Assessment results, this will require the proposal to be reviewed and approved by both the Engine Directorate and the Rotorcraft Directorate.
(B)RTCA/DO-178A may still be applicable for those FADECs that were previously developed and approved under DO-178A and the applicant is proposing to make changes to the FADEC software. However, if the applicant proposes to make changes to a DO-178A approved FADEC, the determination on whether the changes should be made under DO-178B or DO-178A will need to be made by the Engine Directorate and Rotorcraft Directorate. When utilizing DO-178A, one might arrive at the conclusion that the engine control, as a required function, is essential; therefore, level 2 software under DO-178A would be appropriate for the control functions. However, for this level 2 category software, errors are presumed to exist and a software error in a full authority control could result in simultaneous unacceptable malfunctions in all engines.
The provisions of § 27.1309(b) for the rotorcraft installations to be designed such that no probable malfunction or failure would result in a hazard to the rotorcraft, and the Part 29 engine isolation rule § 29.903(b) would generally preclude this level 2 classification.
(C) System designs which provide redundant distinctive software or an alternate technology control which is automatically selected and meets all of the minimum regulatory requirements would reduce the impact of software errors and may allow the level 2; i.e., essential, software classification. At level 1, it is accepted that the software is sufficiently error free that the software does not require further verification in the installation evaluation.
(ii) Lightning Strike Protection. Paragraph AC 27.1309b(4) contains a complete discussion of an acceptable method of demonstrating that the FADEC, as installed, is adequately protected against the catastrophic effects of lightning.
(i¡i) Electrical Power System Considerations.
(A) Normal Operation. The system should be evaluated with all power sources operating normally. If additional power source capability is being provided that is above the minimum required for certification, a certain portion of the evaluation should be conducted while operating in the minimum configuration.
(B) Malfunction Conditions. Beginning with the minimum configuration that is required for certification, electrical power system malfunctions should be introduced and the impact on continued FADEC operation determined.
(C) Circuit Protection Location. The circuit protective devices for the FADEC should be located in the cockpit such that they can be readily reset or replaced in flight. The operation of the FADEC system is considered to be essential to safety in flight. Reference § 27.1357(d). The definition for "essential to safety in flight" is given in AC 27.1357b(1)(i).
Page MG 4 - 2
(D) System Separation. On multiengine applications, each system should be separated from the other system to the maximum extent practical. Wiring should be routed separately. Power should be taken from independent busses and grounds, and system components should be independent of one another.
(E) Periodic Checks. Where periodic checks are appropriate, they should be made at reasonable intervals. This would normally range from preflight checks for certain items of greater concern to a tie-in with normal aircraft maintenance intervals for other items. If a crew check is specified, it should be evaluated to ensure it is a reasonable check. If items to be checked are located in an area that can be covered by interior upholstery, for example, a crew check would not be considered reasonable, and further design considerations may be in order.
(iv) Powerplant Installation Considerations.
(A) Paragraph AC 27 MG 3 cites certain Part 29 provisions as being appropriate if engine isolation is claimed for a Part 27 rotorcraft. The guidance which follows, in part, references two Part 29 general engine isolation rules, §§ 29.901(c) and
29.903(b)(2), which should be considered.
(B) A demonstration of compliance with § 29.901(c) would generally include a failure mode and effects analysis (FMEA) of the powerplant systems as installed. When a FADEC is utilized, the analysis would consider the control's failure modes, the installed engine reaction, the affect on the aircraft, and the crew response to the situation. Combinations of undetected failures should be considered. Engine failures which may be escalated in severity by the FADEC's response to the initial failure should be analyzed. Potentially hazardous failures should be evaluated during flight testing. The requirements of § 29.903(b)(2) and § 27.1309(b)(2)(i) should be reviewed in determining acceptability of failures.
(C) Section 29.903(b)(2), Category A engine isolation, is intended to ensure that a failure will not prevent the continued safe operation of the remaining engine(s) or require immediate action of the crew to ensure continued safe operation.
The FADEC's of the individual engines should be independent. Where communication between FADEC's is required (for example, for torque sharing), care should be exercised to ensure that failures which may occur will not result in a power loss to the extent that total power available is less than would be available under OEI conditions.
The no-required immediate-crew-action provision would preclude credit for manually selected or operated backup systems in meeting the § 29.903(b) rule. These unrequired backup systems, which may offer the advantage of get-home multiengine capability rather than forced OEI operation, would be evaluated on a no hazard basis.
(D) Section 27.939, turbine engine operating characteristics, intends a flight investigation to ensure that no adverse characteristics are present to a hazardous degree during normal and emergency operation in the allowed flight envelope. The evaluation should include assessment of the minimum FADEC system certification Page MG 4 - 3
configuration; i.e., the minimum proposed by the applicant to meet Part 27 requirements. Reduced capabilities (e.g., restrictions on normal collective movements, limited aircraft maneuvers, etc.) may be acceptable for degraded FADEC modes or backup systems not required to meet Part 27 requirements if those degraded capabilities are reasonable and not hazardous as determined by flight evaluation. The restrictions should be specified in the flight manual.
(E) The rotorcraft with FADEC engines must of course meet all of the Part 27 requirements, but the areas described herein are those which deserve special attention.
b. SINGLE CHANNEL FULL AUTHORITY DIGITAL ENGINE CONTROLS (FADEC) IN SINGLE ENGINE ROTORCRAFT APPLICATIONS.
(1) Background. The purpose of this appendix is to provide guidance for compliance to Part 27 and Part 29 Category B regulations when the powerplant installation is a single engine fitted with a single channel FADEC system. The application of single channel FADECs in single engine helicopters requires special considerations because this combination can have a higher probability of FADEC-related malfunctions that could result in loss of ability to execute a controlled power-on landing or operate safely throughout the flight envelope, relative to dual channel FADEC systems or multiengine installations. The issues that should be addressed by the applicant are criticality level of failures as determined from the engine system safety analysis (SSA), the resulting integrity requirements, capability to detect and present failure/fault data to the crew, and the ability of the crew to manage any failures/faults. The term "must" in this policy is used in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein is used. This policy establishes an acceptable means, but not the only means of certifying a single channel FADEC for single engine application.
(2) Definitions.
(i) Fault or Failure. An occurrence which affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
(її) Integrity. The term "integrity" for the purpose of this policy includes the hardware reliability requirements as well as the software level requirements commensurate with the system criticality.
(iii) Single Channel FADEC. A single channel FADEC system is one which provides full authority control of the engine from below ground idle to 100 percent power and in some cases from engine start similar to more complex dual channel redundant FADEC systems, but without a fully capable second channel providing a dual redundant system. The backup for the single channel FADEC is Page MG 4 - 4
provided by a less capable channel either by hydromechanical or electronic means, usually for "get-home" purposes rather than for dispatchability.
27.1143, 27.1307, 27.1 FAR paragraphs 27.901, 27.903, 27.927, 27.939, 27.1141,
(4) Related Documents.
(i) Federal Aviation Regulations (FARs) paragraphs 21.21, 27.1301,
33.28, 33.75 (її) FAA Advisory Circular AC 29-2C (¡¡i) Standards - Latest revision of RTCA/DO-178 and RTCA/DO-160;
SAE documents
(iv) ARP4754 and ARP4761
(5) Design Requirements for Compliance with FARs 27.901 and 27.1141 FAR paragraph 27.901(b)(1) requires that each component of the installation be constructed, arranged and installed to ensure its continued safe operation between normal inspections or overhauls. FAR paragraph 27.1141 requires that no single failure or malfunction of the powerplant control system will jeopardize the safe operation of the rotorcraft. For an engine with a single channel FADEC some form of redundancy is needed to ensure the continued safe operation of the rotorcraft in the event of a random complete failure. This redundant system must be accessible and provide the pilot with the ability to perform a controlled power-on landing. In addition, FAR paragraph 27.939(a) requires that turbine engine operating characteristics be investigated in flight. Flight tests are required as noted below to demonstrate compliance with the FAR requirements. The following paragraphs provide guidance for meeting these general design requirements.
(i) Redundancy: Because of the random nature of electrical/electronic component failures, there is no assurance that the electronic system will operate safely between established inspection periods. Therefore, some redundancy technique should be applied to the electrical/electronic part of the FADEC system to reduce the probability of losing the ability to land safely or continue safe flight. This redundancy is usually provided by some form of backup system or alternate method of control of the engine. The requirement for a backup system can be achieved with a number of approaches that include a simple mechanical/hydromechanical system, a simple electrical/electronic system that is not a completely redundant channel, or a completely redundant system.
(•) Availability: A means must be provided either by system design or operational procedures to ensure that the primary and the backup or alternate system are available functionally to serve the intended purpose. The Page MG 4 - 5
АС 27-1B 9/30/99 manufacturer's required interval for testing the backup or alternate system should be based on the expected failure rate established during the failure analysis of the system. However, the pilot should have the capability to test the backup system at the pilot's discretion. Additionally, failure of the primary system must not affect the safe operation of the backup or alternate system.
(iii) Capability of back-up system: Section 27.1143 requires that each power control provide a positive and immediately responsive means of controlling its engine. Additionally, § 27.903 requires that the powerplant systems associated with engine control systems are designed to give reasonable assurance that the engine operating limitations will not be exceeded in service. Although back-up control may be somewhat degraded, the system should allow for control of the engine and the aircraft within their operating limits. It should be demonstrated that upon failure of the primary control the aircraft can continue to be operated safely and execute a controlled power-on landing without creating an undue pilot workload. This includes demonstration of the ability to maintain rotor speed within acceptable limits while transitioning to the backup mode and while using the backup control.
(iv) Ability of crew to switch to back-up: If crew action is required for switching to the back-up mode, this ability must be demonstrated during all phases of flight from any seat which may be occupied by the pilot in command or the copilot.
The process to be used by the pilot to switch to the back-up mode should be clearly described in the Rotorcraft Flight Manual (RFM) as required by FAR paragraph
27.1581.
(V) Transfer to backup: The transfer to the back-up mode from the primary control mode or an intermediate mode (fixed position) should occur without excessive time delay or variation in power. Time delays and power variations experienced during the transfer should be evaluated during flight test for acceptability. A means should be provided to alert the pilot that transfer to the backup mode has occurred.
(vi) Annunciation: Adequate annunciations should be provided to cue the crew of faults/failures and/or transfer of engine controls. These annunciations are of visual and aural types and must be distinct as to purpose and should not be misleading, especially under any fault/failure. Flight evaluation of these annunciations is required before final acceptance can be made.
(vii) Automatic Transfer: If the system is designed to accomplish automatic transfer between control modes, the transfer should occur without excessive variation in power and a means should be provided to alert the pilot that transfer to the back-up mode has occurred. Multiple automatic transfers between control modes may cause aircraft instability. A method to lockout the primary control after its initial failure and automatic transfer to the backup should be Page MG 4 - 6
provided. If pilot reset is to be allowed, the procedure should be described in the
(vill) Calculated failure rate (with unannunciated faults present): Before a calculation of the failure rate can be attempted, the failure should be defined. The determination of failure rate, using the definition of failure, can be the product of a Failure Mode Effects Analysis (FMEA) combined with a reliability analysis, using individual part reliability figures. The figures should come from some recognized data base. The failure rate calculations should consider the worst case application limitations such as flight operation, environmental considerations, and time of operation. The flight operations to be considered for the worst case scenario include all flight segments (take off, cruise, hover, landing, etc.) together and separately for the various missions the aircraft is expected to be used in. Another way to determine failure rate is to use service history. However, service history is applicable only if a high degree of similarity exists for the FADEC and its installed application. The calculated failure rate is the direct result of the FMEA, and should meet the integrity level requirement determined by the Functional Hazard Assessment.
(6) Certification Approach:
Analysis Requirements: Functional Hazard Assessment:
Compliance to the requirements of FAR paragraphs 27.1141 and 27.1309 for a single channel FADEC in a single engine application should be based on criticality of application for the system under consideration. This criticality of application may be determined by performing an aircraft level hazard assessment that starts with the type of possible failures and ends with the results of these failures. The results can be categorized into criticality levels and the required integrity levels can be obtained by matching the required integrity level to the criticality level. The main emphasis should be on determining the higher levels of criticality (Major and above) and their source. This process should include consideration of failures seen at the operational level and interaction of the failures with the airframe and crew as well as the system itself. The following subject areas are related to this assessment.
(A) Assumptions: Assumptions should be made about the airframe/crew interface in order to perform the aircraft level hazard assessment.
These assumptions are prerequisites to perform an aircraft level hazard assessment and must be listed in this hazard assessment and validated by airframe testing when the airframe is available. If the assumptions cannot be validated, the actual airframe test data must be substituted for the invalidated assumptions (assumed prerequisites) and the hazard assessment re-evaluated with the new data supported prerequisites. The results of this new assessment would be the deciding factor for acceptance of the FADEC system for the installation as designed or provide the necessity for design changes.
Page MG 4 - 7
(B) Criteria: Acceptance of an engine fitted with a single channel FADEC system in a single engine rotorcraft application requires that the integrity levels of the FADEC system be compliant with the criticality levels determined by the aircraft level Functional Hazard Assessment (FHA). In addition, final acceptance of the system at the aircraft level for the application is based on the integrity level(s) that match the criticality level(s) determined by the hazard assessment that uses data that has been validated during the aircraft flight test program. These assumptions/prerequisites would include operational aspects associated with the possible FADEC failures and would include as a minimum the following:
(1) Crew/aerodynamic response to failure.
(2) Worst case flight operation for failure to occur. (Landing, IFR, etc.)
(3) Duration of flight operation (exposure time).
(4) System interaction with shared Inputs/Outputs with other systems and/or with back-up systems.
(5) Adequate annunciation of failure.
(ii) Validation Criteria:
(A) General:
(1) Validation of the assumptions/prerequisites made by the engine manufacturer in developing the SSA, using aircraft level FHA requirements, must be validated by conducting flight testing during the certification of the installation. The possibility exists that if the assumptions cannot be validated during flight testing, then engine and/or FADEC redesign may be required.
(2) Failure management methods that are related to operational characteristics should be addressed. It should be determined that the FADEC/engine manufacturer's envisioned failure management is desirable and compatible with the operational requirements. Therefore, the following basic FADEC related information should be identified:
(i) The detected failures.
(i) The failures that are not detected.
(iI) The action that the FADEC takes when failures are detected.
(iv) The failures that are annunciated to the crew and in what manner.
Page MG 4 - 8
9/30/99/ AC 27-1B (V) The anticipated operational action required as a result of detected failures.
(vi) Possible operational results of the undetected failures.
(vii) Verification that the assumed worst case flight operation is the worst case.
(B) Manual Backup: Additional aircraft operational testing is required to specifically evaluate the manual backup system for compliance with the FAR requirements. The acceptability of the manual backup system depends substantially on its installation and interface with the airframe. The following items need to be demonstrated in accordance with § 27.927 and §27.939 or accomplished on each application prior to the acceptance of the manual backup system:
(1) It should be demonstrated by flight test with the failure of the primary engine control, that the aircraft can be flown and a safe and controlled power-on landing executed without creating an undue pilot workload.
(2) It should be demonstrated by flight test that switching between control modes will not create an unsafe condition during any phase of operation within the aircraft operating envelope.
(3) The pilot action required as a result of a failure of the primary control and used as an assumption in the FHA and FMEA should be validated during flight tests and listed in the emergency procedures section of the flight manual.
c. FADEC RELIABILITY REVIEW DUE TO INCREASED ROTORCRAFT
ENDURANCE
(1) Background. This advisory material is to provide guidance for reevaluation of the FADEC control system reliability due to extension of the aircraft mission endurance. During the initial type certification of an aircraft, an analysis is normally conducted on systems to determine their criticality category (e.g.
catastrophic, hazardous, major, etc.) and reliability requirements. To establish a system's reliability, an exposure time is determined by making certain assumptions.
In most cases, the exposure time is the average endurance based on the various flight scenarios in which the aircraft is to be used. When an aircraft's expected mission endurance is increased by adding fuel capacity, a new analysis for system reliability should be conducted taking into account the new increased mission endurance.
(2) Requirements.
Page MG 4 - 9
AC 27-1B, Chg 2 4/25/06 If the applicant has access to the initial analysis used for the type certification, one method to accomplish the new reliability analysis is by multiplying the exposure time used in the original reliability analysis by the ratio of the increased maximum endurance to the original maximum endurance. That is, if the aircraft endurance increases by 50 percent due to additional fuel capacity, the assumed exposure time should also increase by 50 percent. The applicant should then rework the analysis using this new exposure time.
(II) If the applicant does not have access to the initial analysis it will be incumbent upon them to provide the rationale used for determining the new exposure time and to provide a complete analysis for the systems determined to be critical.
The FAA engineer should compare this new analysis to the original.
d. CERTIFICATION GUIDELINES FOR COMPLIANCE TO THE
REQUIREMENTS FOR ELECTROMAGNETIC COMPATIBILITY (EMC) TESTING FOR
NON-QUALIFIED EQUIPMENT AND EQUIPMENT KNOWN TO HAVE A HIGH
POTENTIAL FOR INTERFERENCE WHEN INSTALLED ON ROTORCRAFT WITH ELECTRONIC CONTROLS THAT PROVIDE CRITICAL FUNCTIONS.
(1) Background.
(i) Rotorcraft operations are varied and use a wide assortment of equipment. While some of this equipment is qualified to aircraft standards, particularly environmental standards, some of the equipment not qualified to such standards may be the source of harmful electromagnetic interference. Rotorcraft typically have not had electronic controls that perform critical functions, such as engine controls and flight controls; therefore, there was no real concern about requiring equipment to be qualified to aircraft standards. Typically, this equipment was installed with only a cross-matrix operational check for EMC. These tests consisted of operating the equipment in question and checking visually for an indication of interference. The equipment was, for the most part, non-required equipment and the primary concern was that interference might be emitted from the equipment.
(ii) Unqualified equipment and their effects on critical systems is of particular concern due to the recent increase in the number of rotorcraft with electronic engine controls and the implementation of fly-by-wire technology. Additionally, the physical close proximity of installed equipment to electronic controls that provide critical functions is inherent due to the smaller size of most rotorcraft and represents a greater potential for interference than for larger fixed wing aircraft.
(2) Requirements.
(i) The rules to assure that required functions are not subject to interference are provided in the certification basis for the rotorcraft. Although the certification basis may differ between aircraft, the requirements that address electromagnetic interference Page MG 4 - 10
are similar and result in the same methods for compliance. A note has been added to the type certificate data sheets for rotorcraft that employ FADECs. This note was added to remind all modifiers that the requirement for addressing interference exists and that special EMI test considerations must be addressed to show compliance. Most EMC considerations can be addressed by the operational interference checks addressed in the background discussion. However, when a critical control function is provided by some electronic means, special EMI test considerations must also be addressed, in addition to the previously described EMC tests. The determination of when these other, more rigorous tests are required is a simple concept, but complex in practice. More rigorous testing is required to satisfy the concern for the installation of equipment that would interfere with the critical control (e.g., FADEC, Fly-By-Wire, etc.) or failure management of the critical control. This class of equipment is "equipment known to have a potential for interference," which may or may not be qualified to an aircraft standard, such as high frequency (HF) radios, high powered radars, hoists, transmitting antennas located near the controls systems, etc. The concern associated with this class of equipment is the possible interference with the critical electronic controls.
Accomplishment. In addition to the following special testing considerations addressed in paragraph (2)(iii), "EMI Installation Testing for Critical Controls" and "Installation Test Conditions," all installed equipment should undergo a cross-matrix operational check for EMC considerations by operating all equipment under consideration and determining if an interference hazard is created.
(A) Class of Equipment - Equipment Known to Have a High Potential for Interference: This class of equipment should be tested in the installation as described in the "EMI Installation Testing for Critical Controls/Installation Test Conditions," paragraph (2)(iii). Since the concern of this class of equipment is its high potential for interference, its EMI laboratory qualification does not preclude the EMI installation testing.
Equipment that meets any one of the following criteria is considered to be "equipment known to have a high potential for interferencei
• Equipment that requires 25 amps or more to operate,
• Equipment that transmits 30 watts or more,
• Equipment with an antenna located 0.5 meters or less from the FADEC, or
• High Frequency (HF) Transmitters of any power.
The types of equipment in this class include HF radios, high-powered radars, hoists, high-powered radios, installations where radio transmission antennas are in close proximity to the controls, and equipment that require large currents to operate or radiate strong electromagnetic fields. Examples of this type of equipment are some Emergency Page MG 4 - 11
AC 27-1B, Chg 2 4/25/06 Medical Service (EMS) equipment, night sun lights, some air conditioners, video and sound systems that require large currents (25 amps - up) to operate, Forward Looking Infrared System (FLIRS), some forward looking radars, some weather radars, some communication systems that transmit 30 watts or more, some data link transmission systems, etc.
NOTE: Equipment that does not meet this criteria is considered to be "equipment not known to have a high potential for interference."
(B) Class of Equipment - Equipment Not Known to Have a High Potential for Interference: Once it has been established that the equipment being proposed to be installed is not in the class of "equipment known to have a high potential for interference," per the criteria stated in paragraph (2)(ii)(A), there is no requirement to conduct the EMI installation tests described in the "EMI Installation Testing for Critical Controls/Installation Test Conditions paragraph (2)(iii). However, the cross-matrix operational checks for EMC considerations described in paragraph (2)(ii) are still required.
EMI Installation Testing for Critical Controls:
EMI installation testing is no longer required for unqualified equipment that does not have a high potential to cause interference. However, EMI installation testing is the only method of testing to show compliance for interference considerations, for the class of "equipment known to have a high potential for interference." The criteria for determining whether the "equipment is known to have a high potential for interference is stated in paragraph (2)(ii)(A).
(B) To accomplish the EMI installation tests, there must be an FAA- approved test plan that requires the high interference potential equipment to be operated through all reasonable modes of operation, in order to determine if electromagnetic interference is entering the electronic control system. EMI installation testing consists of interrogating the control, if it has such a feature, to determine if the critical electronic control system is adversely affected (identify the recorded faults that occur during the test). Additionally, real-time monitoring of the control's input/output parameters should be accomplished. The pass/fail criteria is "no detected interference" for a pass state, and conversely a fail state if any interference is detected entering the control. If interference is detected, the source of interference should be investigated to determine if the detected interference is the worst case. In some cases, the detection of interference may result in flight tests being required to determine if the interference is worse in flight. After the worst case interference is defined, the interference must be eliminated at the source, or the interference must be evaluated to assure that the critical electronic controls, its functions, and its related indications do not result in an unsafe condition. For FADECs, special test equipment developed by the engine manufacturer will be required to interrogate and monitor the controls input/output parameters. Other types critical controls may also require special test equipment to perform this type of testing.
Page MG 4 - 12
(C) Installation Test Conditions: "Equipment Known to Have a High Potential for Interference" represents the main concern for radiated and conductive interference; therefore, ground and flight tests are usually required. Therefore, when the EMI installation tests described in paragraph (2)(iii) are required, ground and flight tests will usually need to be conducted. Ground tests alone are usually not sufficient since some equipment may pose safety issues if operated on the ground, while other equipment cannot be satisfactorily operated on the ground, or the equipment would provide misleading results if operated on the ground. For example, some equipment is prohibited from being operated on the ground, such as hoists.
(D) If the proposed installed equipment has been tested in relation to the critical electronic control system on another identical installation, then there can be an exception to the EMI installation testing requirements defined in paragraph (2) (iii). The data showing identicality of the equipment and installation with passing test data are acceptable in place of further testing on the same type rotorcraft.
(3) Summary. The concern for potential interference to electronic controls that provide critical functions may be addressed by the methods contained within this document. To address the interference aspects of "equipment known to have a high potential for interference," the equipment must be tested as a part of the installation as described in paragraph (2)(iii), during ground and flight tests.
Page MG 4 - 13