2-22 condition test coverage of all instructions at the source code that can affect the generation and display of RAs. These tests may be a combination of module tests, module integration tests and functional tests.
2.3.7.4 Equipment produced under a TSO has obtained FAA concurrence that the software for the equipment was developed in accordance with RTCA/DO- 178B/C to the software level the TSO specifies. Subsequent installations of the same TCAS II equipment on other aircraft types do not require any additional verification if the software and the interface is not changed.
2.3.8 Failure Conditions System Safety Assessment and Design Assurance. Unannunciated failures of the TCAS II equipment, its associated transponder, or sensors or displays that could generate an incorrect or false RA, or result in a missing RA, must be improbable. This can be accomplished using the methods described in AC 25.1309-1A, System Design and Analysis. A functional hazard assessment (FHA), a failure modes and effects analysis (FMEA), and a quantitative probability analysis of the TCAS II equipment, Mode S transponder, displays, and sensors (including altitude information sources) will normally be necessary to show that the system design meets the probabilities specified for the following failure conditions.
Note: Appendix E, Section E.1, Definitions, gives the definitions of a missing RA, incorrect RA, and false RA.
2.3.8.1 The probability of failure of the installed system to perform its intended function from a reliability and availability perspective should be shown to be no greater than 1.0 x10-3 per flight hour.
2.3.8.2 The probability of a missing RA, without indication of loss of capability to generate an RA, should be shown to be no greater than 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.
2.3.8.3 The probability of a false RA aural and visual alert due to a failure of the system should be shown to be no greater than 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.
2.3.8.4 Software that presents incorrect RA aural and visual alerts, or results in a missing RA, is considered a hazardous failure condition. Develop software involved in generating RAs to RTCA/DO-178B/C, Level B standards.
2.3.8.5 The probability of an incorrect RA aural and visual alert due to a failure of the hardware should be shown to be no greater than 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.
2-23
2.3.8.6 The frequency of encounters where another aircraft could present a potential threat depends on the density of aircraft in the airspace. In terminal airspace, you may assume the frequency to be once every 10 hours and, in enroute airspace, it may be once every 200 hours. You may establish different frequencies based on operational data. Provide these analyses for the first installation of TCAS II equipment on a new model aircraft. For subsequent installations of the same equipment in other aircraft, you may use some of the same analyses paying particular attention to the differences in the altitude sensors that are used.
2.3.9 Maintenance Considerations for Hybrid Surveillance Functionality (TSO-C119d and later).
2.3.9.1 RTCA/DO-300A section 2.2.10, Monitoring Requirements, provides a means for annunciation or recording of failures of own-ship latitude, longitude and/or ground speed inputs. Note that a failure of any of these inputs will not cause TCAS to fail, but it will disable the hybrid surveillance functionality.
2.3.9.2 To ensure that latent failures don’t exist in airborne TCAS II units for long periods of time, the system must annunciate failures of hybrid surveillance to the flight crew, or there must be periodic scheduled maintenance tasks to check hybrid surveillance functionality. The instructions for continued airworthiness (ICA) must also require operators to periodically report reliability of the hybrid surveillance functionality. Depending on the level of avionics integration in the aircraft, you can use different methods to ensure the continued airworthiness of the hybrid surveillance such as:
2.3.9.2.1 For those aircraft equipped with an engine indicating and crew alerting (EICAS) system (or other similar annunciation system) integrate the failure information into the warning system such that a failure of hybrid surveillance is annunciated to the flight crew.
2.3.9.2.2 For aircraft equipped with an onboard maintenance computer interfaced with TCAS, add a scheduled maintenance task to the aircraft’s maintenance program to check for presence of any existing or past failures of hybrid surveillance. Take corrective action as specified by the TCAS manufacturer.
2.3.9.2.3 For aircraft without a centralized warning system and/or an onboard maintenance computer, add a scheduled maintenance task to the aircraft’s maintenance program to check for presence of any existing or past failures of hybrid surveillance and to ensure hybrid surveillance is functional.
Take corrective action as specified by the TCAS manufacturer.
2.3.9.2.4 If a scheduled maintenance task is employed, the installer must establish the initial frequency of the task in conjunction with the manufacturer of
2-24 the TCAS equipment but on a frequency not to exceed two calendar years between tasks. Operators can use normal maintenance escalation procedures later to extend the maintenance frequency if they provide adequate justification to do so to the responsible ACO. Coordinate any such extension request with the ACO prior to implementation of changes.
2.3.9.3 The ICA must require operators of TCAS equipment with hybrid surveillance to report hybrid surveillance maintenance history to the TCAS manufacturer periodically but not to exceed 18 calendar months between reports.
2.3.10 Populating Mode S Transponder registers 4016 and 6216 (if implemented).
Some airspace regulations require the transponder to report short term intent data, such as the Selected Altitude data, in transponder replies or via ADS-B. For example, 14 CFR § 91.225 requires that by Jan 1, 2020 specific message elements must be broadcast. Some of those elements are contained in the BDS 6216 register, such as SIL and NACP. Refer to AC 20-165B, Airworthiness Approval of ADS-B Out Systems, for more information on compliance with the requirements of 14 CFR 91.225 and 14 CFR § 91.227. When complying with either the EU Enhanced Surveillance rule or the U.S.
ADS-B rule, the short term intent fields are only required to be implemented if the data is available on the aircraft via a digital interface. For example, there is no expectation that a new autopilot must be installed to comply with reporting Selected Altitude if it is not available from the existing system on the aircraft. Any data that is not available on the aircraft should be reported as zero.
2.3.10.1 Selected Vertical Intention (BDS register 4016). If available, interface the transponder to the aircraft systems that provide vertical intention information for the various subfields in register 4016 e.g. MCP/FCU selected altitude, FMS selected altitude, etc. Appendix F provides guidance for interfacing to these systems.
2.3.10.2 Target State and Status Information (BDS register 6216). If available, interface the transponder to the aircraft systems that provide the transponder with state and status information for the various subfields in register 6216 e.g. SIL supplement, NACP, NICBARO, barometric pressure setting, selected heading, etc. Appendix F provides guidance for interfacing to these systems.
3-1 CHAPTER 3. TEST AND EVALUATION (INITIAL APPROVAL).
3.1 General.
Test the first installation of a manufacturer’s TCAS II or Mode S transponder system.
This will verify the design and installation performs its intended function under the expected operating conditions, and that there are no adverse interactions between the TCAS II or Mode S transponder and existing aircraft systems. The test will also show that other aircraft equipment has not been adversely affected.
3.2 Create a Test Plan.
Provide a test plan that includes adequate testing to perform this verification. This test plan will generally require a combination of ground tests, basic flight tests, and flight tests involving planned encounters with another TCAS II equipped aircraft. You can use an aircraft other than a transport category aircraft for either the TCAS II installation or for the air-to-air cooperative flights. The rest of this chapter lists and explains the minimum elements of the test plan.
3.2.1 Basic Ground Tests.
3.2.1.1 Bearing accuracy.
Demonstrate the bearing estimation accuracy of the TCAS II system as installed in the aircraft. Measure the bearing accuracy using a calibrated antenna range that allows precise echo controlled, far field, angle-of-- arrival measurements at or slightly above zero degrees elevation and over 360 degrees in azimuth. You may also measure the bearing accuracy using a fixed transponder location while rotating the test aircraft on a compass rose while measuring the bearing angles at 30-degree intervals.
Alternately, you may keep the airplane in a fixed position and move the transponder (refer to Appendix B for cautionary note on testing). You may do a manual readout of the bearing estimate directly from a plan position display on the traffic advisory display. Alternatively, you may automatically record the bearing estimates or read them from a special test display. A maximum error of ±15 degrees in azimuth is acceptable;
however, larger errors are acceptable in the area of the tail (for example, within ±45 degrees of the tail) when that area is not visible from the cockpit. In this case, aircraft structure may interfere with the signal path.
3.2.1.2 Sensor failures.
Evaluate simulated failures of the aircraft sensors integrated with TCAS II to determine that the resulting system failure state agrees with the predicted results. These tests should be part of the ground test plan.
3-2
3.2.1.3 Electromagnetic Compatibility (EMC).
Demonstrate that the TCAS II equipment is electromagnetically compatible with previously installed systems or equipment, and is not a source of adverse conducted or radiated interference, and that conducted or radiated interference from previously installed systems and equipment does not adversely affect operation of the TCAS II equipment.
Specifically demonstrate that the TCAS II equipment is electromagnetically compatible with the weather radar, particularly if operating in the C-band.
3.2.1.4 Evaluate the general arrangement and operation of controls, displays, circuit breakers, annunciators, and placards of the TCAS II system.
Conduct a human factors evaluation of the controls, displays and annunciators. Evaluate the TCAS controls and the controls of installed systems that interact with TCAS (for example, transponders) to determine that the control design and location prevents inadvertent actuation.
Evaluate TCAS displays and annunciations to determine that they support flight crew awareness of TCAS status changes which could result from TCAS mode selections, intentional pilot actuation of other installed systems, or inadvertent pilot actions with TCAS or other installed systems.
Evaluate TCAS displays to ensure all information is, at a minimum, legible, unambiguous, and attention-getting (as applicable). In particular, where transponder functions are integrated with other system controls, ensure that unintended transponder mode switching, especially switching to STANDBY or OFF, is not possible. Pay close attention to line select keys, touch screens or cursor controlled trackballs as these can be susceptible to unintended mode selection resulting from their location in the flight deck (for example proximity to a foot rest or adjacent to a temporary stowage area).
3.2.1.5 Evaluate the TCAS II self-test features and failure mode displays and annunciators.
Verify that a TCAS failure and TCAS in the standby mode are properly annunciated in accordance with sections 2.2.10 of this AC.
3.2.1.6 Verify proper interface of the pressure altitude source and radio altimeter with the TCAS II equipment.
3.2.1.7 Verify that the windshear and the ground proximity warning system/terrain awareness warning system (GPWS/TAWS) warnings along with any other higher priority alerts and TCAS II voice alerts are compatible. Also, verify that the flight crew can clearly understand windshear or GPWS/TAWS warnings and that TCAS II automatically switches to the TA Only mode when TCAS II and windshear voice or GPWS/TAWS announcements simultaneously occur. The alert priorities should be windshear, GPWS/TAWS and then TCAS II.
3-3
3.2.1.8 Verify the performance of TCAS II traffic display by observing any available area traffic.
3.2.1.9 Evaluate the TCAS II system installation for satisfactory identification, accessibility, and visibility during both day and night conditions.
3.2.1.10 Determine that any configuration of discretes associated with the TCAS II logic, including inhibits of climb RAs, operate properly. (Changes in logic or function with aircraft configuration, altitude, or speed.)
3.2.1.11 Verify that the ICAO 24-bit aircraft address and maximum airspeed are correct. Additionally, verify that other features, which may be optional, such as extended squitter, aircraft identification reporting or other data link uses also function correctly. Verify that the transponder and data sources meet the requirements of the failure condition classifications associated with the features. For example, an unannunciated failure of the transponder extended squitter resulting in transmission of erroneous information is at least a major failure condition.
3.2.1.12 If connected, verify that the altitude alerter is providing correct data to TCAS and that the TCAS II V7.0 or V7.1 logic, as applicable, correctly weakens or strengthens the displayed RA using the altitude alerter input.
3.2.1.13 Verify that the air/ground inputs are connected properly.
CAUTION: When the aircraft is on the ground, the system must inhibit the Mode S transponder from replying to any Mode A, Mode C, Mode A/C/S all-call interrogations and Mode S-only all-call interrogations. You can usually accomplish this inhibit via an appropriate transponder pin connected through the weight-on-wheels switch, but you might also implement it through other automatic means (for example, velocity/altitude algorithm, etc.). You must verify the inhibit during ground testing.
Note: While on the ground, the transponder normally should stop output of acquisition squitters (short squits), and should continue output of extended squitters (known as long squits or ADS-B) in the surface format, and it should reply to any discretely-addressed aircraft interrogations.
You should also verify this during ground testing. DO-181E section
2.2.18.2.6, Acquisition Squitter Protocols, specifies the exact conditions for transmission of acquisition squitter.
3.2.2 Basic Flight Tests.
3.2.2.1 During all phases of flight, determine if there is any mutual interference with any other aircraft system. Have all installed systems, including the weather radar, operating during the flight test.
3-4
3.2.2.2 Evaluate TCAS II aural messages for acceptable volume and intelligibility during both low and high cockpit noise levels (idle descent at low speed and high power at maximum operating limit speed Vmo) with headset covering outboard ear only (when appropriate) and without headsets. In the case of turbo-prop aircraft where the aircrew utilizes headsets via the aircraft audio distribution panel, the aural messages should hold the same acceptable volume and intelligibility during both low and high cockpit noise levels. If you use the TCAS II TEST to simulate voice announcements, ensure that use of the TEST function does not change the audio level.
3.2.2.3 Demonstrate that traffic information remains valid and usable when the aircraft is pitched ±15 degrees and rolled approximately 30 degrees during normal maneuvers by observing area traffic in the traffic advisory display.
3.2.2.4 Evaluate the effective surveillance range of the traffic display, including target azimuth reasonableness and track stability. Use of targets of opportunity or a non-transport category (low speed) aircraft as a target for these tests is permissible.
3.2.2.5 Determine that any configuration discretes (changes in logic or function with aircraft configuration, altitude, or speed) associated with the TCAS II logic, including inhibits of climb RAs, operate properly unless you have previously demonstrated them during ground tests.
3.2.2.6 Perform the additional flight tests in RTCA/DO-185A or RTCA/DO- 185B, paragraph 3.4.4 as applicable, unless previously accomplished under TSO-C119b or TSO-C119c/d/e respectively.
3.2.2.7 Evaluate TCAS II for noninterference during coupled autopilot and flight director (FD) approaches to the lowest minimums approved for the aircraft.
3.2.2.8 Before any cooperative flight tests at any altitude involving the TCAS II- equipped aircraft and another aircraft, fly both aircraft in close formation to ensure matched altimetry readouts. You should fly these checks at the speeds and altitudes you will use for the tests.
3.2.2.9 Evaluate all selectable modes of the TCAS II to determine that they perform their intended function and that the system clearly and uniquely annunciates the operating mode.
3.2.2.10 Re-evaluate any previously installed aircraft systems that required changes as a result of the TCAS II installation. (For example, electronic flight instrument system (EFIS), FD, PFD, navigation displays (ND), IVSI, interface etc.)
3-5
3.2.2.11 If you include hybrid surveillance functionality, perform the flight tests in RTCA/DO-300, dated December 13, 2006 (including Change 2, dated December 15, 2015) or DO-300A, dated March 20, 2013 (including Change 1, dated December 15, 2015), MOPS for Traffic Alert and Collision Avoidance System II (TCAS II) Hybrid Surveillance, paragraph 3, as appropriate unless previously accomplished under TSO-C119c, TSO- C119d or TSO-C119e.
3.2.3 Planned Encounter Flight Tests.
The objective of these flight tests is to demonstrate adequate TCAS II surveillance and to verify smooth, predictable TCAS II performance. First establish the appropriate safety rules, static system leak test (if needed due to having opened the system), and altimeter correlation between the encounter aircraft and the TCAS aircraft. You should fly the following encounters between the TCAS II aircraft and a dedicated intruder aircraft to assure that the TCAS II aircraft system performs its intended function by generating TAs and RAs, and is consistent with RTCA/DO-185A or RTCA/DO-185B as applicable, and RTCA/DO-300 (including Change 2) or RTCA/DO-300A (including Change 1) as appropriate. The intruder aircraft must have a previously approved transponder installation capable of Mode A, Mode C, and for those tests necessary, Mode S, TCAS II and ADS-B Mode S Extended Squitter if appropriate. These tests are also to expose the installed TCAS II system to a reasonable number of carefully controlled encounters that are likely to occur in service. This matrix covers the envelope of encounter speeds, altitudes, and geometries that have in the past identified flaws in surveillance, logic, and antenna mechanization that bench tests did not detect earlier. Fly the following encounters:
3.2.3.1 Intruder overtaking TCAS II aircraft (from the aft quadrants).
3.2.3.2 Head-on.
3.2.3.2.1 Low and high closure speeds.
3.2.3.2.2 Above climb limit, TCAS II to TCAS II.
3.2.3.2.3 TCAS II against Mode C with TCAS II above intruder and above climb limit (intent is to force TCAS II aircraft to descend.)
3.2.3.2.4 At 3000 feet over calm water to evaluate multipath protection.
3.2.3.3 Converging.
3.2.3.3.1 Crossing (intruder above TCAS II, descending or vice versa.)
3.2.3.3.2 Evaluate the TA-only mode during planned encounters.
3.2.3.3.3 Evaluate a mix of intruder transponder modes (A, C, S and S with extended squitter) but primary emphasis should be on
3-6 TCAS II-to-TCAS II coordination, and on Mode C replies from the intruder aircraft.
3.2.3.3.4 Evaluate a mix of encounters with TCAS II both above and below the intruder.
3.2.3.3.5 If a flight test is necessary to ensure compatibility with other designs, verify correct air-to-air coordination between the test TCAS II and another manufacturer’s previously approved equipment (refer to paragraph 2.3.3).
3.2.3.3.6 Evaluate the effect of electrical transients (bus transfer) during encounters.
The TCAS II should not experience adverse effects. Electrical transients should not result in generation of any false TAs or RAs. Normal TCAS II functions and displays should be restored within approximately three seconds.
3.2.4 Mode S Transponder Tests.
3.2.4.1 This section provides select guidance for certain extended squitter and ELS/EHS surveillance messaging. Refer to the EASA and JAA publications mentioned in paragraph 1.5 for guidance on ELS/EHS capabilities.
3.2.4.2 You can use the tests in these paragraphs to obtain the certification of a stand-alone Mode S transponder installation (an installation without TCAS II). You should also use these tests to evaluate a Mode S transponder installed as part of a TCAS II installation. The tests primarily verify the installed antenna(s) are compatible with the Mode S transponder and provide an adequate response to ground radar interrogations during normal aircraft maneuvers.
3.2.4.3 Additionally, these tests demonstrate that the Mode S transponder functions properly as installed and does not interfere with other aircraft electronic equipment. You don’t need to do as much detailed flight test when the Mode S transponder and antenna installation are identical or similar to that of a previously approved ATCRBS transponder installation.
If you are upgrading a previously installed and certified transponder, you don’t necessarily need to follow all of the guidance in this section to approve the upgrade. You should accomplish a careful examination of the proposed transponder upgrade to determine which of the tests in this section are necessary and appropriate. Typical testing associated with the initial installation and certification of a new transponder may not be necessary when upgrading a previously approved transponder. For example, if you are considering a software upgrade that would add extended squitter functionality to a transponder in a previously approved installation, you won’t need detailed flights if appropriate ground testing adequately evaluates the added functionality.
3-7 CAUTION: When conducting flight testing of the transponder or TCAS system, you must prevent being a source of interference to ATC or other TCAS aircraft operating in the area. For example, using a fixed transponder to simulate an intruder aircraft can cause transmission of data which produce false targets for the ground ATC surveillance systems or airborne TCAS aircraft. These false indications of “intruder aircraft” could result in unnecessary ATC communications and possibly in TCAS induced aircraft maneuvers. Therefore, conduct such testing in coordination with ATC.
Note: The conduct of this test requires cooperation with ATC controllers.
Coordination with ATC is important before the flight test for any necessary approval of the flight and agreement with the flight test procedures. During the flight test, the test crew will need to communicate with the controller monitoring the aircraft and reporting transponder performance data.
3.2.4.4 If the Mode S transponder uses a top mounted antenna in addition to a bottom mounted antenna installed at, or near, the same location used by a previously approved ATCRBS transponder antenna, conduct a comprehensive ground test and evaluation in accordance with Appendix B and perform a functional flight test. The transponder code, altitude reporting and “IDENT” features of the transponder should be exercised during normal maneuvering. The ATC controller should not observe any objectionable behavior.
3.2.4.5 If a Mode S transponder is installed in an aircraft which does not have a previously approved ATCRBS transponder installation, or that uses a bottom mounted antenna location which differs significantly from that used by a previously approved ATCRBS transponder antenna, conduct the following ground and flight tests:
Note: References to the radar facility are references to the radar that provides the data used by the ATC controller(s) during the flight test for monitoring the aircraft and reporting transponder performance data. In other words, these refer to where the radar antenna/interrogator is located, not the displays used by the controllers.
3.2.4.6 Conduct ground tests and evaluations per Appendix B.
3.2.4.7 Climb and Distance Coverage.
Begin at a distance of at least 10 nautical miles (NM) from, and an altitude of 2000 to 3000 feet above, the radar facility. Using a transponder code assigned by ATC, fly on a heading that will pass the aircraft over the radar facility. At a distance of 5 to 10 NM beyond the radar facility, fly the aircraft at its normal maximum climb attitude to within 90 percent of the certificated altitude for the aircraft, maintaining the aircraft heading within
3-8 5 degrees of the track from the radar facility. After reaching the maximum altitude for which the aircraft is certificated, fly level at the maximum altitude to 160 NM for turbojet and some turboprop powered airplanes (or 80 NM for most other aircraft) from the radar facility. (Distance from the radar facility is a function of the airplane’s maximum certificated altitude.)
Communicate with the ATC controller to check for evidence of transponder dropout. During the flight, check the “IDENT” mode of the ATC transponder to assure that it is performing its intended function.
There should be no unexpected dropouts (no return for two or more sweeps). Uncontrollable ringing that hinders use of the ground radar is unsatisfactory.
3.2.4.8 Long Range Reception.
At 90 percent of maximum certificated altitude, perform left and right 360-degree turns, at bank angles of 8 to 10 degrees. The aircraft should be at least 160 (or 80) NM from the radar facility. During these turns, request that the ATC controller monitor the radar displays. There should be no dropouts (no return for two or more sweeps).
3.2.4.9 High Angle Reception.
Perform two 360-degree turns, one to the right and one to the left, at bank angles of 8 to 10 degrees with the airplane at a distance of 50 to 70 NM from the radar facility and at an altitude of at least 35,000 feet or within 90 percent of the maximum altitude for which the aircraft is certificated.
There should be no dropouts (no return for two or more sweeps). Switch the transponder to a new code assigned by the ATC controller. The aircraft secondary return on the ATC controller’s radar display should indicate a Mode A code change.
3.2.4.10 High Altitude Cruise.
Within 90 percent of the aircraft’s maximum certificated altitude or its maximum operating altitude beginning at a point 160 (or 80) NM from the radar facility, fly on a course that will pass over the radar facility. The ATC controller should report no unexpected transponder dropout or “ring around.”
3.2.4.11 Surveillance Approach.
Beginning at or above 90 percent of the certificated maximum altitude for the aircraft, perform a letdown and approach to a runway of an airport served by Airport Surveillance Radar (ASR) having an ATCRBS facility.
Make the approach at the maximum normal rate of descent. Normal approach and landing configuration for the aircraft should continue down to an altitude of 200 feet or less above the ground radar antenna elevation.
Not more than one dropout should occur for any 10 sweeps during final
3-9 approach. Uncontrolled ringing that hinders use of the ground radar is unsatisfactory.
3.2.4.12 Holding and Orbiting Patterns.
3.2.4.12.1 At an altitude of 2000 feet above the radar antenna or minimum obstruction clearance altitude (whichever is greater) with landing flaps and gear extended, fly left and right 360-degree turns approximately 10 miles from the radar facility. There should be no signal dropouts.
3.2.4.12.2 At an altitude of 2000 feet above the radar antenna or minimum obstruction clearance altitude (whichever is greater), fly 45 degree sectors of left and right 10 mile orbital patterns around a radar facility with gear and landing flaps extended. There should be no signal dropouts.
3.2.4.13 Altitude Reporting.
Conduct a functional test of the altitude encoder by comparison with ATC displayed altitudes. Verify correspondence at several altitudes between ATC readings and the Captain’s altimeter, when set at or corrected to
29.92 inches of mercury (or equivalent).
3.2.4.14 Verify that a transponder failure and transponder in the standby mode are properly annunciated in accordance with sections 2.2.10 of this AC.