Change 1 AC 23-17C 7/16/2012
209 contained in current Section 23.1309(c) and proposed Section 23.1309(a)(3) will require these items on a multiengine airplane to meet the requirements contained in current Section 23.1309(b).
A new Section 1309(b) is proposed which will require a detailed examination of each item of equipment, system, and installation. This examination is to determine whether a failure would affect the airplane's continued safe flight and landing. Each item of equipment, each system, and each installation identified by such an examination as being critical to the safe operation of the airplane would be required to meet additional requirements. This will permit the approval of more advanced systems that were not envisioned when Section 23.1309 was added to Part 23, without the need for special conditions.
A new Section 23.1309(c) is proposed to require identification of loads which are "essential loads" and requires the airplane power sources for these loads to meet requirements consistent with other airplane airworthiness requirements. These requirements are substantially equivalent to section 59(b) of Appendix A to Part 135.
A new Section 23.1309(d) is proposed to allow reduction of power loads when showing compliance with proposed Section 23.1309(c)(2). This provision is substantially equivalent to section 59(c)(3) of Appendix A to Part 135.
A new Section 23.1309(e) is proposed to require that the design of each electrical system, each item of equipment, and each installation take into account critical environmental conditions. Critical environmental and atmospheric conditions would include radio frequency energy and direct and indirect effects of lightning. Section
23.867 now requires the airplane structure to be protected from the effects of lightning and Section 23.954 now requires the airplane fuel system to be protected from the effects of lightning.
A new Section 23.1309(f) is proposed to provide a definition of the systems to which the requirements of this section are applicable and specifically identifies certain items to which they are not applicable.
Early in the development of minimum requirements for transport category airplanes, it was realized that more complex systems were being added to airplane designs and there was a need to include requirements which specifically addressed equipment, systems, and their installation. This was accomplished by the addition of Section 4b.606 to Part 4b of the Civil Air Regulations (CAR), Amendment 4b-6, effective March 5, 1952, in part, accomplished this objective. The preamble to that amendment included the following in regard to that addition:
An amendment clarifying the requirements for equipment, systems, and installations with regard to functioning and reliability is made in Subpart F. In addition, it specifies dual power supply for those installations the functioning of which is necessary to show compliance with the Civil Air Regulations.
210 This requirement, as adopted by that amendment, was retained in CAR Part 4b until that regulation was recodified to the Federal Aviation Regulations, Part 25, effective February 1, 1965. At that time, this requirement, substantially unchanged, was identified as Section 25.1309. For many years the "single fault" or "fail safe" concept of this requirement, along with experience based on service-proven designs and engineering judgment, were used to successfully evaluate most airplane systems and equipment.
However, in the late 1960's there appeared a number of safety-critical systems that were utilizing new technical complexity to accomplish safety-critical functions. Due to the increasing complexity of the technology being used to develop these systems, it was becoming increasingly difficult to apply engineering judgment as the only means of determining the effects or likelihood of failure conditions. The increasing difficulty in evaluating these complex systems, along with the potential hazards to the airplane that could result from their failure made it necessary to provide duplicate and triplicate systems to assure an acceptable level of safety.
At about this same time, the development of rational methods for safety assessment of systems led to the conclusion that an inverse relationship should exist between the probability of a failure condition and its effect on the airplane. That is, the more serious the effect, the lower the probability must be that it will occur.
The availability of this rational method for safety analysis of systems, along with the increasing difficulty in applying the then existing "single fault" or "fail safe" concept, prompted the FAA to propose an amendment to Section 25.1309 which would permit the use of this rational method as an acceptable means of accomplishing safety analysis. That proposed revision to Section 25.1309, which specified a level of safety in qualitative terms, and required assessments to be made, was adopted by Amendment 25-23 on April 1, 1970.
At that time, the FAA also realized that more complex systems were being utilized in small airplanes and that there was a need to add a reliability requirement to Part 23.
Accordingly, rulemaking action was initiated which resulted in Section 23.1309 being added to Part 23 by Amendment 23.14, effective December 20, 1973. The requirements of that new Section 23.1309 were similar to those of Section 25.1309 prior to Amendment 25-23 which where based on the "single fault" or "fail safe" concept. At that time, it was not envisioned that complex safety-critical systems, utilizing technology now available, would be used in the designs of small airplanes.
Therefore, there was no identified need to include provisions for use of the rational method of analysis in Part 23, as had been done in Part 25 by Amendment 25-23.
Experience has shown that the envisioned rate of technical growth of systems used in small airplanes was inaccurate and that safety-critical systems are now being proposed for use on Part 23 airplanes. As with the earlier experience with Part 25, the FAA is finding that it is difficult to apply "single fault" concepts to these complex systems and to utilize the application of engineering judgment as the only means of
211 determining the effects or likelihood of certain failure conditions. Accordingly, there is now a need to revise the reliability requirements of Part 23 to allow the use of the latest available rational method for safety analysis of these complex safety-critical systems to assure continuation of the level of safety intended for airplanes certificated to Part 23. Such safety critical systems are currently being proposed for approval and there is an urgent need to accomplish this proposed rule change.
A recommendation for a complete change of Section 23.1309 was submitted as a part of the Small Airplane Airworthiness Review Program. That recommendation, conference proposal number 434, was discussed during the October 22-26, 1984, Small Airplane Airworthiness Review Program conference held in St. Louis, Missouri. A copy of the transcript of all discussions held during the conference is filed in Docket No. 23494, and may be examined by interested persons.
At that conference a commenter on the recommendation noted that it dealt with failures that cause hazards which do not have catastrophic potential, but does not deal with hazards which are potentially catastrophic. As noted in the above discussion, in the development of requirements for small airplane systems it was originally recognized that failures of systems could produce hazards and the earlier requirements addressed protection from those failures, but did not address safetycritical systems whose failures could be potentially catastrophic or would be catastrophic. As proposed, Section 23.1309 addresses all levels of hazards and the proposed requirements are based on the criticality of the system.
This would be accomplished by requiring all of the airplane's systems to be reviewed to determine (1) if the airplane is dependent upon a system function for continued safe flight and landing, and (2) if a failure of any system on the airplane, not limited to VFR conditions, would significantly reduce the ability of the crew to cope with the adverse operating conditions. For airplanes that do not include systems which perform either of these safety critical functions, the single-fault or fail-safe concept requirements would continue to be applicable as proposed in Section 23.1309(a).
If the design of the airplane includes systems that perform a function that is needed for continued safety flight and landing of the airplane and, accordingly, whose failure could be catastrophic, the systems would be required to meet standards that establish that failures of the system must be extremely improbable. In addition, on airplanes designed for any type of operation other than VFR, the systems whose failures would significantly reduce the airplane's capability, of the ability of the crew to cope with the adverse operating conditions and, thereby, be potentially catastrophic would be required to meet standards that establish that failures of these systems are improbable. This standard is applicable if a system failure would reduce the capability of the airplane or the crew to cope with adverse operating conditions. It was recognized that any failure will reduce the airplane's or crew's capability by some degree, but that reduction may not be of the degree that will make operation of the airplane potentially catastrophic. The intent of this proposed standard, Section
23.1309(b), is to have those systems whose failure would be catastrophic or
212 potentially catastrophic be evaluated using the latest available techniques and, thereby, better assure that failures of such systems will not occur.
At the conference, a commenter expressed the opinion that the language of conference proposal 434 would require all system items to meet the analysis test and proof of compliance means. This commenter noted that simple and conventional systems can be assessed on the basis of service experience and engineering judgment and noted that low performance, simple designed airplanes should be able to use the existing method of determining compliance. The FAA agrees with this commenter and, as previously stated, proposed Section 23.1309(a) is structured to allow the use of existing procedures for simple airplane system designs.
Another conference commenter expressed a concern over the applicability of Section XX.1309 of any of the airworthiness parts. To clarify the applicability of Section
23.1309, a definition of "system" is included in proposed Section 23.1309(f).
One commenter noted the difference in the way Part 23 and Part 25 airplanes are used and suggested different probability values for Part 23, but did not provide recommended values. In reviewing this comment, it should be noted that the probability terms do not have values assigned in these proposed requirements of other airworthiness parts. Extremely improbable failure conditions have been defined in FAA guidance material as those which are so unlikely that they are expected to occur within the total operational life of all airplanes of one type. If such a definition were to be applied to items of structure, a failure that would cause the loss of a wing would be a type of catastrophic failure that would not be expected to occur in the life of all airplanes of one type. As cited, current requirements applicable to other portions of Part 23 airplanes, such as structures, establish a level of safety that does not permit the occurrence of catastrophic failures and, accordingly, there is no justification for allowing a lower level of safety for possible catastrophic system failures. Accordingly, the proposed language of this proposal uses the term "extremely improbable" to define this critical type of failure condition.
Less critical failure condition terms used in airworthiness requirements for other categories of aircraft are also included in this proposal.
Other review conference comments, not limited to any one commenter, questioned the applicability of the rational method for analysis to two-to-four-place airplanes.
While this proposal allows the continued use of existing certification procedures for certification of simple airplane designs, it would, however, also require the use of rational procedures if the airplane's design includes systems for the accomplishment of safety-critical functions. Because the proposed additional requirements of this proposal are added in such a manner as to make their use dependent on the complexity of the affected design and because the degree of reliability required in a particular design will depend upon the criticality of the system function, there is no reason to limit these requirements to a size of airplane or to differentiate between single or multiengine types of airplanes.
213 One review conference commenter questioned the power supply requirements of the conference proposal number 434. This commenter asked if this proposed requirement is related purely to electrical power, and if it is, shouldn't it be located elsewhere in Part 23. During the discussion of this question, it was pointed out by FAA panel members that the proposed requirement does not specify an "electrical" power supply and, therefore, would be applicable to any form of power supply provided for a system that is required by this chapter. No additional language has been added to identify the types of power supply. The proposal language, which is similar to that used in other airworthiness parts, identifies requirements for power supplies used for each item of equipment, system, and installation required by this chapter. By its applicability, it is clear that the requirements are not limited to electrical power supplies.
Additional discussions at the conference suggested that current Section 23.1309 was adequate and that the only need was an Advisory Circular (AC) to identify acceptable means of compliance. At that time, the FAA made it known that was not the case, and cited instances in which a complex safety-critical system had been used in the design of small airplanes that could not be properly evaluated under the existing "single fault" concept of Section 23.1309. The FAA further noted that the number of occurrences where such a complex safety-critical system was being used in the design was increasing rapidly and noted the need to revise the requirements to keep them current with this rapid expansion of technology being applied to the design of small airplanes.
The FAA attempted to address some current issues relative to electronic flight instrument systems and autopilot monitors and limiters in advisory circulars. FAA review of resulting material in the draft advisory circulars determined that the contents were rulemaking in nature and not suitable in an advisory circular. The concern was relative to the complexity and criticality of such equipment. This proposal, when adopted, will provide a regulatory basis for determining the criticality level of such systems and require corresponding levels of reliability requirements which are based on the criticality of the system's function and will provide the updated standards needed for the certification of complex safety-critical systems in small airplanes.”
This amendment is explained by Final Rule, Docket 25812 as follows: “This proposal would retain the existing reliability requirements of current Section 23.1309 for airplane equipment, systems, and installations that are not complex and do not perform safety-critical functions. For those cases where the applicant finds it necessary or desirable to include complex, safety-critical systems, this proposal also would provide additional requirements for identifying such equipment, systems, and installations and would define additional requirements needed for their certification.
This proposal would permit the approval of more advanced systems having the capability to perform critical functions and whose failure condition would prevent the continued safe flight and landing of the airplane.
214 Two commenters offer comments on proposed Section 23.1309. One of these commenters concurs with the concept of updating the reliability requirements applicable to airplanes not limited to Visual Flight Rules (VFR) flight, but does not concur with this updating for all airplanes. As discussed in Notice Number 89-6, this proposal addresses the systems installed on airplanes and is not limited to the operations approval of the airplane. The airworthiness standards, as adopted in Section 23.1309(a), are based on single-fault or fail-safe concepts and experience based on service-proven designs and engineering judgment. These requirements should be used for airplanes whose systems are not complex and do not perform safety-critical functions. Therefore, Section 23.1309(a) is structured to allow the use of existing procedures for simple airplane system designs.
If the design of the airplane includes equipment, systems, and installations that perform functions whose failure condition would prevent continued safe flight and landing of the airplane, the occurrence of each failure conditions must be extremely improbable. In addition, on airplanes designed for any type of operation not limited to VFR, the systems whose failure conditions would significantly reduce the airplane's capability, or the ability of the crew, to cope with the adverse operating conditions must be improbable. It was recognized that any failure would reduce the airplane's or crew's capability by some degree, but that reduction may not be of the degree that would make operation of the airplane potentially catastrophic. The intent of Section 23.1309(b) is to require that systems whose failure would be catastrophic or potentially catastrophic be evaluated using the latest available analysis techniques.
Although future airplane designs limited to VFR operations are not likely to include equipment, systems, and installations whose failure condition would prevent continued safe flight and landing of the airplane, the applicability of this requirement, as discussed above, will provide airworthiness standards if the applicant elects to include such systems in the airplane's design. Therefore, the applicability of this requirement has not been revised as suggested by this commenter.
One commenter suggests that the critical environmental system considered in Section
23.1309(c) would be better defined by removing the words "such as" from the proposed paragraph and replacing them with the word "including." The FAA agrees that the suggested wording more accurately identifies the intent of this paragraph, as discussed in this notice. The wording of paragraph (e) of Section 23.1309 has been revised accordingly.
This same commenter notes that there are proposals being considered for a new Sections 25.1315 and 15.1317, which deal with the effects of lightning and external high energy radiated electromagnetic fields, and suggests that similar actions be considered for part 23 rules. Although this comment is beyond the scope of the actions proposed in Notice Number 89-6, the FAA recognizes the desirability of having the various airworthiness standards address like requirements in the respective sections and will consider this comment in future rulemaking actions.”
215 Lightning Protection See AC 23.1309-1E, “System Safety Analysis and Assessment for Part 23 Airplanes,” AC 20-136A, “Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning,” AC 20-155, “SAE Documents to Support aircraft Lightning Protection Certification,” and RTCA DO-160F, “Environmental Test Conditions and Test Procedures for Airborne Equipment,” Section 22, for guidance on lightning certification of IFR airplanes.
Several SAE documents have been issued and the FAA finds the following SAE documents acceptable:
SAE ARP 5412A, “Aircraft Lightning Environment and Related Test Waveforms”, February 21, 2005.
SAE ARP 5414A, “Aircraft Lightning Zoning”, February 16, 2005.
SAE ARP 5415A, “Users Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning”, May 14, 2002.
SAE ARP 5416, “Aircraft Lightning Test Methods,” March 17, 2005.
SAE ARP 5577, "Aircraft Lightning Direct Effects Certification”, September 30, 2002.
Figure 2 in AC 23.1309-1E provides software development assurance levels as a function of airplane class and failure condition. For example, a Class I single reciprocating engine airplane should use a software design assurance level C or higher for systems with catastrophic failure conditions. A Class III airplane should use software design assurance level B or higher for systems with catastrophic failure conditions. Some applicants have assumed that this table is also the level of lightning protection compliance rigor. These levels in Figure 2 are not for the lightning protection requirements only for software and complex hardware. The lightning protection compliance approach for the failure condition classifications (catastrophic, hazardous, major, minor, or no effect) is in the specific guidance for lightning.
EASA requires applicants to use the EUROCAE documents that are technically identical to the ARP(s) listed.
High Intensity Radiated Fields (HIRF) See Section 23.1308.
Change 1 AC 23-17C 7/16/2012
216 Electronic Engine Control (EEC) Systems Section 23.1309 does not apply to powerplant systems provided as part of the certificated engines according to § 23.1309(f). This rule did not envisage digital engine controls. Special conditions will be required for electronic engine controls without a hydromechanical back-up system that has the reliability and performance of a traditional reciprocating engine without electronic engine controls. The special conditions will require compliance to HIRF and § 23.1309(a) through (e), according to the latest amendment, for these digital engine controls. Appropriate engine certification data may be used for airplane certification. Even though an engine control may be certificated as part of the engine, the installation aspects of the installation require certification to part 23. Experience has shown that changes required for aircraft certification may require changes to the engine software with the associated engine certification of those changes.
Acceptance of either engine mounted and engine certificated Full Authority Digital Electronic Engine Control (FADEC) or EECs does not mean that approval at the airplane level is automatic.
Software changes initiated either by the engine manufacturer, FADEC, or EEC manufacturer should be validated on each software change of their effect on part 23 certification requirements. Any and all engine control software changes must be coordinated with the appropriate ACO to assess the impact on part 23 certification requirements.
Standardization of Application of 14 CFR, Part 23, § 23.1309, Regarding Hazardous Misleading Heading Information for Attitude-Heading Reference Systems (AHRS)
Purpose
The purpose of this guidance is to clarify FAA certification policy on the application of AC 23.1309-1E, “System Safety Analysis and Assessment for Part 23 Airplanes,” regarding hazardous misleading heading information.
The issue in question is specifically about the application of AC 23.1309-1E for an airplane with a certification basis of amendment 23-41 or later. This clarification is limited to installations approved for operation in Instrument Meteorological Conditions (IMC) under IFR.
For operations in Visual Meteorological Conditions, a misleading heading indication is not considered hazardous.
Change 1 AC 23-17C 7/16/2012
217 Current Regulatory and Advisory Material
14 CFR part 23, § 23.1309, Equipment, systems, and installations.
Technical Standard Order (TSO) TSO-C151b, “Terrain Awareness and Warning System”, May 6, 2002.
AC 23.1309-1E, “System Safety Analysis and Assessment for Part 23 Airplanes,” November 11, 2011.
AC 23-18, “Installation of Terrain Awareness and Warning System (TAWS) Approved for Part 23 Airplanes”, June 14, 2000.
Summary
A Functional Hazard Assessment (FHA) and the related safety assessments should be made for the specific airplane type and configuration. There can be many combinations of failures, various mitigating factors, and other functions available to a pilot. Because of the many factors that affect the criticality of the heading indication, a safety assessment process using AC 23.1309-1E should be used to classify the failure conditions for misleading heading information.
A hazardously misleading heading is usually when the accuracy error is greater than 10 degrees on the primary heading instrument and it is an undetected error from the AHRS. The safety assessment process should consider appropriate mitigating factors that might reduce failure conditions effects, including:
1. availability, accuracy, and reli ability of magnetic compass;
2. independent heading instrument;
3. independent navigation information;
4. moving map if approved for IFR operations;
5. TAWS, if approved (for design and perf ormance) according to TSO-C151b, Class A or B, and following AC 23-18 (for airworthiness approval for the installation);
6. air traffic control monito ring of the aircraft; and
7. exposure time.
218 Safety Assessment Process
A hazardously misleading heading is usually when the accuracy error is greater than 10 degrees due to a malfunction on the primary heading system using the AHRS. The normal accuracy should be within the guidelines under section 23.1301 in this AC.
For Class I part 23 airplanes, the failure condition for misleading hazardous heading is usually considered major according to AC 23.1309-1E.
For a major failure condition on Class I airplanes, the likelihood for the system to provide hazardously misleading heading information to the display should be less than or equal to 10-4 per flight hour because of undetected or latent failures. For Class II, III, and IV airplanes, the probability for the system to provide hazardously misleading heading information to the display should be less than or equal to 10-5 per flight hour because of undetected or latent failures. For major failure conditions, a qualitative analysis is usually sufficient.
NOTE: There is a difference between hazardous as used in general policy or regulations and hazardous failure condition as used in an FHA. When the term "hazard" or "hazardous" is used in general policy or regulations, it is generally defined as follows:
"Any condition that compromises the overall safety of the airplane or that significantly reduces the ability of the flight crew to cope with adverse operating conditions."
When used in an FHA, "hazardous failure condition" is one of the five different failure conditions classifications in AC 23.1309-1E. Hazardous failure conditions would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent there would be the following:
A large reduction in safety margins or functional capabilities;
(1) Physical distress or higher workload such that the flight crew cannot be relied on to perform their tasks accurately or completely; or
(2) Serious or fatal injury to an o ccupant other than the flight crew.
Mitigating Factors
During the safety assessment process, mitigating factors should be considered if they are independent of the AHRS. These factors should provide additional qualitative and quantitative credit and alleviate failure conditions. The mitigating factors may include the following:
1. availability, accuracy, and reliability of magnetic compass; independent heading instrument;
2. independent naviga tion information;
3. moving map if approve d for IFR operations;
4. TAWS, if approved (for design and pe rformance) in accordance with TSO- C151b, Class A or B, and following AC 23-18 (for airworthiness approval of the installation);
5. air traffic control monitoring of the aircraft; and exposure time.
Some of these factors may not be appropriate for higher performance and complex airplanes.
Normally, for Class I and some Class II airplanes, the pilot should be scanning the instruments for cues to determine misleading information. Therefore, the locations of primary instruments and secondary instruments should be within the primary and secondary fields-of-view. This is defined in GAMA Publication No. 10, “Recommended Practices and Guidelines for Part 23 Cockpit/Flight Deck Design,” dated September 2000.
Magnetic Compass or Independent Heading Instrument
The usability of the magnetic compass, as a mitigating factor, is dependent on the airplane installation on a case-by-case basis. The following guidelines should be considered. A magnetic compass or independent heading instrument is considered acceptable if the accuracy is within 10 degrees and it is located in the secondary fieldof-view. However, the compass may not be usable if it is susceptible to large errors induced by other onboard equipment. For example, an airplane approved for known icing may have an unusable compass when a windshield heater is affecting the compass; therefore, additional mitigating factors may be necessary to meet the appropriate safety level.
One general concern is that Class II airplanes may have some systems that can affect the magnetic compass that are not typically found in Class I airplanes. Therefore, the magnetic compass should be usable for many Class I airplanes, but it may not be usable for many Class II airplanes or higher. An evaluation should be conducted to determine if the magnetic compass is usable and accurate within 10 degrees.
Navigation Information
Credit should also be given for moving maps displaying position information from independent navigation systems such as GPS that are approved for IFR operations.
The moving map should depict the airplane relative to the desired navigation track and the navigational tracks heading.
220 Navigation systems such as IFR-approved GPS systems can provide an independent relative heading source that can be used to verify the primary heading indication.
Besides, the FAA expects that pilots will naturally crosscheck their moving map displays because they are easier to use for navigation than traditional deviation needles.
The moving map should be in the primary field-of-view (preferably) or the secondary field-of-view to get credit for the safety assessment process by AC 23.1309-1E.
TAWS
TAWS with a display provides the pilot with sufficient information and alerts to detect potentially hazardous terrain situations so the pilot may take effective action to prevent CFIT events. Although a TAWS with a display is not approved for navigation under normal circumstances, under emergency conditions TAWS provides acceptable situational awareness to prevent CFIT.
TAWS may not be usable to determine misleading heading information, but TAWS should reduce or prevent a CFIT accident. TAWS that meet TSO-C151b, Class A or B, and AC 23-18 is acceptable.
Air Traffic Control Monitoring
For most IFR operations, the airplane will be in controlled airspace and under radar coverage. Air Traffic Control (ATC) has been the primary mitigating factor for heading indicator accuracy for many decades. ATC maneuvers airplanes based on a ground track. Heading errors in traditional mechanical Directional Gyros (DG) are still identified by ATC when pilots do not maneuver in the direction ATC expects.
Most of the time ATC will identify heading errors when the pilot fails to adequately update their DG or their horizontal situation indicator has failed.
However, there are locations at some airports where radar coverage is not available.
There is usually some type of navigation signal that pilots can use to get into and out of the airport. These are the types of departures and approaches where heading accuracy may be important. Although ATC may be a mitigating factor, specific guidelines are not being provided now.
Exposure Time and Risk Assessment
Exposure time and risk factors that may be considered are as follows:
1. automatic pre-engagement self test;
2. monitoring capabilities;
2. maintenance intervals; and