Appendix A A.2.2.5 32 dB Attenuation.
This attenuation is appropriate when the level A display equipment and all associated wiring to and from equipment are located entirely within areas with very effective HIRF shielding to form an electromagnetic enclosure.
A.2.2.6 Generic Attenuation for Rotorcraft.
Display units installed in rotorcraft typically have minimal attenuation unless specific shielding is provided in the bulkhead, glare shield, panel, and doors.
A.2.3 Different attenuation values may be appropriate for different frequency ranges. For example, 0 dB attenuation may be used for the frequency range of 100 MHz to 400 MHz, 6 dB attenuation for the frequency range of 400 MHz to 1 GHz, and 12 dB attenuation for the frequency range of 1 GHz to 18 GHz. If you intend to use different attenuation values for various frequency ranges, then you should also provide the supporting rationale.
A.2.4 Consult the user’s guide for details on the use of generic attenuation.
A-5
Appendix A A.3 MEASURED TRANSFER FUNCTIONS OR ATTENUATION.
You can produce your own generic transfer functions and attenuation for your level A display systems (see paragraph 10.11) based on actual measurement s on your aircraft models. These transfer functions and attenuation can then be used in your HIRF compliance submission in place of the generic transfer functions and attenuation specified in this appendix. The FAA encourages this approach because it provi des a more accurate reflection of the true internal HIRF environment for your aircraft models.
However, if you intend to produce your own generic transfer functions and attenuation, then this approach should also be addressed in the HIRF compliance plan (s ee paragraph 9.1) that is submitted to the FAA for approval.
Figure A-6 Generic Attenuation Values – All Aircraft 100 MHz to 18 GHz A-6
Appendix B Appendix B. Examples of HIRF Safety Assessment Considerations - Level A Systems on Transport Category Airplanes B.1 EXAMPLES OF HIRF SAFETY ASSESSMENT CONSIDERATIONS .
B.1.1 This appendix contains examples of HIRF safety assessment c onsiderations for level A systems of transport category airplanes. These HIRF safety assessment considerations for level A systems may be applicable to normal category airplanes and rotorcraft .
Establishing appropriate pass/fail criteria for complying with § 25.1317(a) should be achieved through a comprehensive review of the system design using an acceptable HIRF functional hazard assessment process to determine the system’s HCL. The following paragraphs summarize approaches whereby pass /fail criteria for compliance with § 25.1317(a) may depend on the specific system architecture attributes (for example, system with similar redundant channels, dissimilar redundant channels, combination of similar and dissimilar redundant channels) . For evaluation of the examples in paragraph B.1.2 of this appendix, consider the specific system architecture attributes. Channel modes as used in this appendix mean the following:
• Active mode means the channel is performing the aircraft function during normal operation.
• Active-backup mode means the channel is operational (in the ready state), but not used to perform the aircraft function until switched to active mode, either automatically or by flightcrew action.
• Passive-backup mode means the channel is not operational (not in the ready state).
Switching to active mode is either automatic or by flightcrew action upon failure recognition.
Systems are typically categorized with the following archit ectures:
B.1.1.1 Similar Redundant Channels .
The multiple channels consist of equipment, components, electrical interconnections , and configurations that are similar, typically with equipment that have identical part numbers. The channels should be independent. Th ey may be configured in active, active-backup, and passive-backup modes.
B.1.1.2 Dissimilar Redundant Channels .
Each channel is unique (comprises different equipment, components, electrical interconnections, and configurations) and independent of the others. They may be configured in active, active-backup, and passive-backup modes.
B.1.1.3 Combination of Similar and Dissimilar Redundant Channels .
The combination of similar redundant channels and dissimilar redundant channels, as defined above, with independence between channels. They may be configured in active, active-backup, and passive-backup modes.
B-1
Appendix B B.1.1.4 Combination of Electrical and Electronic and Mechanical, Hydraulic, and/or Pneumatic Channels.
Certain architectures combine electrical and electronic channels with mechanical, hydraulic, and/or pneumatic channels. These combinations of channels may be configured in active, active-backup, and passive-backup modes.
Note: The examples in paragraph B.1.2 of this appendix are theoretical and do not account for all possible configurations but instead represent common system architectures or those that present unique challenge s.
B.1.2 The following examples (B-1 through B-8) describe aircraft systems with multiple independent and redundant channels performing a function whose failure would prevent continued safe flight and landing of the aircraft.
B-2
Appendix B Example B-1 Information Essential to Continued Safe Flight and Landing Function System Channel System Channel System Channel Display of attitude, altitude, and airspeed information to the pilots during operation under IFR (e.g., primary display system and associated sensors, with dissimilar standby display system and sensors).
Active (pilot displays and associated sensors).
Active (co-pilot displays and associated sensors).
Active-backup (dissimilar standby display and associated sensors).
Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) (b) Discussion:
This example illustrates the requirement in § 25.1333 for the instruments at each pilot station to independently display information essential to the safety of flight. The standby display is necessary for the system to comply with § 25.1309. Either the pilot or co-pilot can be the pilot flying or pilot monitoring during normal operations, so both the pilot and co-pilot display system could be the active system.
Compliance with § 25.1317(a)(1), (2), and (3) should demonstrate that each pilot instrument display of aircraft attitude, altitude, and airspeed is not adversely affected when the aircraft is exposed to HIRF environments I and II and recovers normal operation after the aircraft is exposed to HIRF environment I. The dissimilar standby display should comply with § 25.1317(b) based on the functional failure condition of hazardous. Adverse effects include both loss of, and hazardously misleading, attitude, altitude, and airspeed information.
B-3
Appendix B Example B-2 Electronic Flight Control System Function System Channel System Channel System Channel Full authority control of pitch, yaw, and roll using electrical and electronic flight control systems Active or activebackup (flight control system #1) Active or active-backup (flight control system #2) Active or active-backup (flight control system #3) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) (a)(1), (2), and (3) Discussion:
This example illustrates an electronic flight control system comprising three independent channels to comply with § 25.1309. At any time, any one of the three channels can operate as the active channel. This may be necessary to achieve the safety intent or maintain reliability, priority scheme, voting logic, etc.
Only one channel operates in active mode while others are in active-backup mode. Any channel can perform the control function at any one time; therefore, all channels must comply with § 25.1317(a)(1), (2), and (3).
B-4
Appendix B Example B-3 Engine Over-Speed Protection Function System Channel System Channel System Channel Provide engine over-speed protection.
Active (electronic engine control system) (normal speed control) Active or active-backup (electronic engine control system) (over-speed protection) Active (independent mechanical over-speed protection) Applicable paragraph in § 25.1317 (b) (b) None Discussion:
This example illustrates the function of engine over-speed protection performed by a combination of active electrical and electronic control and mechanical system control. The mechanical channel must provide over-speed protection during normal operations and be independent of the active electronic control channels. The mechanical channel must not rely on electrical or electronic components to assist, augment, or monitor the over-speed protection. If the mechanical channel is independent of the electronic engine control speed control and over-speed protection, and has no electrical or electronic components, then the engine over-speed protection function is not adversely affected when the aircraft is exposed to HIRF environments I and II. The system therefore is not subject to § 25.1317(a). The electronic engine control channels should comply with § 25.1317(b) based on the functional failure condition of hazardous.
This example only addresses the over-speed protection feature implemented by the system. Other functions whose failure may be classified as catastrophic, like the loss of thrust control where the function may be implemented by electronic control channels, should comply with § 25.1317(a).
B-5
Appendix B Example B-4 Electrical Power Generation System including Ram Air Turbine (RAT) Function System Channel System Channel System Channel Provide electrical power for electrical and electronic systems including those with catastrophic failure conditions.
Active (left engine generator system) Active (right engine generator system) Passive-backup (emergency power supply system driven by ram air turbine) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) (b) Discussion:
This example illustrates a typical transport category airplane electrical system on a two-engine airplane where two or more independent sources of electrical power are required by § 25.1307(b) and a ram air turbine is necessary to comply with the requirements in §§ 25.1309 and 25.1351(d).
For this example, the electrical system consists of two active channels provided by a single main engine driven generator on each engine with the associated distribution and controls, and a third passive-backup channel provided by a ram air turbine electrical power system. The ram air turbine electrical power system is stowed during normal operation and deployed either automatically or manually when power from the two main engine driven generators is lost.
The active engine generator system channels must not be adversely affected when the aircraft is exposed to HIRF environments I and II and must comply with § 25.1317(a)(1), (2), and (3). The passive-backup ram air turbine electrical power system does not mitigate adverse effects for compliance with § 25.1317(a). The ram air turbine electrical power system must comply with § 25.1317(b) based on the functional failure condition of hazardous.
B-6
Appendix B Example B-5 Electrical Power Generation System including Auxiliary Power Unit (APU) and RAT Function System Channel System Channel System Channel System Channel Provide electrical power for electrical and electronic systems including those with catastrophic failure conditions.
Active (left engine generator system).
Active (right engine generator system).
Active-Backup (APU driven generator system required for extended operations (ETOPS) flight beyond 180 minutes).
Passive-Backup (emergency power supply system driven by ram air turbine).
Applicable paragraph in § 25.1317 (a)(1), (2), and (3)
(a)(1), (2), and (3) Based on specific aircraft safety assessment.
(b) Discussion:
This example illustrates a two-engine transport category airplane electrical system where two or more independent sources of electrical power are required by § 25.1307(b) and an alternate source (driven by ram air turbine) is necessary to comply with §§ 25.1309 and 25.1351(d). This configuration includes a third electrical power source driven by an APU. This third source (active-backup channel) is required for ETOPS beyond 180 minutes. As in example 4, the emergency power source is a passive-backup channel provided by a ram air turbine that remains stowed during normal flight and deployed either automatically or manually when power from all other channels is lost.
All active electrical power generation channels should comply with § 25.1317(a)(1), (2), and (3). The active-backup electrical power generation channel HCL should be determined based on the specific aircraft safety assessment. The passive-backup electrical power generation channel does not mitigate adverse effects due to HIRF exposure to meet the intent of the HIRF rule. The passive backup channel must be evaluated under § 25.1317(b) based on the functional failure condition of hazardous.
Note: For airplanes without ETOPS type design approval or with ETOPS type design approval for up to 180 minutes, the APU HCL should be defined based on a specific aircraft safety assessment.
B-7
Appendix B Example B-6 Independent Systems Performing an Aircraft Function Function System Channel System Channel System Channel System Channel Reduce aircraft speed on ground in a controlled manner using thrust reverser control system, spoiler deployment system, wheel braking system.
Active main brake system (electromechanical) Active (electronic engine thrust reverse control with associated sensors) Active (electronic spoiler deployment control with associated sensors) Active (independent mechanical wheel braking) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) Based on specific aircraft safety assessment.
Based on specific aircraft safety assessment.
None Discussion:
This example illustrates an aircraft level function that is performed by a combination of independent systems, each contributing to the function in part during a specific phase of flight. Each system implements a very distinct aircraft level function that serves in a complementary manner to decelerate the aircraft during the landing roll. The mechanical wheel braking system is assumed to be independent of the other channels, with no associated electrical or electronic equipment to assist, augment, or monitor the mechanical wheel braking system.
In this example, it is assumed that the main brake system includes failure conditions that are catastrophic. For the electronic engine thrust reverser control and the electronic spoiler control systems, the applicable paragraphs in § 25.1317 would depend on the specific failure conditions. The effectiveness, authority, and malfunctions associated with each system should be addressed. Additionally, the interaction between the systems should be addressed. Issues such as unsymmetrical thrust reverser activation or spoiler deployment could adversely affect the main brake and mechanical wheel braking functions and could affect the safety classification for the thrust reverser and spoiler controls.
An aircraft safety assessment should be conducted for each of these systems performing a specific aircraft level function to identify and classify their failure conditions. The failure hazard classifications and the decomposition of each system into the constituent channels would then dictate which paragraphs of § 25.1317 must be complied with.
B-8
Appendix B Example B-7 Altitude Information from Multiple Sources Function System Channel System Channel System Channel Provide altitude information to display in IFR using air data computer connected to the primary flight display, and pneumatic standby instrument with alternate static port.
Active (air data computer 1 with static port) Active (air data computer 2 with static port) Active-backup (pneumatic standby altimeter with alternate static port) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) None Discussion:
This example illustrates the function of providing altitude information. The main sources are obtained from two air data computers coupled to static ports and a backup source from a standby pneumatic altimeter coupled to an alternate static port independent from the main static ports. The pneumatic standby altimeter (active-backup channel) has no associated electrical or electronic equipment to assist, augment, or monitor the pneumatic standby altimeter system.
In this example, the standby altimeter does not mitigate the hazardously misleading altitude information from the active air data computer channels to comply with § 25.1317(a).
B-9
Appendix B Example B-8 HCL Comparison to Development Assurance Level (DAL) Function Function System Channel System Channel System Channel Control and protection of the aircraft pneumatic (bleed) system (top-level failure condition classification:
catastrophic).
Active (pneumatic system controller #1) Functional DAL (FDAL) B Active (pneumatic system controller #2) FDAL B Passive Back-up (high pressure switch + valve) FDAL C Applicable paragraph in § 25.1317
(a)(1), (2), and (3) (a)(1), (2), and (3) (b) Discussion:
This is a generic example to show that the HCL of a given system may be different from the FDAL and item development assurance level (IDAL), as defined in SAE ARP4754A. Therefore, it is important to use the proper nomenclature and avoid using ARP4754A “DAL” or similar terms when referring to the HCL.
In this example, the pneumatic control system is composed of two main active controllers and a simpler passive back-up channel that can perform the function, preventing a catastrophic event should both controllers fail.
The FDAL for each channel or member (ARP4754A nomenclature) in this example was determined for a catastrophic top-level failure condition based on the “Option 2” column of Table 3 “DEVELOPMENT ASSURANCE LEVEL ASSIGNMENT TO MEMBERS OF A FUNCTIONAL FAILURE SET” in ARP4754A, which allows the combination of FDAL B+B+C for independent channels. In contrast, the respective HCLs would be A+A+B.
Considering that HIRF can simultaneously affect all channels, the considerations used for FDAL assignment are not sufficient. Compliance with § 25.1317(a) is required for both active channels performing a function with a catastrophic top-level failure condition.
The FDAL for the passive back-up channel may be C in this example. However, for HIRF, the applicable paragraph in § 25.1317 is (b) based on the functional failure condition of hazardous.
B-10