6. Can the applicant submit, and will the FAA accept, previously accomplished equipment qualification data (test analysis, reports, etc.) to be used in support of compliance findings?
As previously discussed, if there is reasonable confidence the qualification data is applicable, valid, and from a trusted source, the FAA may choose to accept the data. If the equipment was qualified to a different performance or qualification standard than that required or associated with FAA guidance, then a comparison analysis matrix should be prepared and additional analysis and/or testing applied, as necessary. If the data is accepted, the installation of the SME will be evaluated like any other equipment that must be installed under amended TC or STC certification procedures. Furt her analysis or testing may be required if the equipment performance may be affected by the installation and/or where the equipment may affect the aircraft’s required systems.
7. What happens if the COTS/MOTS equipment fails to meet minimum qualification requirements for the environment or function for the intended use? If the qualification testing shows that COTS/MOTS equipment cannot meet minimum safety requirements, one should consider if there is other equipment available that may be more suitable for the application. It is recognized that SME, i.e., equipment for a special or unique purpose, may limit options for hardware available to do the job. Depending on the circumstances, it may be necessary to incorporate modifications to the off-the-shelf configuration to render it suitable for the airborne application. The equipment may no longer be considered off-the-shelf if required modifications are extensive. However, when the intent and purpose of the certification is to ensure a minimum level of safety for the aircraft and its occupants, there is no room for compromise. There may be other avenues to consider. Repackaging, hardening, or designing an enclosure to contain or mitigate hazards as part of the installation design may be an option.
8. What about approvals for software embedded in GFE/SME?
a. AC 20-115B, “Radio Technical Commission for Aeronautic Inc. Document RTCA/DO-178B” recognizes RTCA/DO-178B as an acceptable means of compliance for securing the FAA’s approval of software in airborne systems and equipment. Keep in mind that RTCA/DO-178B is a means, but not the only means, to secure FAA software approvals.
b. Any alternative means of compliance is assessed in terms of how well it satisfies the objectives of RTCA/DO-178B. A system level functional hazard assessment needs to be accomplished to determine the criticality of the mission software. Depending on the criticality of the mission software, a software correlation matrix may need to be developed comparing the objectives of RTCA/DO-178B to the alternate means.
c. Some aircraft mission equipment installation factors to consider are:
(1) Is the mission equipment completely isolated and self contained, other than aircraft power, with no dependencies or interfaces with other aircraft systems or equipment?
(2) Is the mission equipment only a receiver?
(3) Is the mission equipment a transmitter?
(4) Does the mission equipment interface with other aircraft systems and/or equipment?
d. AC 20-148, “Reusable Software Components,” addresses acceptance of reusable software components, i.e., software libraries, operating systems, and communication protocols.
Order 8110.49, “Software Approval Guidelines,” is used as a guide by certification officials and their designees on how to apply RTCA/DO-178B for approving software used in airborne equipment.
9. To what depth does the FAA participate in finding compliance with 14 CFR § XX.1309(a), for SME?
a. The following is a discussion of the application of 14 CFR § 25.1309(a) with respect to non-required or non-critical equipment when operating normally, i.e., not the failure case.
b. Previously, there has been wide variation as to how 14 CFR § 25.1309(a) has been applied for certification of SME on a CDA. The variations go from doing nothing, to demonstrating that the system does not interfere with the airplanes equipment, to demonstrating the airplane’s equipment does not interfere with the non-required equipment, to demonstrating that the equipment performs within its design envelope.
c. Interference: 14 CFR § 25.1309(a) applies to each item of installed equipment, thus it applies to non-required or non-critical equipment as well. So, part of the compliance with 14 CFR § 25.1309(a) is showing the equipment doesn’t interfere with its own function or other equipment doesn’t interfere with its function. Further, it must be shown that this equipment doesn’t interfere with equipment on other airplanes, a requirement in 14 CFR § 25.1309(a) as applied to the other equipment. In the later case, certain other regulations and associated guidance may come into play as well, such as 14 CFR § 25.1353.
d. We may establish there is no interference, but that does not mean we have established that the equipment is functioning properly. A primary finding is that the equipment is functioning within its design envelope. However, the design envelope, if not specified by some regulation or associate guidance material, can be selected at the discretion of the applicant or may be dictated to the applicant by the aircraft purchaser as part of the purchaser’s contract. The purchaser would have to specify in the purchase agreement if he or she wants the modifier to certificate the performance of the equipment to a specific performance envelope under 14 CFR § 25.1309(a).
e. In demonstrating that the SME complies with 14 CFR § XX.1309(a), the assessment of compliance may be accomplished as follows:
(1) With respect to the regulations, if the GFE/SME is required, is essential for safe operation, or affects the aircraft’s performance, the FAA will assess compliance using normal FAA procedures. Assessment will typically be, but not limited to, exercising the equipment (i.e., verifying the equipment is functional and is not being interfered with) and assessing compliance (functions properly) for the full operational/environmental envelope. For embedded military or 16
special mission functions, the FAA may not be able to establish appropriate criteria to make this finding. FAA findings may be supported by assessmen ts from the receiving military authority or other U.S. government agency.
(2) With respect to the regulations, if the GFE/SME is not required, is not essential for safe operation, or does not affect the aircraft’s performance, but whose function is essential to the mission of the aircraft, the FAA may not be able to establish appropriate criteria to make this finding. FAA findings may be supported by assessm ents from the receiving U.S. military or other U.S. government agency.
f. Establishing who is taking responsibility to verify that the equipment functions properly should be documented in the program specific certification plan and made known to the FAA and MAA.
10. What reliability must GFE/SME have?
a. The applicable regulation and means of compliance may affect the design’s reliability. In general regulati ons that establish or govern the reliability of design include 14 CFR §§ 25.671, 25.672, 25.901, 25.1309, and 25.1431(a). There are other specific rules that require redundancy, such as 14 CFR §§ 25.1307, 25.1333, and 25.1355, that are related to reliability.
b. The reliability specified by the military customer or other end user may be different than that necessary to show compliance. The FAA must assess reliability which is necessary to show compliance for the applicable regulations. If the applicant wishes to demonstrate a finding, certification, or validation of reliability different than that required by the regulations, the FAA, at its discretion, may assess compliance or leave the assessment of compliance to the military, as appropriate.
11. Can the FAA approve provisions for unapproved SME as part of the type certification process? The FAA may approve installed SME if it can be included as part of the type design and be shown to comply with applicable airworthiness standards. In cases where this is not possible or practical, the FAA has defined and may consider alternate levels of approval (see Order 8110.101, chapter 8). The FAA-approved type design could include only provisions for the equipment. In exercising this option, the applicant must show that provisions are designed to meet established space, weight, and power requirements to support the follow-on installation.
The structural, weight (and center of gravity), power, and other requirements must be defined, and compliance to applicable airworthiness standards must be shown to keep the end aircraft configuration within the airworthiness limitations for the derivative aircraft. The actual installation of the mission equipment is not part of the FAA-approved type design. Any subsequent modifications, including installation of the equipment for which the provisions were designed, are then approved by the MAA. As this practice requires the establishment of interface criteria for subsequent installation approval, it is the responsibility of the applicant to establish appropriate interface information and limitations as part of the FAA-approved type design. Other information may also be required by the MAA to assess and approve installation of SME. This coordination is conducted between the applicant and the end user. The FAA can 17
provide technical assistance to the MAA in its understanding of the criteria and limits of the FAA provisions-only approval.
12. For SME that will be FAA certified, but is not required by FAA regulations, what areas may need to be covered by the MAA? As a regulatory agency, the FAA can only mandate compliance to the minimum safety standards defined in the civil airworthiness regulations. Also the FAA does not wish to cha nge policy and guidance material for established means of compliance to these regulations deemed appropriate for civil aircraft operation. These minimum safety standards or the compliance criteria may not meet the military’s requirements for the CDA to perform a special mission. Any higher (or different) performance standards or reliability requirements should be imposed by contract. It is not in the best interest of the government or the contractor/applicant to duplicate efforts or address conflicting requirements.
When mission and certification requirements overlap, compliance can be shown to appropriate regulations when data is presented, or tests are performed, that shows the type design meets the regulation. Every effort should be made by the applicant to write test pl ans and generate data that will demonstrate compliance with certification requirements and satisfy overlapping customer requirements, where possible. Particular areas where military or special mission requirements may overlap or exceed certification standards include, but may not be limited to:
a. Environmental qualification to military standards or to mission requirements;
b. System/Equipment performance to criteria desired;
c. Demonstration of function throughout its design envelope;
d. Effects failures may have on the non-required equipments performance;
e. Reliability; and
f. Desired format content of instructions for continued airworthiness.
CHAPTER 3. CONFORMITY INSPECTIONS AND PRODUCTION APPROVALS
1. How is FAA conformity inspection achieved for SME during the type certification process?
a. FAA conformity inspection is required during the type certification process for two principle reasons:
(1) Inspection to engineering requirements ensures that the prototype article(s) used for certification evaluation and test match the type design presented for approval; and
(2) Manufacturing review to ensure the design data is sufficient to produce, procure, and deliver articles that continue to conform to the type design.
b. SME may include COTS hardware, MOTS hardware, or GFE. It is usually not specifically produced for use on civil aviation products, and only limited type design data may be available. Without existing oversight of FAA-approved quality control procedures, questions may be raised about how complete conformity inspection can be obtained.
c. In terms of the level of detail in the type design data, the regulations require the applicant (modifier) to submit the type design, test reports, and computations “necessary” to show compliance with the applicable regulations. Regulations with the word “necessary” include 14 CFR §§ 21.21(b), 21.31(a), 21.33(b), 21.35(b), 21.81(d), 21.83(g), 21.97(b),
21.123(b), 21.143(a), 21.157, 21.303(c)(3)(ii) and (e).
d. What is “necessary” is that specifically required by the regulations. The detail necessary to show conformity or compliance for GFE/SME will generally depend on the equipment’s complexity, the number of regulations that are applicable, and the potential that the equipment (for normal operation and failure conditions) may create a hazard to flight.
e. There will be a point where the showing of conformity or compliance may become impractical for complex GFE/SME because design, production, or qualification data is unavailable. In these cases, the FAA may c onsult with the military, and through special agreement, accept a military statement of conformity or military airworthiness approval tag in lieu of the FAA conformity inspection process. If FAA conformity inspection becomes an issue for certification of SME, consultation with the FAA Aircraft Engineering Division, AIR-100, and Production and Airworthiness Division, AIR-200, may be necessary.
2. Can SME be provided as an FAA-approved part if it has not been produced under an FAA production approval?
a. Production requirements for new SME provided as part of the modification for installation in MCDA are established in the same way as established for civil aircraft applications. As part of the FAA-approved t ype design, it must be established that newly manufactured or procured components have been produced using reasonable manufacturing and quality control procedures, and configuration control is maintained.
b. New production, modification, or replacement parts produced for sale must be approved under the TC, a production certificate, a technical standard order authorization (TSOA) or FAA letter of TSO design approval, or a parts manufacturer approval (PMA) (reference 14 CFR § 21.303). Where parts incl uded in the type design are not produced as specified under 14 CFR § 21.303, the parts procured must be specified in the type design and must be properly identified if their physical or chemical properties cannot be readily and accurately determined (reference 14 CFR § 21.125(b)(1) and (2)). The aircraft manufacturer, TC holder operating under a production certificate, or an STC holder operating under a production certificate or PMA, may procure SME included on the FAA-approved type design as unapproved parts.
However, if the SME is provided as part of the modification, or provided for sale to the military or operator as a spare or replacement part, he or she must obtain FAA approval for the part under a production certificate or obtain a PMA (unless the part is already produced under another FAA-approved production approval system, such as a TSOA). For FAA production approval, the modifier must set up the necessary inspections and tests to show that the equipment meets the regulations, and that these findings are maintained from part to part. These parts become approved parts under the TC or STC type design and TC or STC production systems. It remains the applicant’s responsibility to provide configuration control and maintain access to all necessary type design data, and they may do this in accordance with agreements with their suppliers.
3. What about SME supplied as government or customer furnished equipment? In some cases, the mission equipment to be installed is GFE that is supplied by the military to the applicant out of existing government stock, and may not even be a new part. The type design must be available for the FAA to approve as part of the design approval. However, the applicant may not be able to obtain FAA production approval. If original and replacement parts are furnished by the government, and the modification and/or replacement parts are not provided for sale by the modifier, they are not subject to the requirement to obtain production approval under 14 CFR § 21.8. If appropriate, cert ain GFE items may be classified as “commercial parts” under 14 CFR § 21.9(a)(4). The military or any other U.S. government agency that supplies the part as GFE is responsible for configuration control and airworthiness of the part.
4. Does the FAA accept used parts from the military or other U.S. government entities?
This question is basically answered by the previous question. However, if it can be shown with reasonable confidence that government furnished SME has been maintained and/or stored such that configuration control is maintained for replacement parts, then that finding may alleviate some of the effort in identifying the part for the type design relative to complying with 14 CFR § 21.125(b)(1) & (2). In other words, the design must have been accurately identified and the configuration must have been maintained from the initial tested part to the parts being installed.
5. What about parts and components that are installed as military deviations (not included in the type design)? Installation of SME or components not included in the type design (military deviations) is the responsibility of the modifier and the receiving MAA. The FAA may certify provisions for such equipment (mounting or connecting hardware) to the extent that the provisions can be shown to comply with the applicable regulations. This becomes the method of last resort if the criteria described above cannot be met.
CHAPTER 4. MILITARY DEVIATIONS TO FAA-APPROVED TYPE DESIGN
1. Can the FAA establish that uncertified SME (appearing on FAA Form 8130-31 as a military deviation) does not interfere with the airplane and/or flight crew performance for normal operation or a failure case? The FAA and/or FAA designees cannot establish this by making actual compliance findings; however, a technical evaluation or assessment may be provided. Unless it can be established under an FAA-approved process that the system or equipment installed on follow-on aircraft are the same as that evaluated, any evaluation or assessment would apply to the specific serial number examined. Configuration control and applicability of the evaluation for subsequent aircraft would be the responsibility of the MAA.
In accordance with the FAA/Armed Forces MOA, the military may request the FAA evaluate military deviations from FAA-approved type design to determine compatibility with the aircraft systems or flight crew performance. They should make that request to the FAA under technical assistance services and make the aircraft available for such evaluations.
2. Why is it required that the FAA find compliance for an aircraft configuration (as defined in type design) even though that FAA-approved configuration may be superseded by military deviations and may never be produced?
a. To approve design changes to a type-certificated product, a configuration must be defined that will establish that the aircraft meets all applicable airworthiness regulations. So, a design data package can only be approved if the type design is complete and eligible for approval. If the equipment or installation is required by regulations, a compliant configuration must be established. If the military chooses to replace this required equipment with equipment that cannot be certified, it should not be included in the proposed type design. On delivery of the aircraft, that equipment will be identified as a military deviation on FAA Form 8130-31. For non-required, equipment that cannot be shown to comply with civil regulations, “safe-carriage” or “provisions-only” installations can be approved (see Order 8110.101, chapter 8), Equipment installed as “safe-carriage” is shown on the type design as disconnected and having no function;
therefore, the compliance findings to substantiate operation of the equipment need not be addressed. Other compliance findings may be required to establish that the equipment meets crashworthiness and cabin safety requirements. “Provisions-only” installations are designed without the equipment identified at all. Equipment could later be installed by FAA approval if compliance is shown, but the provisions are usually for installation of SME that will appear as a military deviation approved by the MAA.
b. There are other reasons why a fully compliant type design must be defined to support the FAA approval:
(1) There is no requirement, basis, or need for the FAA to identify and address exemptions, develop special conditions, or make equivalent levels of safety findings for MCDA.
If the civil airworthiness regulations are not appropriate, it is the responsibility of the MAA to determine appropriate airworthiness criteria to meet its needs. Deviations from the FAA- approved type design, as documented on Form 8130-31, identify these components for the MAA.
(2) The definition of an FAA-approved type design allows a derivative aircraft to be returned to an FAA-approved configuration at any time. If military deviations are addressed (removal of unapproved equipment and restoration of FAA-approved configuration), the aircraft could conceivably operate as a civil aircraft with a standard airworthiness certificate.
(3) Complete definition of FAA-approved type design, and military deviations thereto, help establish and maintain configuration control for the specific aircraft.
3. Do items identified in the FAA-approved type design, that will not be used in the delivered aircraft, need to be manufactured, conformed, and tested to receive certification?
In accordance with 14 CFR § 21.33, the applicant must “allow the Administrator to make any inspection and any flight and ground test necessary to determine compliance with the applicable requirements of the Federal Aviation Regulations.” This must be handled on a case-by-case basis. If compliance for the type design can be established by inspection of drawings, supporting analyses, and/or similarity to an existing FAA-approved design, it may not be necessary to actually build this hardware for the prototype installation. However, if compliance cannot be determined without a necessary inspection, ground test, or flight test, it may be necessary to manufacture a prototype installation that is later modified, or not used, in the aircraft. The applicant’s certification plan should identify components that it does not plan to manufacture or install and a rationale for suitable means of compliance should be identified.
Appendix A
APPENDIX A Acronyms 14 CFR Title 14 of the Code of Federal Regulations AC Advisory Circular ACO Aircraft Certification Office CAR Civil Aviation Regulations CDA Commercial Derivative Aircraft COTS Commercial Off-The-Shelf ELOS Equivalent Level of Safety GFE Government Furnished Equipment MAA Military Airworthiness Authority MCDA Military Commercial Derivative Aircraft MCO Military Certification Office MOA Memorandum of Agreement MOTS Military Off-The-Shelf PMA Parts Manufacturer Approval SME Special Mission Equipment STC Supplemental Type Certificate TC Type Certificate TSOA Technical Standard Order Authorization A-1
Appendix B
APPENDIX B Discussion of required/essential versus non-required/non-essential electrical equipment There are numerous regulations that have general applicability to equipment on the aircraft and there are regulations that apply to specific equipment or equipment whose function is required by “this subchapter” or “essential for safe operation.” Examples of regulations that apply generally to all electrical equipment are 14 CFR §§ 25.1301, 25.1309(b), and 25.1431. Examples of regulations that apply to electrical equipment “whose functioning is required by this subchapter” or “essential for safe operation” include 14 CFR §§ 25.1309(a) and 25.1353(a).
Equipment, including equipment “not required” or “not essential for safe operation,” must be shown not to adversely affect equipment that is required or essential during normal operation and in the case of failure. For example, for electrical equipment, 14 CFR §§ 25.1309(a), 25.1431(a) and (c), and 25.1353(a) apply to normal operation and, 14 CFR § 25.1309(b) applies to the failure case.
1. Non-Required/Non-Essential GFE/SME - Normal Operation:
a. Effect on non-required/non-essential equipment, reference includes 14 CFR § 25.1301.
(1) 14 CFR § 25.1309(a) does not directly apply; therefore, unless another regulation requires a specific design or qualification envelope, the design or qualification envelopes may be that selected by the modifier and may not necessarily have to be FAA- approved. However, operating limitations ma y be appropriate. Reference 14 CFR § 25.1301, also note 14 CFR § 25.1585(b).
b. Effect on required/essential equipment: Reference 14 CFR §§ [indirect] 25.1309(a), [indirect] 25.1431(a) & (c)], and [direct] 25.1353(a).
(1) For the showing that non-required equipment does not adversely affect required equipment or other electrical equipment essential to safe operation, certain FAA/industry qualification standards may be imposed on the non-required equipment. For example, RTCA/DO-178B and RTCA/DO-160B are applied to non-required electrical equipment, see AC 25-10. This is an indirect applica tion of 14 CFR §§ 25.1309(a) and 25.1431(a) & (c) showing the non-required equipment doesn’t affect required equipment.
2. Required/Essential Equipment (Non-GFE/SME) - Normal Operation: Effect on nonrequired/non-essential GFE/SME [no specific regulation other than 14 CFR § 25.1309(a)]. The scope of this assessment will generally be limited and/or delegated.
3. Required or Non Required/Essential or Non Essential Equipment GFE/SME - Failure Case:
a. Sections in 14 CFR such as §§ 25.1309(b) and 25.1431(a) apply. Note, under 14 CFR § 25.1431(a) critical environmental conditions must be considered when evaluating the failure case of non-required/non-essential equipment on required/essential equipment.
b. The discussions above are limited to 14 CFR part 25. The observations above should be the same for other parts (23, 27, and 29) if the regulations are the same.
B-1
Appendix C
APPENDIX C Example (14 CFR part 25) The installation of a manually wound 24 hour military clock in the passenger cabin, and the clock is purchased from an unapproved distributor.
Requirements: As the clock is fully mechanical and not required, the applicable regulations include, but are not limited to the following:
1. 14 CFR § 21.125(b)(1) and (2): The GFE/SME design will have to be defined in the type design, including acceptance inspections and tests that would likely be required to comply with 14 CFR § 21.125(b)(1)&(2). The inspections and tests for the type design to comply with 14 CFR § 21.125(b)(1)&(2) should be developed to the extent necessary to establish that the compliance findings with respect to 14 CFR §§ 25.561(b), 25.789, 25.853, 25.1301 and 25.1309 are still valid from part to part.
2. 14 CFR § 21.53: Conformity would be normal, i.e., per type design. See paragraph above.
3. 14 CFR §§ 25.561(b), 25.789 and 25.853: Typical certification compliance effort for an item of mass in the cabin. Structural tests and burn tests may be required for certification.
4. 14 CFR § 25.1301: The accuracy and the environmental envelope that the clock is to operate can be specified by the modifier or by an agreement between the modifier and aircraft purchaser
(i.e., whether it needs a second hand, accurate to 1, 0.1 or .01 seconds etc., or needs to meet a military specifications, environmental operating conditions, color, size, etc.). The military or manufacturer’s specifications for the clock may provide adequate information.
5. 14 CFR § 25.1309(a): Defining the performance and qualification standards for this installation relative to 14 CFR § 25.1301 are up to the modifier, and the certification assessment is at the discretion of the FAA. The complian ce effort may be a spot check for functioning by the FAA.
6. 14 CFR §§ 25.671, 25.672, 25.901(c), 25.903(b) 25.1309, 25.1431(a): The clock’s failure does not affect the flight crew or other required equipment. Therefore, there is no FAA reliability requirement other than at the time of certification review “they perform their intended functions” under 14 CFR § 25.1309(a). Defining th e qualification standards for reliability for this installation is up to the modifier and the certification assessment is at the discretion of the FAA. The compliance assessment may be delegated or left to statements from the modifier or the clocks manufacturer, if necessary. The military or manufacturer’s specifications for the clock may provide adequate information.
Note: The above list of regulations is not all-inclusive. For instance, the affect of the weight of the installation would need to be assessed under the performance and structural regulations.
C-1