manufacturer’s approved TCAS II system in your evaluation. If it can be shown for a specific design that communication link failures are no more hazardous than encountering a Mode C intruder, then these tests are not necessary. Also, after completing mature bench tests, future certification experience may show that these tests are no longer necessary. Submit evidence to show that you performed TCAS/transponder interoperability bench tests using the same TCAS/transponder pairing (the same part numbers) as the installation seeking certification.
Interoperability bench tests can be satisfied by either of the following:
a. Execute the following RTCA/DO-185A or RTCA/DO-185B tests as applicable, using the actual TCAS unit and Mode S transponder seeking certification:
(1) 2.4.2.2.3.1 and 2,
(2) 2.4.2.2.4.1,
(3) 2.4.2.2.4.2.1, 3 and 5-8, and,
(4) 2.4.2.2.5.
b. Execute the following tests in RTCA/DO-181E as applicable, Minimum Operational Performance Standards for Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment, using the actual TCAS unit and Mode S transponder seeking certification:
(1) Procedure 30,
(2) Procedure 31 a-d,
(3) Procedure 32a-c and d (1 & 2),
(4) Procedure 34,
(5) Procedure 36 a and c, and,
(6) Procedure 37 a and b.
c. In addition, execute the following RTCA/DO-181E tests as applicable, using a TCAS simulator coupled with the actual Mode S transponder:
(1) Procedure 31e,
(2) Procedure 32d (3-16),
(3) Procedure 33,
(4) Procedure 35, 11
(5) Procedure 36b,
(6) Procedure 37c and,
(7) Procedure 38.
2-16. Aircraft Performance Considerations. Use paragraphs 2-16 through 2-17 and Table 1 of this AC to help you evaluate the need to inhibit TCAS II CLIMB and/or INCREASE CLIMB RAs resulting from inadequate aircraft climb performance. The collision avoidance maneuvers posted as RAs by TCAS II assume an aircraft’s ability to safely achieve them. If it’s likely the required response to CLIMB and INCREASE CLIMB RAs are beyond the performance capability of the aircraft, then TCAS II must know beforehand so it can change strategy and issue an alternative RA. These performance limits must be provided to TCAS II from the aircraft interface and discrete settings relative to altitude and/or aircraft configuration. However, carefully consider the need to inhibit TCAS II CLIMB or INCREASE CLIMB RAs since the alternative RAs may not provide the optimum solution to the encounter. Inhibiting these RAs will increase the likelihood of TCAS II:
a. Issuing crossing maneuvers (crossing through an intruder’s altitude), thus increasing the probability that an RA may be thwarted by the intruder maneuvering,
b. Causing an increase in DESCEND RAs at low altitude, and
c. Providing no RAs if below the descend inhibit altitude of 1200 feet AGL during takeoff and 1000 feet AGL on approach.
2-17. Evaluating Aircraft Performance . The configuration interface may need switches or sensors, besides the basic airplane flap position switches, to prevent unnecessary TCAS II inhibits. For example, if CLIMB RAs need to be inhibited for the maximum takeoff flap setting only, and no switch exists to sense that position, install an additional switch instead of simply using one that may exist at lesser flap angle settings.
a. Because TCAS II can only accept a limited number of inputs related to airplane performance, it’s not possible to automatically inhibit CLIMB and INCREASE CLIMB RAs in all cases where it may be appropriate to inhibit such RAs. In these cases, TCAS II may command maneuvers that may significantly reduce stall margins or result in stall warnings.
Conditions where this may occur include bank angles greater than 15 degrees, weight/altitude/temperature combinations outside the envelope shown in Table 1, initial speeds below those shown in Table 1, one engine inoperative, leaving the aircraft configuration fixed for climb RAs on landing transition to go-around, and abnormal configurations such as landing gear not retractable. Provide information concerning this aspect of TCAS in the airplane flight manual (AFM) or airplane flight manual supplement (AFMS) so that flight crews may take appropriate action.
b. An aircraft’s low altitude climb capability during takeoff, approach, or landing is significantly affected by the aircraft’s configuration, true airspeed available during initial climb to safely trade for climb rate if needed, and the initial airspeed margin from the current stall speed.
(1) Table 1, Conditions 1 through 3 apply to the takeoff and initial climb configuration analysis.
(2) Table 1, Conditions 4 through 6 apply to the approach flap configuration analysis when operating in the terminal area with the flaps set at less than the landing flaps.
(3) Table 1, Conditions 7 through 9 apply to the landing flight regime analysis. To be consistent with normal operation, indicate in the AFM or AFMS that when a climb RA occurs with the aircraft in the landing configuration, the pilot should initiate the normal go-around procedure when complying with the TCAS II RA. Therefore, we can assume that the flaps are being retracted from the landing position to the go-around position when evaluating Table 1, Conditions 7 through 9.
c. To prevent very unlikely combinations of events, such as weight/altitude/temperature limiting conditions, in conjunction with low airspeed, high drag configurations, and unusual encounter geometries causing climb inhibits when the aircraft’s performance is more than adequate, the entry and exit conditions and RAs in Table 1 are structured into two classes of encounters.
(1) Maneuvers A and B represent reasonably severe combinations of entry conditions and RAs, and restricts the exit conditions to an airspeed of 1.2VS1 (or 1.13VSR1 for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS)).
(2) Maneuver C represents reasonably worst-case combinations of entry conditions and RAs, and this very unlikely event may require flying near stall warning conditions through the recovery.
(3) Airspeeds between 1.2VS1 (or 1.13VSR1 for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS)) and stall warning represent a range of usable airspeeds that may be traded for climb performance (as is currently recommended for wind shear recovery) for evaluation of this low probability event. The altitude/temperature envelope represents a range of values that exist at busy airports in the continental United States. Operations outside this envelope may require special crew procedures if the normal AFM weight, altitude, temperature, and configuration limitations are not sufficiently compensating, such as operation at Mexico City.
d. For those airplanes that may routinely operate at low climb airspeeds during the clean configuration, enroute phase of flight, such as propeller commuter airplanes, consider providing a discrete to the TCAS II based on airspeed. Such an input, derived from a TCAS II interface system, would provide for CLIMB or INCREASE CLIMB RA inhibits when the airplane is in the clean configuration and operating below a certain airspeed. We consider such a scheme appropriate instead of an across-the-board inhibit for the clean configuration regardless of flight 13
regime (which is not considered to provide the best overall level of safety as previously discussed for other configurations).
e. An aircraft’s climb capability when operating at or near maximum approved operating altitude is also affected by excess thrust and true airspeed that may be available to safely trade for climb rate. Climb RAs should not be inhibited if the aircraft has adequate performance available or because it may exceed its maximum certificated altitude by several hundred feet during an RA. Configurations that should be evaluated in this flight regime are shown in Table 1, Conditions 10 and 11. If the aircraft is approved for significant alternative configurations, (such as spare engine pod and gear down operation,) then the initial airspeed used for the analysis should be appropriate for them. In the analysis of the aircraft’s ability to accelerate and return to the initial speed and altitude following the RA, an undershoot of approximately 200 feet is permissible.
f. In icing conditions, the aircraft limited performance weights are reduced, and sometimes the operating speeds increased, to account for icing system bleeds and residual ice drag on the unprotected surfaces. Therefore, the capability to perform the TCAS II maneuvers remains essentially unchanged, eliminating the need to provide additional RA inhibits under these circumstances. However, if a particular aircraft design shows marginal capability to operate in the icing environment, consider additional RA inhibits enabled by icing system activation.
g. If Table 1, Maneuver A causes operation at airspeeds below the minimum, then inhibit the CLIMB RA. If Table 1, Maneuver B or C causes operation at airspeeds below the minimum, then inhibit the INCREASE CLIMB RA. However, early recovery of 1 to 2 seconds is of little or no consequence on the collision avoidance maneuver and a higher overall level of safety will be achieved if inhibits are not provided under these circumstances, as previously discussed in paragraph 2-16.
Table 1. Maneuvers
CONDITION FLIGHT REGIME WEIGHT
ALTITUDE, TEMPERATURE1
THRUST FLAPS GEAR AIRSPEED2 MANEUVER3
INITIAL MINIMUM 1 Takeoff Part 25 climb limit Maximum rated takeoff All takeoff Up V2+204 1.2VS1 5 thru RA A 2 Takeoff Part 25 climb limit Maximum rated takeoff All takeoff Up V2+204 1.2VS1 5 thru RA B 3 Takeoff Part 25 Climb limit Maximum rated takeoff All takeoff Up AFM all-engine takeoff speed6 15° bank to stall warning7 thru recovery C 4 Approach Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust for level flight Less than landing Up 1.6VS1 1.2VS1 5 thru RA A 5 Approach Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust for level flight Less than landing Up 1.6VS1 1.2VS1 5 thru RA B 6 Approach Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust for level flight Less than landing Up, or down to up Min. maneuver speed from training procedures 15° bank to stall earning7 thru recovery C 7 Landing, Transition to Go- Around at RA Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust required for 3° glideslope Transition from landing flap to goaround flap Down to up VREF + 10 1.2VS1 5 thru RA A 8 Landing, Transition to Go- Around at RA Part 25 Climb limit Spin up to max go-around thrust during maneuver from thrust required for 3° glideslope Transition from landing flap to goaround flap Down to up VREF + 10 1.2VS1 5 thru RA B 15
Table 1. Maneuvers (continued)
CONDITION FLIGHT REGIME WEIGHT
ALTITUDE, TEMPERATURE1
THRUST FLAPS GEAR AIRSPEED2 MANEUVER3
INITIAL MINIMUM 9 Landing, Transition to Go- Around at RA Part 25 climb limit Spin up to max go-around thrust during maneuver from thrust required for 3° glideslope Transition from landing flap to goaround flap Down to up VREF + airspeed addition from training procedures 15° bank to stall warning7 thru recovery C 10 En Route Critical Wt/Alt giving 0.3g to buffet onset Thrust for level flight increased to max continuous, if required Up Up Long-range cruise Higher of 1.2VS 5 if defined or buffet onset A 11 En Route Critical Wt/Alt giving 0.3g to buffet onset Thrust for level flight increased to max continuous, if required Up Up Long-range cruise Higher of 1.2VS 5 if defined or buffet onset B NOTES:1. Weight = Lesser of climb limit or structural; Airport Pressure Altitude = sea level to 5300 ft; Temperature = ISA ± 50 °F; Conditions 1 through 3 evaluated 700 ft above airport; Conditions 4 - 9 evaluated 1700 ft above airport.
2. For those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS), replace 1.2 VS1 with 1.13 VSR1, 1.2VS with 1.13 VSR and 1.6 VS1 with 1.5 VSR1.
3. Maneuvers:
Maneuver A evaluates the TCAS II CLIMB RA. From the initial steady -state condition, after a 3-second pilot-reaction time delay, rotate the aircraft at 1.25 g to attain +1500 feet per minute climb. Hold until the total duration of the RA of 25 seconds has elapsed. Recover to attain the initial trim airspeed.
Maneuver B evaluates the TCAS II INCREASE CLIMB RA following a CLIMB RA.
From the initial steady-state condition, after a 3-second pilot-reaction time delay, rotate the aircraft at 1.25 g to attain +1500 feet per minute climb. Hold until 15 seconds has elapsed from when the CLIMB RA was issued. Then, after a 1-second pilot reaction time-delay to the INCREASE CLIMB RA, rotate the aircraft again at
1.25 g to attain +2500 feet per minute climb and hold until the total duration of the RA of 25 seconds has elapsed. Recover to attain the initial trim airspeed.
Maneuver C evaluates a maximum duration TCAS II INCREASE CLIMB RA following a minimum duration CLIMB RA. From the initial steady -state condition, after a 3-second pilot-reaction time delay, rotate the aircraft at 1.25 g targeting +1500 feet per minute climb until 6 seconds has elapsed from when the CLIMB RA was issued. Then, after a 1-second pilot-reaction time delay to the INCREASE CLIMB RA, rotate the aircraft again at 1.25 g to attain +2500 feet per minute climb and hold until the total duration of the RA of 25 seconds has elapsed. Recover to attain the initial trim airspeed.
4. Vy + 10 for nontransport category aircraft without a defined V2.
5. For those airplanes where the power-on stalling speed is significantly reduced from the power-off stalling speed, use 1.1 VS or 1.08VSR for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS).
6. Vy for nontransport category aircraft without a defined V2.
7. For those airplanes where the power-on stalling speed is significantly reduced from the power-off stalling speed, use VS1 or 0.94VSR1 for those airplanes that use reference stall speed (VSR) in lieu of stalling speed (VS).
h. A summary of the system inhibits (limitations) programmed into the TCAS II computer is given in Table 2 below.
Table 2. System Inhibits
INHIBIT PARAMETERS Increase Descent RA Inhibited below 1650 ft AGL while climbing and inhibited below 1450 ft AGL while descending.
Descend RA Inhibited below 1200 ft AGL while climbing and inhibited below 1000 ft AGL while descending.
TA Voice Messages Inhibited below 400 ft AGL while descending and inhibited below 600 ft AGL while climbing.
RAs Inhibited below 1100 ft AGL while climbing, and inhibited below 900 ft AGL while descending. (TCAS automatically reverts to TA only).
Self-Test Can be inhibited when airborne.
Advisory Priority Automatically reverts to TA only when higher priority advisories (such as GPWS/TAWS and windshear) occur.
Climb RA Can be inhibited, based upon aircraft performance capability.
Increase Climb RA Can be inhibited, based upon aircraft performance capability.
2-18. How Aircraft Systems Should Interface with TCAS II.
a. Pressure altitude information. The pressure altitude data must be from the most accurate source available in the aircraft and it must correspond to that being transmitted by the associated Mode S transponder. The accuracy of the altitude data must be at least that specified in RTCA-DO-185A or RTCA/DO-185B, paragraph 3.2.8 as applicable. It must be shown that the resolution of the altimetry source is compatible with TCAS II. The altitude source with the finest compatible resolution must be used. When available, the resolution should be in increments of 10 feet or less. Also provide information to indicate when the pressure altitude information is invalid.
b. Radio altitude information. Provide radio altitude information to the TCAS II to inhibit:
(1) INCREASE DESCENT RAs below 1650 ft AGL while climbing and below 1450 ft AGL while descending,
(2) DESCEND RAs below 1200 ft AGL while climbing and below 1000 ft AGL while descending, 18
(3) All TA voice messages (aural traffic advisories) below 400 ft AGL while descending and below 600 ft AGL while climbing, and
(4) All RAs below 1100 ft AGL while climbing and below 900 ft AGL while descending, to allow automatic sensitivity level selection when close to the ground, and to determine that individual targets are on the ground.
(5) Also provide information to indicate when the radio altitude information is invalid.
c. Aircraft configuration. Use discrete information from flaps, slat, landing gear, and/or other aircraft configuration sensors to ensure that TCAS II appropriately inhibits CLIMB and INCREASE CLIMB RAs to the airplane performance limits as described in paragraph 2-16 and 2-17.
d. Aircraft identification. Provide discrete information to the Mode S transponder for the unique aircraft Mode S identification code and its maximum airspeed capability.
e. Attitude. Aircraft pitch and roll attitude may be provided to assist with stabilization of the directional antenna function to assure surveillance and to ensure TA display data remain unaffected by aircraft normal maneuvers. If attitude information is used by TCAS II, provide information to indicate when the attitude data are invalid.
f. Heading. Aircraft heading may be provided for the TA display reference presentation. Information must also be provided to indicate when the heading data are invalid.
g. System failure display. Provide an indication to indicate when RAs are not possible due to failure of the TCAS II equipment or any of its sensors or displays.
h. Altitude alerter data. You may provide the current clearance altitude from the altitude alerter to enable TCAS II to select RAs that are more consistent with the aircraft’s altitude clearance once the immediate collision threat has been resolved.
NOTE: Altitude alert functionality is optional per RTCA/DO-185A and RTCA/DO-185B. Not all TSO-C119( ) TCAS II units will have this option available.
i. Mode S Transponder Gillham altitude input requirements. The Gillham format uses 11 discrete wires that, depending on which wires are turned off or on, represent an altitude value. The Gillham format is sometimes called a blind encoder, as error detection and/or correction on the wires is not conducted. For this reason, ARINC 718, Mark 3 Air Traffic Control Transponder (ATCRBS/MODE S), dated December 1989, states: “Pins have been reserved to permit the direct application of Gillham code data to the transponder. This practice is not encouraged because of concerns that a “stuck bit” in the coded input could be the cause of serious errors in TCAS II resolution advisories.” This is a failure mode peculiar to t he Gillham code against which protection is virtually impossible. If Gillham coded altitude use cannot be 19
avoided for the TCAS II installations, two sources of altitude information must be connected to the transponder and their values compared. All transponder altitude comparator failures must be annunciated.
j. Hybrid surveillance failure annunciations (TSO-C119d units only). For aircraft equipped with centralized alert and warning system and or an onboard maintenance system, consideration should be given to integrating the hybrid surveillance alerting functionality into the system so as to alert the crew with an appropriate failure annunciation. Refer to section 2-21 for more information.
2-19. Verifying and Validating TCAS II Software . It is required for the first installation of a manufacturer’s TCAS II equipment to verify and validate TCAS II software using the procedures outlined below. Also, apply these procedures to subsequent software changes to a manufacturer’s TCAS II equipment. A manufacturer may provide a design that partitions the software, which affects RAs from other software such as that necessary for the traffic display.
The TCAS II manufacturer may not use the minor change authority of the TSO system to change any software not partitioned from the software that affects RAs.
a. Verification and validation of TCAS II software represents a unique challenge.
Collision avoidance algorithms, commonly called “the CAS logic,” are specified in detail in a formal statechart representation in the CAS requirements specification (CRS) in RTCA/DO-185A, Volume II and RTCA/DO-185B, Volume II. In addition, Attachment A of Volume II provides a software design specification in pseudocode that meets these requirements.
This detail is required because the coordination algorithms in the CAS logic assume that the software implemented by all manufacturers will have exactly the same CAS logic. However, the surveillance software necessary to establish and maintain the relative tracks of nearby transponder-equipped aircraft and the software necessary to provide the interface with the Mode S transponder and with other aircraft sensors and displays, must be developed by the manufacturer of the TCAS II equipment. This hybrid approach to the specification of the software requirements means that the application of the software criteria in RTCA/DO-178B, Software Considerations in Airborne Systems and Equipment Certifications, dated December 1, 1992, for the detailed CAS requirements and the pseudocode software design have been satisfied by the FAA and our contractors, while the remaining requirements of RTCA/DO-178B are the responsibility of the manufacturer.
b. If software is used for the display of TCAS II RAs or in the operation of the Mode S transponder data link, the verification and validation of this software must be done to Level B requirements, as defined in RTCA/DO-178B. Also, apply these procedures when the TCAS II manufacturer develops the software requirements for the TCAS II processor associated with functions other than surveillance or the CAS logic. With the software design specified in RTCA/DO-185A, Volume II or RTCA/DO-185B, Volume II, the manufacturer of the TCAS II processor should conduct code walk-throughs and develop and perform module tests and module integration tests to verify that the specified software design was implemented correctly. This includes the surveillance software necessary to establish and maintain the relative tracks of nearby transponder-equipped aircraft.
c. The functional tests required by TSO-C119b and TSO-C119c/TSO-C119d, as described in RTCA/DO-185A, Volume I and RTCA/DO-185B, Volume I respectively, do not provide complete testing for the TCAS II processor software. However, coverage analysis performed on the CAS test suite, described in Volume I, demonstrated that each column of every transition table and macro, and each identity transition in the CAS requirements specification in RTCA/DO-185A, Volume II or RTCA/DO-185B, Volume II is tested by the CAS test suite.
Thus, the CAS test suite provides more than full decision coverage (but not full condition coverage) as defined in RTCA/DO-178B. TCAS II manufacturers must develop additional functional tests that correspond to the detailed requirements that they develop for the TCAS II processor. The potential consequences of software errors in the TCAS II processor or resolution display require the manufacturer to provide a structural coverage analysis showing single condition test coverage of all instructions at the source code that can affect the generation and display of RAs. These tests may be a combination of module tests, module integration tests and functional tests.
d. Equipment produced under a TSO has obtained FAA concurrence that the software for the equipment was produced in accordance with RTCA/DO-178B for a particular software level. Subsequent installations of the same TCAS II equipment on other aircraft types do not require any additional verification if the software and the interface is not changed.
2-20. Testing for Failures System Safety Analysis. Unannunciated failures of the TCAS II equipment, its associated transponder, or sensors or displays that could generate an incorrect RA, must be improbable. This can be accomplished using the methods described in AC 25.1309-1A, System Design and Analysis. We expect that a functional hazard assessment (FHA), a failure modes and effects analysis (FMEA), and a quantitative probability analysis of the TCAS II equipment, Mode S transponder, displays, and sensors (including altitude information sources) will be necessary to establish that a false RA is improbable. Specifically, show that the probability of an incorrect RA without a failure annunciation is on the order of 1.0 x 10-4 per flight hour in the terminal environment and 1.0 x 10-5 per flight hour in the enroute environment.
The frequency of encounters where another aircraft could present a potential threat depends on the density of aircraft in the airspace. In terminal airspace, the frequency may be assumed to be once every 10 hours and, in enroute airspace, it may be once every 200 hours. You may establish different frequencies based on operational data. Provide these analyses for the first installation of TCAS II equipment on a new model aircraft. For subsequent installations of the same equipment in other aircraft, you may use some of the same analyses paying particular attention to the differences in the altitude sensors that are used.
NOTE: Develop software involved in generating RAs to RTCA/DO178B, Level B standards.
2-21. Maintenance Considerations for Hybrid Surveillance Functionality (TSO-C119d only).
a. RTCA/DO-300A section 2.2.10, Monitoring Requirements, provides a means for annunciation or recording of failures of own-ship latitude, longitude and/or ground speed inputs.
Note that a failure of any of these inputs will not cause TCAS to fail, but it will disable the hybrid surveillance functionality.
b. To ensure that hidden failures are not resident in airborne TCAS II units for long periods of time, failures of hybrid surveillance must be annunciated to the flight crew or the continued airworthiness must be assessed during periodic scheduled maintenance tasks. Periodic reliability reporting for the hybrid surveillance functionality is also required. Depending on the level of avionics integration in the aircraft, different methods can be used to ensure the continued airworthiness of the hybrid surveillance such as:
(1) For those aircraft equipped with an engine indicating and crew alerting (EICAS) system (or other similar annunciation system) integrate the failure information into the warning system such that a failure of hybrid surveillance is annunciated to the flight crew.
(2) For aircraft equipped with an onboard maintenance computer interfaced with TCAS, add a scheduled maintenance task to the aircraft’s maintenance program to check for presence of any existing or past failures of hybrid surveillance. Take corrective action as specified by the TCAS manufacturer.
(3) For aircraft without a centralized warning system and/or an onboard maintenance computer, add a scheduled maintenance task to the aircraft’s maintenance program to check for presence of any existing or past failures of hybrid surveillance and to ensure hybrid surveillance is functional. Take corrective action as specified by the TCAS manufacturer.
(4) If a scheduled maintenance task is employed, the installer must establish the initial frequency of the task in conjunction with the manufacturer of the TCAS equipment but on a frequency not to exceed two calendar years between tasks. Normal maintenance escalation procedures could later be used to extend the maintenance frequency when adequate justification to do so is provided to the cognizant ACO. Coordinate any such extension request with the ACO prior to implementation of changes.
c. Operators of TCAS equipment with hybrid surveillance are required to report hybrid surveillance maintenance history to the TCAS manufacturer periodically but not to exceed 18 calendar months between reports.