Appendix B B.1.1.4 Combination of Electrical and Electronic and Mechanical, Hydraulic, and/or Pneumatic Channels.
Certain architectures combine electrical and electronic channels with mechanical, hydraulic, and/or pneumatic channels. These combinations of channels may be configured in active, active-backup, and passive-backup modes.
Note: The examples in paragraph B.1.2 of this appendix are theoretical and do not account for all possible configurations but instead represent common system architectures or those that present unique challenge s.
B.1.2 The following examples (B-1 through B-8) describe aircraft systems with multiple independent and redundant channels performing a function whose failure would prevent continued safe flight and landing of the aircraft.
B-2
Appendix B Example B-1 Information Essential to Continued Safe Flight and Landing Function System Channel System Channel System Channel Display of attitude, altitude, and airspeed information to the pilots during operation under IFR (e.g., primary display system and associated sensors, with dissimilar standby display system and sensors).
Active (pilot displays and associated sensors).
Active (co-pilot displays and associated sensors).
Active-backup (dissimilar standby display and associated sensors).
Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) (b) Discussion:
This example illustrates the requirement in § 25.1333 for the instruments at each pilot station to independently display information essential to the safety of flight. The standby display is necessary for the system to comply with § 25.1309. Either the pilot or co-pilot can be the pilot flying or pilot monitoring during normal operations, so both the pilot and co-pilot display system could be the active system.
Compliance with § 25.1317(a)(1), (2), and (3) should demonstrate that each pilot instrument display of aircraft attitude, altitude, and airspeed is not adversely affected when the aircraft is exposed to HIRF environments I and II and recovers normal operation after the aircraft is exposed to HIRF environment I. The dissimilar standby display should comply with § 25.1317(b) based on the functional failure condition of hazardous. Adverse effects include both loss of, and hazardously misleading, attitude, altitude, and airspeed information.
B-3
Appendix B Example B-2 Electronic Flight Control System Function System Channel System Channel System Channel Full authority control of pitch, yaw, and roll using electrical and electronic flight control systems Active or activebackup (flight control system #1) Active or active-backup (flight control system #2) Active or active-backup (flight control system #3) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) (a)(1), (2), and (3) Discussion:
This example illustrates an electronic flight control system comprising three independent channels to comply with § 25.1309. At any time, any one of the three channels can operate as the active channel. This may be necessary to achieve the safety intent or maintain reliability, priority scheme, voting logic, etc.
Only one channel operates in active mode while others are in active-backup mode. Any channel can perform the control function at any one time; therefore, all channels must comply with § 25.1317(a)(1), (2), and (3).
B-4
Appendix B Example B-3 Engine Over-Speed Protection Function System Channel System Channel System Channel Provide engine over-speed protection.
Active (electronic engine control system) (normal speed control) Active or active-backup (electronic engine control system) (over-speed protection) Active (independent mechanical over-speed protection) Applicable paragraph in § 25.1317 (b) (b) None Discussion:
This example illustrates the function of engine over-speed protection performed by a combination of active electrical and electronic control and mechanical system control. The mechanical channel must provide over-speed protection during normal operations and be independent of the active electronic control channels. The mechanical channel must not rely on electrical or electronic components to assist, augment, or monitor the over-speed protection. If the mechanical channel is independent of the electronic engine control speed control and over-speed protection, and has no electrical or electronic components, then the engine over-speed protection function is not adversely affected when the aircraft is exposed to HIRF environments I and II. The system therefore is not subject to § 25.1317(a). The electronic engine control channels should comply with § 25.1317(b) based on the functional failure condition of hazardous.
This example only addresses the over-speed protection feature implemented by the system. Other functions whose failure may be classified as catastrophic, like the loss of thrust control where the function may be implemented by electronic control channels, should comply with § 25.1317(a).
B-5
Appendix B Example B-4 Electrical Power Generation System including Ram Air Turbine (RAT) Function System Channel System Channel System Channel Provide electrical power for electrical and electronic systems including those with catastrophic failure conditions.
Active (left engine generator system) Active (right engine generator system) Passive-backup (emergency power supply system driven by ram air turbine) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) (b) Discussion:
This example illustrates a typical transport category airplane electrical system on a two-engine airplane where two or more independent sources of electrical power are required by § 25.1307(b) and a ram air turbine is necessary to comply with the requirements in §§ 25.1309 and 25.1351(d).
For this example, the electrical system consists of two active channels provided by a single main engine driven generator on each engine with the associated distribution and controls, and a third passive-backup channel provided by a ram air turbine electrical power system. The ram air turbine electrical power system is stowed during normal operation and deployed either automatically or manually when power from the two main engine driven generators is lost.
The active engine generator system channels must not be adversely affected when the aircraft is exposed to HIRF environments I and II and must comply with § 25.1317(a)(1), (2), and (3). The passive-backup ram air turbine electrical power system does not mitigate adverse effects for compliance with § 25.1317(a). The ram air turbine electrical power system must comply with § 25.1317(b) based on the functional failure condition of hazardous.
B-6
Appendix B Example B-5 Electrical Power Generation System including Auxiliary Power Unit (APU) and RAT Function System Channel System Channel System Channel System Channel Provide electrical power for electrical and electronic systems including those with catastrophic failure conditions.
Active (left engine generator system).
Active (right engine generator system).
Active-Backup (APU driven generator system required for extended operations (ETOPS) flight beyond 180 minutes).
Passive-Backup (emergency power supply system driven by ram air turbine).
Applicable paragraph in § 25.1317 (a)(1), (2), and (3)
(a)(1), (2), and (3) Based on specific aircraft safety assessment.
(b) Discussion:
This example illustrates a two-engine transport category airplane electrical system where two or more independent sources of electrical power are required by § 25.1307(b) and an alternate source (driven by ram air turbine) is necessary to comply with §§ 25.1309 and 25.1351(d). This configuration includes a third electrical power source driven by an APU. This third source (active-backup channel) is required for ETOPS beyond 180 minutes. As in example 4, the emergency power source is a passive-backup channel provided by a ram air turbine that remains stowed during normal flight and deployed either automatically or manually when power from all other channels is lost.
All active electrical power generation channels should comply with § 25.1317(a)(1), (2), and (3). The active-backup electrical power generation channel HCL should be determined based on the specific aircraft safety assessment. The passive-backup electrical power generation channel does not mitigate adverse effects due to HIRF exposure to meet the intent of the HIRF rule. The passive backup channel must be evaluated under § 25.1317(b) based on the functional failure condition of hazardous.
Note: For airplanes without ETOPS type design approval or with ETOPS type design approval for up to 180 minutes, the APU HCL should be defined based on a specific aircraft safety assessment.
B-7
Appendix B Example B-6 Independent Systems Performing an Aircraft Function Function System Channel System Channel System Channel System Channel Reduce aircraft speed on ground in a controlled manner using thrust reverser control system, spoiler deployment system, wheel braking system.
Active main brake system (electromechanical) Active (electronic engine thrust reverse control with associated sensors) Active (electronic spoiler deployment control with associated sensors) Active (independent mechanical wheel braking) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) Based on specific aircraft safety assessment.
Based on specific aircraft safety assessment.
None Discussion:
This example illustrates an aircraft level function that is performed by a combination of independent systems, each contributing to the function in part during a specific phase of flight. Each system implements a very distinct aircraft level function that serves in a complementary manner to decelerate the aircraft during the landing roll. The mechanical wheel braking system is assumed to be independent of the other channels, with no associated electrical or electronic equipment to assist, augment, or monitor the mechanical wheel braking system.
In this example, it is assumed that the main brake system includes failure conditions that are catastrophic. For the electronic engine thrust reverser control and the electronic spoiler control systems, the applicable paragraphs in § 25.1317 would depend on the specific failure conditions. The effectiveness, authority, and malfunctions associated with each system should be addressed. Additionally, the interaction between the systems should be addressed. Issues such as unsymmetrical thrust reverser activation or spoiler deployment could adversely affect the main brake and mechanical wheel braking functions and could affect the safety classification for the thrust reverser and spoiler controls.
An aircraft safety assessment should be conducted for each of these systems performing a specific aircraft level function to identify and classify their failure conditions. The failure hazard classifications and the decomposition of each system into the constituent channels would then dictate which paragraphs of § 25.1317 must be complied with.
B-8
Appendix B Example B-7 Altitude Information from Multiple Sources Function System Channel System Channel System Channel Provide altitude information to display in IFR using air data computer connected to the primary flight display, and pneumatic standby instrument with alternate static port.
Active (air data computer 1 with static port) Active (air data computer 2 with static port) Active-backup (pneumatic standby altimeter with alternate static port) Applicable paragraph in § 25.1317 (a)(1), (2), and (3) (a)(1), (2), and (3) None Discussion:
This example illustrates the function of providing altitude information. The main sources are obtained from two air data computers coupled to static ports and a backup source from a standby pneumatic altimeter coupled to an alternate static port independent from the main static ports. The pneumatic standby altimeter (active-backup channel) has no associated electrical or electronic equipment to assist, augment, or monitor the pneumatic standby altimeter system.
In this example, the standby altimeter does not mitigate the hazardously misleading altitude information from the active air data computer channels to comply with § 25.1317(a).
B-9
Appendix B Example B-8 HCL Comparison to Development Assurance Level (DAL) Function Function System Channel System Channel System Channel Control and protection of the aircraft pneumatic (bleed) system (top-level failure condition classification:
catastrophic).
Active (pneumatic system controller #1) Functional DAL (FDAL) B Active (pneumatic system controller #2) FDAL B Passive Back-up (high pressure switch + valve) FDAL C Applicable paragraph in § 25.1317
(a)(1), (2), and (3) (a)(1), (2), and (3) (b) Discussion:
This is a generic example to show that the HCL of a given system may be different from the FDAL and item development assurance level (IDAL), as defined in SAE ARP4754A. Therefore, it is important to use the proper nomenclature and avoid using ARP4754A “DAL” or similar terms when referring to the HCL.
In this example, the pneumatic control system is composed of two main active controllers and a simpler passive back-up channel that can perform the function, preventing a catastrophic event should both controllers fail.
The FDAL for each channel or member (ARP4754A nomenclature) in this example was determined for a catastrophic top-level failure condition based on the “Option 2” column of Table 3 “DEVELOPMENT ASSURANCE LEVEL ASSIGNMENT TO MEMBERS OF A FUNCTIONAL FAILURE SET” in ARP4754A, which allows the combination of FDAL B+B+C for independent channels. In contrast, the respective HCLs would be A+A+B.
Considering that HIRF can simultaneously affect all channels, the considerations used for FDAL assignment are not sufficient. Compliance with § 25.1317(a) is required for both active channels performing a function with a catastrophic top-level failure condition.
The FDAL for the passive back-up channel may be C in this example. However, for HIRF, the applicable paragraph in § 25.1317 is (b) based on the functional failure condition of hazardous.
B-10
OMB Control Number: 2120-0746 Expiration Date: 12/31/2027 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering, and maintaining the data needed, completing, and reviewing the collection of information.
All responses to this collection of information are voluntary. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.
If you find an error in this Advisory Circular, have recommendations for improving i t, or have suggestions for new items/subjects to be added, you may let us know by emailing this form to 9- avs-air-directives-management-officer@faa.gov.
Subject: D ate:
Mark all appropriate line items:
An error (procedural or typographical) has been noted in paragraph on page .
Recommend paragraph on page be changed as follows:
In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Other comments:
I would like to discuss the above. Please contact me using the information below.
Submitted by: Date: