of compliance to §21.33 for simple systems if similarity is clearly documented for every model on the AML. The ACO and applicant must agree on this approach, and it must be documented in the Certification Plan and the Model Qualification Process. This approach is clearly recommended in existing guidance for stand-alone GPS receivers in AC 20-138A and should also be applicable to radios, horizontal situation indicators, course deviation indicators, and other typical avionics components.
c. Complex systems are defined as systems that require model specific interface or installation configuration changes or as single or multiple component systems that require significant data communication and integration with existing equipment, or both.
A complex AML STC may involve either an installation where similarity is not as easily shown between models or where the modification requires model specific changes for each airplane on the AML, or both. This may be handled by using model specific installation instructions added as an appendix to the generic set of instructions, or by separate model specific installation instructions clearly referenced on the AML. The applicant should “prototype” the system installation as each model is added to the AML to ensure that model specific requirements are addressed and integrated into the installation instructions. For complex installations, specific compliance and conformity inspections are necessary using model specific information in the installation instructions to comply with §21.33.
d. Complex AML STC approvals should be handled more like multimodel STC approvals, and require model specific documentation for each model listed on the AML.
For example, it may be necessary to produce a model specific System Safety Assessment for each model on the AML to satisfy §23.1309 for complex systems. It may be possible to use one set of §23.1309 compliance data for simple systems.
e. Regardless of the equipment being approved, the AML STC installation instructions must be detailed to allow multiple model installations. This should reduce the number of deviations from the STC data package that are sought for follow-on installations. The idea is to reduce the number of cases where maintenance data, accepted under part 43 rules, is used to support an installation when the STC data package either 1) does not correspond to the airplane, 2) does not address a particular interface, or 3) is incomplete. This may require more work up front for the applicant, but should reduce the number of problems for future installations.
7. What are some limits of the AML STC process?
a. The AML STC process is subject to the same guidelines and limits discussed in Order 8110.4B and 14 CFR, part 21, Subpart E. Therefore, it may not be suitable for new and novel features. The applicant and the ACO should coordinate on each specific certification project to determine if the AML process is applicable. The Small Airplane 9
Directorate should be involved in determining when an AML is applicable in cases where new and novel features are present through the Certification Project Notification (CPN) process according to Order 8110.4B.
b. Order 8110.4B states that if an applicant presents a foreign registered airplane as an article for inspection or test under any STC approval, the applicant must provide evidence the civil aviation authority of the State of Registration agrees to the modification to the airplane. This also applies to AML approvals.
c. The AML STC process should not be applied to those systems whose installation configuration varies significantly among various serial number aircraft of the same model, or those systems that can directly control the aircraft. For example, an AML STC would not be suitable for autopilot installations. For autopilot installations, there may be serial number specific airplane-rigging problems that have to be taken care of on a caseby-case basis. Another example would be a Reduced Vertical Separation Minimum (RVSM) STC approval where model and serial number specific static pressure system characteristics could preclude a generic approach to the certification project. There are cases where the static source error correction curve for RVSM approval is only applicable to a single serial number airplane. The part 91 RVSM guidance material contains details on group approval methods for RVSM approval.
d. High Intensity Radiated Fields (HIRF) and lightning compliance, as well as assumptions made during the Functional Hazard Analysis (FHA) and System Safety Assessment (SSA) for a particular system, may limit the use of the AML process since these items can be model dependent. The applicant and the ACO must agree on a process to allow these items to be addressed in a generic manner for the models on the AML, and agree on Continued Airworthiness procedures to maintain compliance for these items.
e. Deviations from the original approval to allow an installation on a particular model listed on the AML will require the installation instructions to be modified. The approval can also be completed under an individual STC, depending on the scope of the deviation. Existing processes in FAA Order 8300.10 must be used to determine when a deviation to the AML STC is necessary. A deviation is necessary when the installation does not match the equipment list and/or equipment integration approved in the original installation. Any deviations from the original STC must be documented and approved either by an ACO engineer, a DER, or the field inspector. The AML process is not meant to be a blanket approval that delegates the integration of additional equipment to the installer without FAA involvement.
CHAPTER 3. AML STC PROCESS
1. What are the key process steps to an AML STC?
a. The AML STC process is similar to other STC processes, with added steps to allow the requirements for the approval to span across type data sheets. Avionics installation approvals should follow the requirements in 14 CFR, part 21, subpart E, the guidance in Order 8110.4B, and the “Industry Guide to Avionics Approvals,” with the guidance in this AC. Figure 1, on the next page, shows a generalized flowchart for the AML process. For AML STC projects, the applicant is expected to submit a Project Specific Certification Plan (PSCP), following the CPI Process.
b. It is important for the applicant and the responsible ACO to coordinate at the start of the program to document properly the AML process in the PSCP or other FAA approved Certification Plan, which should include:
(1) Development of a Model Qualification Process (see Chapter 3, Section 3)
(2) Development of AML amendment procedures (see Chapter 3, Section 4)
(3) Agreement on data package requirements (see Chapter 4).
2. How is the AML created?
a. Eligibility for each model on the AML must be clearly documented by the applicant. For simple systems, it may be easier to prove similarity or identicality. For complex systems, the applicant may need to “prototype” the system installation as each model is added to the AML. This will ensure that model specific requirements have been addressed and integrated into model specific sections in the installation instructions and other documentation.
b. An applicant cannot simply apply engineering judgment to create the AML, but the applicant must document a repeatable decision process to include each model on the AML and the methods used to determine applicability. Also, the assumptions and limits for the approval must be clearly stated to avoid confusion for future installations or amendments to the AML. For example, RTCA/DO-160 environmental qualification performed during design approval for a particular operating environment on one model may not be suitable for other models being proposed for addition to the AML. Also, assumptions made during the FHA may limit which models can qualify for addition to the AML.
Standard Avionics Certification Process Product Proposed for Certification AML STC?
Develop/Submit PSCP NO YES Installation Complete & Cert Testing Complete
FAA ACO Issues Certificate Coordinate Model Qualification Process, AML Amendment Process, & AML Data Pkg Requirements with ACO Standard Avionics Certification Process Generate/Amend Model List & Issue 8110-3 Develop/Submit
AML PSCP Develop/Amend Installation Instructions End of Project New Models or Other Changes?
NO YES Installation Complete & Cert Testing Complete
FAA ACO Issues Certificate or AML
Figure 1 – General Process AML STC Approvals 12
c. It may necessary for an applicant to split an AML into sections to separate models into groups where similarity can be clearly shown. They may be split according to operational capabilities, certification basis, airplane classification under AC 23.1309, or by other model characteristics that can be clearly grouped. This would allow installation considerations for each group to be addressed separately.
d. The AML should contain a list of the most recent STC documentation to track revisions and changes as the AML is amended. It may be necessary for eligibility for each model on the AML to be revisited if a major change is made to an existing AML approval, such as a change to system design or intended function.
3. What is the Model Qualification Process?
a. The Model Qualification Process is a procedure, agreed on by the ACO and the applicant, that is used by the STC holder to capture specific engineering decisions, design attributes, limitations, and assumptions made during the system development or Technical Standard Order (TSO)/design approval. This helps standardize the AML STC approval process by formally documenting the engineering analysis used to determine applicability and eligibility of a given model for the AML STC.
b. The Model Qualification Process should capture assumptions made during the design phase of a particular piece of equipment and may preclude a model from being included on the AML because of these assumptions. For example, a decision by the equipment manufacturer to develop system software to current revision of RTCA/DO- 178 Level C for critical functions may limit the installation eligibility. According to AC 23.1309-1C, Figure 2, by only certifying to software level C for critical functions, installations for part 23 aircraft over 6,000 pounds are not acceptable and require a higher software development level. See Appendix 1 for more information.
c. The Model Qualification Process requires detailed foreknowledge of the system and the models proposed for the AML. The data submitted with the AML should include information showing the Model Qualification Process has been specifically applied to each model on the AML to verify applicability. The submittal should also include a form 8110-3 that approves the Model Qualification data package and recommends approval of the AML. The 8110.3 should include a clarifying note stating, "This approval is for engineering design data only and is not an installation approval," according to Order 8110.37C. The 8110-3 should reference applicable Part 23 requirements that could influence applicability for models on the proposed AML, given the design assumptions for the equipment being installed. Examples include §23.1301, §23.1309, and §23.1353.
More detail on data package requirements is available in Chapter 4.
d. The Model Qualification Process should evaluate each model on the AML to verify the assumptions used during HIRF and lightning compliance, and during the System Safety Assessment, are valid. These items can be installation dependent, so a formal process must be in place to make sure compliance data is applicable to each model proposed for the AML and that common installation and wiring practices are adhered to.
The applicant and the ACO must agree on a process to allow these items to be addressed in a generic manner for the models on the AML, and agree on Continued Airworthiness procedures to maintain compliance for these items.
e. More information on this process may be found in Chapter 5, “Model Qualification Process Requirements.”
4. How is an avionics AML STC amended?
a. Changes that affect the original basic system approval must be addressed as an amendment to the STC itself and may require further showing of compliance. For example, changing the intended function of a box by installing modified software would require an amendment to the STC itself and may also influence what models can be on the AML. Another example would be a change to the way the equipment is installed that could influence system functionality or the certification assumptions made during the original approval.
b. When an AML STC is amended to add a model, the documentation associated with the AML is amended and not the STC itself. The responsible ACO and the applicant must agree on the procedures to amend the AML; however, the following is a list of the basic steps involved.
(1) The applicant proposes a model to be added to the AML.
(2) The applicant subjects the proposed model to the Model Qualification Process.
(3) The applicant modifies installation instructions, and other documents, as needed to accommodate the new model.
(4) The applicant submits a data package and a form 8110-3 documenting the applicability of the STC to the model in question and recommending approval to add the model to the AML. According to Order 8110.37C, form 8110-3 should contain a clarifying note stating, "This approval is for engineering design data only and is not an installation approval.”
(5) The FAA reviews the submittal and amends the AML.
(6) The FAA issues the new AML with the new model added.
c. Changes to or approval of the AML is not delegated to a DER since this would allow new models to be added to the AML (new STC approvals) without FAA oversight.
A Designated Alteration Station (DAS) with authorized privileges may amend an AML for which it holds an STC if the data package and other STC documentation discussed above is submitted for FAA review according to the existing DAS agreement for STC approvals.
d. As mentioned in Order 8110.4B, an AD must be issued to remove a model from an AML. See Chapter 2, Section 5.a.(7).b.
CHAPTER 4. AML DOCUMENTATION REQUIREMENTS
1. What is the required detail in the data package submittal for an AML?
a. The detail contained in a data package submittal for an AML approval is agreed on between the applicant and the responsible ACO at the beginning of the AML approval process. The detail required will be directly related to the complexity and intended function of the installation and the complexity of the models listed on the AML. The data package can be split into a principal design and certification data package for the STC modification and into either a “master” installation package for all eligible typecertificated products, or into separate installation packages for each eligible typecertificated product.
b. According to Order 8110.4B, and 14 CFR, part 21, § 21.101, there are STC procedures in place to reduce unnecessary administrative burdens on the applicant and the FAA. Once an applicant has shown that a design change meets the airworthiness requirements necessary for FAA approval, later similar alterations may not require the same data package detail and may not require the same tests as the first approval. This philosophy is used to allow an applicant to benefit from previous work.
c. A key element of the AML process is a single set of compliance data to be applied potentially to multiple models. The intent is to avoid duplication of testing and data gathering while honoring the agency's primary responsibility to determine the airworthiness of the altered product. The compliance data package must be detailed enough to allow a compliance finding by the responsible ACO. However, it may be used to show compliance for multiple models on the AML if the Model Qualification Process clearly documents similarity between the models. For example, it may be possible to address electrical load analysis issues, hazard analysis issues, and other certification requirements in a generic fashion for the entire AML. The responsible ACO and the applicant must agree on this approach.
d. The FAA may minimize or waive the need for the applicant to provide supporting data for specific AML approval requirements. This is based on prior FAA knowledge gained from the first installation done by an applicant for the first model on the AML.
This depends on the criticality and intended function of a particular component and the similarity or identicality of the installations. This agreement should be documented in the AML STC Certification Plan. However, the intent is not to allow an applicant to use compliance data from another applicant's approval unless written permission is obtained to do so from the original STC holder. As with other STC approvals, the FAA will not supply an applicant with information submitted by a previous applicant.
e. The generic approach to the conformity plan should be well defined in the Certification Plan or Model Qualification Process document and must have FAA concurrence. FAA Order 8110.4B and AC 21-40, application guide for obtaining a STC, provide more details on conformity inspections.
f. The ACO and applicant must agree whether an Aircraft Flight Manual (AFM) supplement is necessary. This will depend on the need for an aircraft limitation
(23.1583) based on the equipment, operational complexity and the compelling nature of the equipment to draw the pilot’s attention. If it is determined that an AFM supplement is necessary, it should include a description of the system, aircraft limitations, emergency procedures, abnormal procedures, and normal procedures, and any changes to the performance of the airplane. The AFM supplement may also refer to the equipment user manuals for more detailed instructions on operating the equipment. For simple systems, a general supplement would be suitable for all approved models. The general supplement is then inserted into the existing flight manual with the cover page completed for make and model, registration number, and serial number. AC 23-8B, Flight Test Guide for Certification of Part 23 Airplanes, chapter 6, section 3, provides added guidance on AFM and approved manual material. If the airplane does not require an AFM, a “Supplemental Flight Manual” or pilot handbook should be developed to provide the same information.
Order 8110.4B paragraphs 4-2.a. (4) (c) and (e) also set limits on expanding AFM model eligibility for an AML STC.
2. What is the required detail in the installation instructions?
a. The installation instructions and the Model Qualification Process are vital parts of the AML process. The installation instructions should be suitable for the intended function of the system. These instructions must describe the installation in adequate detail such that the installation shop can determine if a particular serial number airplane is eligible. Follow-on installations are repeatable, so the installation will meet airworthiness requirements, and a conformity inspection can be performed to equipment lists and drawings, if required. If the system being certified is simple, it may be possible to use one set of generic installation instructions and apply them to all the models on the AML. The generalized installation guidelines could reference standard practices used in the installation, for example aircraft electrical wire selection as specified in Advisory Circular 43-13.
b. For more complex systems, a more detailed set of installation instructions may be necessary. This may include a general section, with model specific appendices to address model specific installation considerations. New model specific sections may also be added to the instructions and approved by the FAA as necessary when each system is “prototyped” or when the system is installed on a new model as an amendment to the AML. The procedures for revising the installation instructions should be part of the AML amendment procedures between the responsible ACO and the applicant and should be clearly documented.
c. In developing the installation instructions, the applicant may consult local avionics repair stations, the ACO, and Aviation Safety Inspectors from the FAA local Flight Standards District Office. Their support may provide insight into what is required for the installation instructions. The resulting AML STC should reduce the potential 16
need of Flight Standards to issue follow-on field approvals for similar equipment installations.
3. What must the installation instructions address?
a. Definition of Intended Function for the System - The intended function of the system must be clearly stated so compatibility can be determined with existing equipment for each model on the AML. Also, the intended function should be the same for all the models on the AML, or it may be necessary to split the AML into different sections.
There has been a trend to install equipment, mainly navigation related equipment such as moving maps, as nonrequired, “Not approved for primary navigation” or “SA-Only.”
The basis for their installation approval has been that they must perform their intended function and not present a hazard to other equipment or the airplane. However, it is not acceptable to label an instrument as “SA-Only” and assume its failure in normal operation is acceptable. A safety assessment conducted by guidelines in AC 23.1309-1C is required to help define the potential safety concerns for a particular installation for the models on the AML.
b. Human Factors Considerations - The FAA recognizes the need to address human factors issues. Human factors considerations must be addressed in the AML Certification Plan. Guidance to aid in this effort and other human factors considerations is contained in the FAA policy statement, PS-ACE100-2001-004. Also, AC 23.1523 addresses pilot workload, which should be considered for all the models on the AML.
c. Wiring Considerations - This includes system schematics and wiring diagrams to describe adequately the connectivity of the equipment, including antennas. For simple installations, it may be acceptable for the applicant to reference specific sections and figures in AC 43-13 to document accepted installation practices, including wire routing and wire separation. For more complex installations, more detailed wiring information may be necessary. For example, specific wiring instructions are required to maintain HIRF and lightning compliance for follow-on installations of critical equipment. If these practices are not followed for a particular installation, the potential for safety hazards may exist. Wire routing and separation considerations must also be addressed according to accepted practices for the certification basis of the model being altered. However, depending on the installation, exact three-dimensional wire routing diagrams may not be value added, even for critical systems. The applicant and ACO must agree early in the approval process on the acceptable means to document wiring installation. Also, only wire specifically designed for airborne use should be installed in the aircraft, such as wire presented in AC 43.13-1B.
d. Structural Considerations - If required, structural substantiation data must be submitted for antenna installations, and box mounting. AC 43-13 is not a satisfactory reference for antenna installations on pressurized airplanes. Also, depending on the certification basis of the airplane (Amendment 23-45 or later), damage tolerance issues must be addressed.
e. STC Assumptions and Limitations - Assumptions and limitations in the supporting data for the original approval of the STC must be clearly stated in the installation instructions. This is because an installation shop can address serial number specific considerations and seek further approval, if needed. For example, a particular serial number may have existing equipment or modifications that would preclude installation of the proposed modification or would require further FAA approval, despite being listed on the AML.
f. Interface to Other Equipment - Data must be provided to document what equipment is approved to interface with the proposed system under the AML STC.
Enough detail must be provided to document interface compatibility and interoperability assurance with other equipment. This should include any approved variations in protocol or data word formats that might influence proper functionality, operational characteristics, or changes to intended function. This may also include a list of equipment that is specifically not approved to interface with the equipment being installed.
g. Electrical Load Analysis and Functional Hazard Assessment. Installation procedures should clearly state that electrical load analysis, functional hazard assessment, and other certification requirements remain in compliance. It is possible to apply a generic approach to the functional hazard assessment if worst-case assumptions are made for a typical installation. For example, the functional hazard assessment is performed during design approval with certain assumptions on system redundancy and back-up systems. The STC must contain details of these assumptions as limits to assure all models on the AML meet the terms of the original design approval assumptions.
h. Pre- and Post-Installation Check Procedures
(1) Provide either pre or post installation ground test or flight check procedures, or both, with clear and concise pass/fail criteria to verify the intended function of the system. Include a post-installation approval for return to service by the responsible party so a maintenance record entry can be made documenting the installation has been performed.
(2) The ground test or flight check procedures, or both, should 1) evaluate operation of the system, 2) determine if the system is interfaced properly with other systems, 3) determine if the system performs its intended function, and 4) determine if there is unacceptable interference with other systems. For example, day/night lighting considerations must be addressed for a particular installation.
(3) AC 23-8B, Flight Test Guide for Certification of Part 23 Airplanes, provides further guidance. Also consider part 91, § 91.407, to determine flight check requirements for post-installation test to verify intended function. In accordance with § 91.407(a) and
(b)An operational flight check should be conducted by the applicant or designee to verify proper system function. Installations intended for Instrument Flight Rules (IFR) may be initially limited to Visual Flight Rules (VFR) until the proper functionality is shown to 18
avoid the requirement for a special airworthiness certificate in experimental category before conducting an operational flight check.
(4) Electromagnetic Interference (EMI) testing may reveal incompatibilities between the installed system and existing systems. For example, there may be potential interference from electric motors or ballasted lighting systems on sensitive navigation and attitude reference system sensors. The applicant should provide model specific checkout procedures for each model on the AML to address possible interference conditions. Laboratory EMI tests performed according to RTCA/DO-160 Section 21 for RF emissions provide confidence that installed equipment will perform without interference to existing aircraft systems. This represents the most efficient way to address the potential for EMI on multiple models. This approach would also account for variations in existing equipment and minimize EMI tests needed on each airplane model.
Procedures for functional ground tests and flight checks should be provided as a final EMI check. Suggested remedies for interference include transfer of equipment, shielding techniques, or external filters. Recurrent EMI issues may warrant changes to the installation instructions that may need to be rolled back into the original AML STC approval.
i. Any other items the responsible ACO considers necessary for a given AML approval
4. What Continued Airworthiness Considerations must be addressed?
The following items should be addressed for each model on the AML to address continued airworthiness considerations:
a. Instructions for Continued Airworthiness (ICA).
(1) An ICA is required as part of the AML STC data package. Part 21, § 21.50(b), states that a holder of an STC must provide at least one set of complete ICA prepared following § 23.1529, including any Airworthiness Limitations.
(2) The ICA provides instructions necessary for authorized personnel to inspect and maintain the added equipment installed by the AML STC under the requirements of 14 CFR, part 43, including procedures to address approved equipment interfaces.
(3) The FAA is responsible under § 21.50 to accept the ICA. The Aircraft Evaluation Group (AEG) will aid the ACO engineer in showing the adequacy of the ICA and determining the acceptability of the ICA.
(4) The ICA must be in a printed form when the first airworthiness certificate is issued, or before delivery of the first product, whichever is later.
(5) FAA Order 8110.4B offers guidance on developing the ICA documents.
(6) The ICA should address maintaining HIRF and lightning protection compliance, including a list of specific wiring, bonding, or strapping requirements that must be maintained for the system.