A recommendation for a complete change of Section 23.1309 was submitted as a part of the Small Airplane Airworthiness Review Program. That recommendation, conference proposal number 434, was discussed during the October 22-26, 1984, Small Airplane Airworthiness Review Program conference held in St. Louis, Missouri. A copy of the transcript of all discussions held during the conference is filed in Docket No. 23494, and may be examined by interested persons.
At that conference a commenter on the recommendation noted that it dealt with failures that cause hazards which do not have catastrophic potential, but does not deal with hazards which are potentially catastrophic. As noted in the above discussion, in the development of requirements for small airplane systems it was originally recognized that failures of systems could produce hazards and the earlier requirements addressed protection from those failures, but did not address safetycritical systems whose failures could be potentially catastrophic or would be catastrophic. As proposed, Section 23.1309 addresses all levels of hazards and the proposed requirements are based on the criticality of the system.
This would be accomplished by requiring all of the airplane's systems to be reviewed to determine (1) if the airplane is dependent upon a system function for continued safe flight and landing, and (2) if a failure of any system on the airplane, not limited to VFR conditions, would significantly reduce the ability of the crew to cope with the adverse operating conditions. For airplanes that do not include systems which perform either of these safety critical functions, the single-fault or fail-safe concept requirements would continue to be applicable as proposed in Section 23.1309(a).
If the design of the airplane includes systems that perform a function that is needed for continued safety flight and landing of the airplane and, accordingly, whose failure could be catastrophic, the systems would be required to meet standards that establish that failures of the system must be extremely improbable. In addition, on airplanes designed for any type of operation other than VFR, the systems whose failures would significantly reduce the airplane's capability, of the ability of the crew to cope with the adverse operating conditions and, thereby, be potentially catastrophic would be required to meet standards that establish that failures of these systems are improbable. This standard is applicable if a system failure would reduce the capability of the airplane or the crew to cope with adverse operating conditions. It was recognized that any failure will reduce the airplane's or crew's capability by some degree, but that reduction may not be of the degree that will make operation of the airplane potentially catastrophic. The intent of this proposed standard, Section
23.1309(b), is to have those systems whose failure would be catastrophic or potentially catastrophic be evaluated using the latest available techniques and, thereby, better assure that failures of such systems will not occur.
At the conference, a commenter expressed the opinion that the language of conference proposal 434 would require all system items to meet the analysis test 206
and proof of compliance means. This commenter noted that simple and conventional systems can be assessed on the basis of service experience and engineering judgment and noted that low performance, simple designed airplanes should be able to use the existing method of determining compliance. The FAA agrees with this commenter and, as previously stated, proposed Section 23.1309(a) is structured to allow the use of existing procedures for simple airplane system designs.
Another conference commenter expressed a concern over the applicability of Section XX.1309 of any of the airworthiness parts. To clarify the applicability of Section
23.1309, a definition of "system" is included in proposed Section 23.1309(f).
One commenter noted the difference in the way Part 23 and Part 25 airplanes are used and suggested different probability values for Part 23, but did not provide recommended values. In reviewing this comment, it should be noted that the probability terms do not have values assigned in these proposed requirements of other airworthiness parts. Extremely improbable failure conditions have been defined in FAA guidance material as those which are so unlikely that they are expected to occur within the total operational life of all airplanes of one type. If such a definition were to be applied to items of structure, a failure that would cause the loss of a wing would be a type of catastrophic failure that would not be expected to occur in the life of all airplanes of one type. As cited, current requirements applicable to other portions of Part 23 airplanes, such as structures, establish a level of safety that does not permit the occurrence of catastrophic failures and, accordingly, there is no justification for allowing a lower level of safety for possible catastrophic system failures. Accordingly, the proposed language of this proposal uses the term "extremely improbable" to define this critical type of failure condition.
Less critical failure condition terms used in airworthiness requirements for other categories of aircraft are also included in this proposal.
Other review conference comments, not limited to any one commenter, questioned the applicability of the rational method for analysis to two-to-four-place airplanes.
While this proposal allows the continued use of existing certification procedures for certification of simple airplane designs, it would, however, also require the use of rational procedures if the airplane's design includes systems for the accomplishment of safety-critical functions. Because the proposed additional requirements of this proposal are added in such a manner as to make their use dependent on the complexity of the affected design and because the degree of reliability required in a particular design will depend upon the criticality of the system function, there is no reason to limit these requirements to a size of airplane or to differentiate between single or multiengine types of airplanes.
One review conference commenter questioned the power supply requirements of the conference proposal number 434. This commenter asked if this proposed 207
requirement is related purely to electrical power, and if it is, shouldn't it be located elsewhere in Part 23. During the discussion of this question, it was pointed out by FAA panel members that the proposed requirement does not specify an "electrical" power supply and, therefore, would be applicable to any form of power supply provided for a system that is required by this chapter. No additional language has been added to identify the types of power supply. The proposal language, which is similar to that used in other airworthiness parts, identifies requirements for power supplies used for each item of equipment, system, and installation required by this chapter. By its applicability, it is clear that the requirements are not limited to electrical power supplies.
Additional discussions at the conference suggested that current Section 23.1309 was adequate and that the only need was an Advisory Circular (AC) to identify acceptable means of compliance. At that time, the FAA made it known that was not the case, and cited instances in which a complex safety-critical system had been used in the design of small airplanes that could not be properly evaluated under the existing "single fault" concept of Section 23.1309. The FAA further noted that the number of occurrences where such a complex safety-critical system was being used in the design was increasing rapidly and noted the need to revise the requirements to keep them current with this rapid expansion of technology being applied to the design of small airplanes.
The FAA attempted to address some current issues relative to electronic flight instrument systems and autopilot monitors and limiters in advisory circulars. FAA review of resulting material in the draft advisory circulars determined that the contents were rulemaking in nature and not suitable in an advisory circular. The concern was relative to the complexity and criticality of such equipment. This proposal, when adopted, will provide a regulatory basis for determining the criticality level of such systems and require corresponding levels of reliability requirements which are based on the criticality of the system's function and will provide the updated standards needed for the certification of complex safety-critical systems in small airplanes.
This amendment is explained by Final Rule, Docket 25812 as follows: This proposal would retain the existing reliability requirements of current Section 23.1309 for airplane equipment, systems, and installations that are not complex and do not perform safety-critical functions. For those cases where the applicant finds it necessary or desirable to include complex, safety-critical systems, this proposal also would provide additional requirements for identifying such equipment, systems, and installations and would define additional requirements needed for their certification.
This proposal would permit the approval of more advanced systems having the capability to perform critical functions and whose failure condition would prevent the continued safe flight and landing of the airplane.
Two commenters offer comments on proposed Section 23.1309. One of these commenters concurs with the concept of updating the reliability requirements applicable to airplanes not limited to Visual Flight Rules (VFR) flight, but does not concur with this updating for all airplanes. As discussed in Notice Number 89-6, this proposal addresses the systems installed on airplanes and is not limited to the operations approval of the airplane. The airworthiness standards, as adopted in Section 23.1309(a), are based on single-fault or fail-safe concepts and experience based on service-proven designs and engineering judgment. These requirements should be used for airplanes whose systems are not complex and do not perform safety-critical functions. Therefore, Section 23.1309(a) is structured to allow the use of existing procedures for simple airplane system designs.
If the design of the airplane includes equipment, systems, and installations that perform functions whose failure condition would prevent continued safe flight and landing of the airplane, the occurrence of each failure conditions must be extremely improbable. In addition, on airplanes designed for any type of operation not limited to VFR, the systems whose failure conditions would significantly reduce the airplane's capability, or the ability of the crew, to cope with the adverse operating conditions must be improbable. It was recognized that any failure would reduce the airplane's or crew's capability by some degree, but that reduction may not be of the degree that would make operation of the airplane potentially catastrophic. The intent of Section 23.1309(b) is to require that systems whose failure would be catastrophic or potentially catastrophic be evaluated using the latest available analysis techniques.
Although future airplane designs limited to VFR operations are not likely to include equipment, systems, and installations whose failure condition would prevent continued safe flight and landing of the airplane, the applicability of this requirement, as discussed above, will provide airworthiness standards if the applicant elects to include such systems in the airplane's design. Therefore, the applicability of this requirement has not been revised as suggested by this commenter.
One commenter suggests that the critical environmental system considered in Section
23.1309(c) would be better defined by removing the words "such as" from the proposed paragraph and replacing them with the word "including." The FAA agrees that the suggested wording more accurately identifies the intent of this paragraph, as discussed in this notice. The wording of paragraph (e) of Section 23.1309 has been revised accordingly.
This same commenter notes that there are proposals being considered for a new Sections 25.1315 and 15.1317, which deal with the effects of lightning and external high energy radiated electromagnetic fields, and suggests that similar actions be considered for part 23 rules. Although this comment is beyond the scope of the actions proposed in Notice Number 89-6, the FAA recognizes the desirability of 209
having the various airworthiness standards address like requirements in the respective sections and will consider this comment in future rulemaking actions.”
Lightning Protection See AC 23.1309-1C, “Equipment, Systems, and Installations in Part 23 Airplanes,” AC 20-136, “Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning,” and RTCA DO-160D, “Environmental Test Conditions and Test Procedures for Airborne Equipment,” Section 22, for guidance on lightning certification of IFR airplanes. As part of the ongoing review of natural lightning by the SAE Lightning Committee AE2 and EUROCAE WG-31, the multiple stroke and burst environmental criteria was revised from the AC 20-136 requirement as defined in SAE ARP 5412, “Aircraft Lightning Environment and Related Test Waveforms.”
Several SAE documents have been issued and the FAA finds the following SAE documents acceptable:
SAE ARP 5412, “Aircraft Lightning Environment and Related Test Waveforms”, November 1, 1999.
SAE ARP 5413, “Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning,” (it is being incorporated into an AC), May 14, 2002.
SAE ARP 5414, “Aircraft Lightning Zoning”, December 1, 1999.
SAE ARP 5415, “Users Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning”, May 14, 2002.
SAE ARP 5577, "Aircraft Lightning Direct Effects Certification”, September 30, 2002.
High Intensity Radiated Fields (HIRF) Special conditions will still be required for critical systems for HIRF, since the words “radio frequency energy” in this rule are not intended to include HIRF. RTCA DO-160D, section 20, is applicable for bench level testing for HIRF.
Electronic Engine Control (EEC) Systems Section 23.1309 does not apply to powerplant systems provided as part of the certificated engines according to paragraph (f). This rule did not envisage digital engine controls. Special conditions will be required for electronic engine controls without a hydromechanical back-up system that has the reliability and performance of a traditional reciprocating engine without electronic engine controls. The special conditions will require compliance to HIRF and § 23.1309(a) through (e), according to the latest amendment, for these digital engine controls. Appropriate engine certification data may be used for airplane certification. Even though an engine control may be certificated as part of the engine, the installation aspects of the installation require certification to part 23. Experience has shown that changes required for aircraft certification may require changes to the engine software with the associated engine certification of those changes.
Acceptance of either engine mounted and engine certificated Full Authority Digital Electronic Engine Control (FADEC) or EECs does not mean that approval at the airplane level is automatic. Flight-testing is still required to assure all part 23 requirements are met.
Software changes initiated either by the engine manufacturer, FADEC, or EEC manufacturer should be validated on each software change of their effect on part 23 certification requirements. Any and all engine control software changes must be coordinated with the appropriate ACO to assess the impact on part 23 certification requirements.
Standardization of Application of 14 CFR, Part 23, § 23.1309, Regarding Hazardous Misleading Heading Information for Attitude-Heading Reference Systems (AHRS)
Purpose
The purpose of this guidance is to clarify FAA certification policy on the application of AC 23.1309-1C, “Equipment, Systems, and Installations in Part 23 Airplanes,” regarding hazardous misleading heading information.
The issue in question is specifically about the application of AC 23.1309-1C for an airplane with a certification basis of amendment 23-41 or later. This clarification is limited to installations approved for operation in Instrument Meteorological Conditions (IMC) under IFR.
For operations in Visual Meteorological Conditions, a misleading heading indication is not considered hazardous.
Current Regulatory and Advisory Material
14 CFR part 23, § 23.1309, Equipment, systems, and installations
Technical Standard Order (TSO) TSO-C151b, “Terrain Awareness and Warning System”, May 6, 2002.
AC 23.1309-1C, “Equipment, Systems, and Installations in Part 23 Airplanes”, March 12, 1994.
AC 23-18, “Installation of Terrain Awareness and Warning System (TAWS) Approved for Part 23 Airplanes”, June 14, 2000.
Summary
A Functional Hazard Assessment (FHA) and the related safety assessments should be made for the specific airplane type and configuration. There can be many combinations of failures, various mitigating factors, and other functions available to a pilot. Because of the many factors that affect the criticality of the heading indication, a safety assessment process using AC 23.1309-1C should be used to classify the failure conditions for misleading heading information.
A hazardously misleading heading is usually when the accuracy error is greater than 10 degrees on the primary heading instrument and it is an undetected error from the AHRS. The safety assessment process should consider appropriate mitigating factors that might reduce failure conditions effects, including:
availability, accuracy, and reliability of magnetic compass;
independent heading instrument;
independent navigation information;
moving map if approved for IFR operations;
TAWS, if approved (for design and performance) according to TSO-C151ab, Class A or B, and following AC 23-18 (for airworthiness approval for the installation);
air traffic control monitoring of the aircraft; and
exposure time.
Safety Assessment Process
A hazardously misleading heading is usually when the accuracy error is greater than 10 degrees due to a malfunction on the primary heading system using the AHRS.
The normal accuracy should be within the guidelines under section 23.1301 in this AC. For Class I part 23 airplanes, the failure condition for misleading hazardous heading is usually considered major according to AC 23.1309-1C.
For a major failure condition on Class I airplanes, the likelihood for the system to provide hazardously misleading heading information to the display should be less than or equal to 10-4 per flight hour because of undetected or latent failures. For Class II, III, and IV airplanes, the probability for the system to provide hazardously misleading heading information to the display should be less than or equal to 10-5 per flight hour because of undetected or latent failures. For major failure conditions, a qualitative analysis is usually sufficient.
NOTE 17: There is a difference between hazardous as used in general policy or regulations and hazardous failure condition as used in an FHA. When the term "hazard" or "hazardous" is used in general policy or regulations, it is generally defined as follows:
"Any condition that compromises the overall safety of the airplane or that significantly reduces the ability of the flight crew to cope with adverse operating conditions."
When used in an FHA, "hazardous failure condition" is one of the five different failure conditions classifications in AC 23.1309-1C. Hazardous failure conditions would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent there would be the following:
A large reduction in safety margins or functional capabilities;
(1) Physical distress or higher workload such that the flight crew cannot be relied on to perform their tasks accurately or completely; or
(2) Serious or fatal injury to an occupant other than the flight crew.
Mitigating Factors
During the safety assessment process, mitigating factors should be considered if they are independent of the AHRS. These factors should provide additional qualitative and quantitative credit and alleviate failure conditions. The mitigating factors may include the following:
availability, accuracy, and reliability of magnetic compass;
independent heading instrument;
independent navigation information;
moving map if approved for IFR operations;
TAWS, if approved (for design and performance) in accordance with TSO-C151ab, Class A or B, and following AC 23-18 (for airworthiness approval of the installation);
air traffic control monitoring of the aircraft; and exposure time.
Some of these factors may not be appropriate for higher performance and complex airplanes.
Normally, for Class I and some Class II airplanes, the pilot should be scanning the instruments for cues to determine misleading information. Therefore, the locations of primary instruments and secondary instruments should be within the primary and secondary fields-of-view. This is defined in GAMA Publication No. 10, “Recommended Practices and Guidelines for Part 23 Cockpit/Flight Deck Design,” dated September 2000.
Magnetic Compass or Independent Heading Instrument
The usability of the magnetic compass, as a mitigating factor, is dependent on the airplane installation on a case-by-case basis. The following guidelines should be considered. A magnetic compass or independent heading instrument is considered acceptable if the accuracy is within 10 degrees and it is located in the secondary fieldof-view. However, the compass may not be usable if it is susceptible to large errors induced by other onboard equipment. For example, an airplane approved for known icing may have an unusable compass when a windshield heater is affecting the compass; therefore, additional mitigating factors may be necessary to meet the appropriate safety level.
One general concern is that Class II airplanes may have some systems that can affect the magnetic compass that are not typically found in Class I airplanes. Therefore, the magnetic compass should be usable for many Class I airplanes, but it may not be usable for many Class II airplanes or higher. An evaluation should be conducted to determine if the magnetic compass is usable and accurate within 10 degrees.
Navigation Information
Credit should also be given for moving maps displaying position information from independent navigation systems such as GPS that are approved for IFR operations.
The moving map should depict the airplane relative to the desired navigation track and the navigational tracks heading.
Navigation systems such as IFR-approved GPS systems can provide an independent relative heading source that can be used to verify the primary heading indication.
Besides, the FAA expects that pilots will naturally crosscheck their moving map displays because they are easier to use for navigation than traditional deviation needles.
The moving map should be in the primary field-of-view (preferably) or the secondary field-of-view to get credit for the safety assessment process by AC 23.1309-1C.
TAWS
TAWS with a display provides the pilot with sufficient information and alerts to detect potentially hazardous terrain situations so the pilot may take effective action to prevent CFIT events. Although a TAWS with a display is not approved for navigation under normal circumstances, under emergency conditions TAWS provides acceptable situational awareness to prevent CFIT.
TAWS may not be usable to determine misleading heading information, but TAWS should reduce or prevent a CFIT accident, which will mitigate the failure effect.
TAWS that meet TSO-C151ab, Class A or B, and AC 23-18 should be acceptable when pilot confidence proficiency is achieved through service history.
Air Traffic Control Monitoring
For most IFR operations, the airplane will be in controlled airspace and under radar coverage. Air Traffic Control (ATC) has been the primary mitigating factor for heading indicator accuracy for many decades. ATC maneuvers airplanes based on a ground track. Heading errors in traditional mechanical Directional Gyros (DG) are still identified by ATC when pilots do not maneuver in the direction ATC expects.
Most of the time ATC will identify heading errors when the pilot fails to adequately update their DG or their horizontal situation indicator has failed.
However, there are locations at some airports where radar coverage is not available.
There is usually some type of navigation signal that pilots can use to get into and out of the airport. These are the types of departures and approaches where heading accuracy may be important. Although ATC may be a mitigating factor, specific guidelines are not being provided now.
Exposure Time and Risk Assessment
Exposure time and risk factors that may be considered are as follows:
automatic pre-engagement self test;
monitoring capabilities;
maintenance intervals; and
phase of flight, and so forth.
In the SAE Standard ARP4761, “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment,” exposure time is defined as follows:
"The period of time between when an item was last known to be operating properly and when it will be known to be operating properly again."
In this guidance, risk is also being considered.
Risk assessment is the composite of:
the outcome or effect of the failure condition;
the average probability of the failure condition per flight hour; and
exposure time; and
likelihood of the outcome/effect of the hazard will occur.
the exposure time.
For risk assessments, a credit should be factored into the analysis that is proportional to the probability that a given failure condition will occur on the aircraft. This credit is related to the system level of the failure condition, the operational and environmental conditions, and the phase of flight.
To determine exposure time, the time the pilot would only be using heading information to navigate should be considered. Only a percentage of a typical IFR flight is flown navigating solely on the heading instrument. The critical times for heading are when the pilot is not navigating with a navigation instrument but is only using the heading instrument.
The details on how to calculate the “Average Probability Per Flight Hour” for a Failure Condition are given in Appendix C of AC 23.1309-1C. A common assumption for 14 CFR, part 23 airplanes is the average flight duration is one hour.
The FAAs General Aviation and Air Taxi Activity Survey gives estimated flight hours for IMC operations for specific airplanes. When researching the operations of specific airplane models, the result indicates that Class I airplanes are operated in IMC conditions about 20 percent of their total flight hours and Class II airplanes about 30 percent. Also, the FAA believes that only portions of most IFR flights are flown by navigating solely on the heading instruments.
Using the percentages for “phases of flight” from a Boeing accident study, the FAA estimates that on any given IFR flight, navigation solely by the heading instrument would only occur about 20 percent of the time. For this analysis, Class III and Class IV airplanes are assumed to be operating IFR nearly 100 percent of the time.
Acceptable Configurations for IFR Use Some acceptable configurations for IFR approval include:
Configuration A:
One dependable magnetic compass.
(1) A reliable magnetic gyroscopically stabilized heading system that together meets the AC 23.1309-1C reliability levels, such as 10-4 per flight hour for Class I airplane.
Configuration B:
A magnetic compass that meets the airworthiness requirements but cannot be given credit for AC 23.1309-1C purposes for the reasons under Magnetic Compass or Independent Heading Instrument paragraphs in the Safety Assessment Process.
(2) One magnetic gyroscopically stabilized heading system that meets the AC
23.1309-1C reliability levels, such as 10-4 per flight hour for Class I airplane, alone or in combination with one or more of the mitigating factors addressed such as moving map or TAWS with a display.
Configuration C:
(1) A magnetic compass that meets the airworthiness requirements but cannot be given credit for AC 23.1309-1C purposes for the reasons stated under Magnetic Compass or Independent Heading Instrument paragraphs in the Safety Assessment Process.