Gaseous refrigerant under Compressor increasing pressure Gaseous refrigerant Evaporator Coil Condenser Cooled Receive Expansion Liquid refrigerant
REFRIGERATION CYCLE Figure AC 27.MG 14-1 Page MG 14 - 7
AC 27-1B, Chg 1 2/12/03
INTENTIONALLY LEFT BLANK Page MG 14 - 8
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 15. AIRWORTHINESS APPROVAL OF ROTORCRAFT HEALTH USAGE
MONITORING SYSTEMS (HUMS)
a. Purpose. The purpose of this section of the AC (AC 27 MG 15) is to provide guidance to achieve airworthiness approval for rotorcraft Health and Usage Monitoring System (HUMS) installation, credit validation, and Instructions for Continued Airworthiness (ICA) for the full range of HUMS applications. Mandatory terms used in this section of the AC, such as "must", are terms used only in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein are used. This section of the AC does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. This section of the AC establishes an acceptable means, but not the only means of certifying a rotorcraft HUMS. AC 27 MG 15 addresses the most complex/extensive HUMS; systems of lesser complexity may be addressed by use of only the parts of this section of the AC that are pertinent. HUMS applications in the Catastrophic criticality category are not addressed herein.
b. References and Related Documents.
(1) Federal Aviation Regulations (FAR) Parts 21, 27, 33, 91, 125, 127, 129, 133, 135, 145 - Corresponding European Joint Aviation Requirements (JAR) 21, 27, JAR E, JAR-OPS 3.
(2) FAA Advisory Circular AC 27-1B and the European corresponding ACJs, AMJs where applicable.
(3) Standards - Latest revision of RTCA/DO-160/ED-14, RTCA/DO-178/ED-12, SAE documents ARP 4754, and ARP 4761.
c. Background.
(1) Various types of HUMS have been developed, and they are likely to be used more in the future. Initially, these systems were installed to show the feasibility of gathering meaningful data to modify required maintenance and/or operational actions.
The degree of qualification required for this type of installation is relatively low.
However, there is an increasing number of certification applications to install HUMS and use its data to intervene in maintenance and/or operations of the rotorcraft. This type of Page MG 15 - 1
AC 27-1B, Chg 1 2/12/03 installation requires a higher degree of qualification, commensurate to the criticality of the most severe effect of the intervention action(s) on the rotorcraft.
(2) HUMS typically consists of a variety of onboard sensors and data acquisition systems. The acquired data may be processed onboard the rotorcraft or on a ground station (or a combination of both) providing the means to measure against defined criteria and generate instructions for the maintenance staff and/or flight crew for intervention.
(3) The certification of HUMS must address the complete process, from the source of data to the intervention action. There are three basic aspects for certification of HUMS applications: installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other.
d. Definitions.
(1) END-TO-END: The term "end-to-end" as used in the text is intended to address the boundaries of the Health Usage Monitoring System (HUMS) application and the effect on the rotorcraft. As the term implies, the boundaries are the starting point that corresponds with the airborne data acquisition to the result that is meaningful in relation to the defined credit without further significant processing. In the case where credit is sought, the result must arise from the controlled HUMS process containing the three basic requirements for certification as follows:
(i) Equipment installation/qualification (both airborne and ground),
(ii) Credit validation activities, and
(ili) Instructions for Continued Airworthiness (ICA) activities.
(2) HUMS: Equipment, techniques, and/or procedures by which selected incipient failure or degradation and/or selected aspects of service history can be determined.
Health Monitoring System: Equipment, techniques, and/or procedures by which selected incipient failure or degradation can be determined.
(ii) Usage Monitoring System: Equipment, techniques, and/or procedures by which selected aspects of service history can be determined.
(3) Credit: To give approval to a HUMS application that adds to, replaces, or intervenes in industry accepted maintenance practices or flight operations.
Page MG 15 - 2
(4) Application(s): A HUMS process implemented for a distinct purpose(s).
(5) Criticality (1309): This term describes the severity of the end result of a HUMS application failure/malfunction. Criticality is determined by an assessment that considers the safety effect that the HUMS application can have on the aircraft. There are five criticality categories as tollows:
(i) Catastrophic: Failure conditions, which would prevent continued safe flight and landing.
(її) Hazardous/Severe Major: Failure conditions, which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:
(A) A large reduction in safety margins or functional capabilities, (B) Physical distress or higher workload such that the flight crew could not be relied on to perform their tasks accurately or completely, or (C) Adverse effects on occupants including serious or potentially fatal injuries to a small number of those occupants.
(i¡i) Major: Failure conditions which would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or discomfort to occupants, possibly including injuries.
(iv) Minor: Failure conditions which would not significantly reduce aircraft safety, and which would involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload such as routine flight plan changes, or some inconvenience to occupants.
(v) No-Effect (Non-hazardous class): Failure conditions which do not affect the operational capability or safety of the aircraft, or the crew workload.
(6) Integrity: Attribute of a system or a component that can be relied upon to function as required by the criticality determined by the Functional Hazard Assessment (FHA).
(7) Mitigating Action: An autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS application. This action becomes a part of the certification requirements and, as such, Page MG 15 - 3
AC 27-1B, Chg 1 2/12/03 is required to be performed as long as that certification requirement is not changed by a subsequent re-certification. An example of a mitigating action is a pilot's comparison of airborne HUMS data with aircraft instrument data.
(8) Commercial Off-the-Shelf (COTS): This term defines equipment hardware and software that is not qualified to aircraft standards. An example of COTS equipment hardware and software is a personal computer (PC) and its operational software.
(9) Independent Verification Means: An independent process to verify the correct functionality of a HUMS application on a ground station that utilizes COTS. The intent of independent verification is to gain some degree of confidence in the COTS operational reliability.
NOTE: This process may be discontinued when sufficient confidence in the application has been achieved.
(10) Synthesis: The process of evaluating service history and any other relevant data with the objective of validating and, if necessary, refining the performance of an approved credit.
e. Certification Approach.
(1) There are three basic aspects to Health Usage Monitoring Systems (HUMS) certification. Certification of HUMS must address all three. The three aspects are installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other. A method to address these aspects is provided by the approach herein. Installation includes all the equipment needed for the end-to-end application that is associated with acquiring, storing, processing, and displaying the HUMS application data, including airborne and ground based equipment. Credit validation includes evidence of effectiveness for the developed algorithms, acceptance limits, trend setting data, tests, etc., and the demonstration methods employed. A plan is needed to ensure continued airworthiness of those parts that could change with time or usage and includes the methods used to ensure continued airworthiness.
(2) The certification process should begin with the declared application intent, and determination of the resultant criticality. This declared intent should consider whether this application is for credit, that it adds to, replaces, or intervenes in maintenance practices or flight operations. When the declared intent is for credit, the end-to-end criticality for such an application should be determined and used as an input to establish the integrity criteria. If the declared intent is for non-credit, it may be certified as long as it can be shown that the installation of the equipment will not result in a hazard to the aircraft.
(3) The end-to-end criticality can be determined by performing a Functional Hazard Assessment (FHA). The integrity level is required to be equivalent to the Page MG 15 - 4
determined end-to-end criticality. Compliance with the criticality level established by the FHA must be demonstrated. This may be achieved by a combination of application qualification plus appropriate mitigating actions.
(4) Applications are often qualified to a low level of integrity due to the assessment of criticality; however, it may be desirable to transition to a higher qualification level for future uses. Transition from one level of integrity to another will require re-evaluation.
NOTE: A certification plan may be provided to assist in the certification process. At a minimum, this plan should address the proposed means of compliance to each applicable paragraph of this advisory circular for a given application. Early submittal of this plan to the regulatory Authority is recommended.
f. Installation. Installation approval must cover systems and equipment that acquire, store, process, and display HUMS data and includes the airframe installation, or any one of these functions for a particular application. AC 27 MG 15 will address the most complex/extensive HUMS; systems of less complexity may be covered by use of only the parts of this AC that are pertinent. Different systems exhibit varying capabilities and configurations. Additionally, there may be different functional distributions between airborne and ground based equipment. HUMS equipment requirements consist of common requirements plus the unique requirements of airborne and ground based equipment.
(1) Common Requirements. A common requirement is one that applies to airborne, ground based, and installation equipment. These common requirements are discussed below.
Criticality Determination.
(A) Criticality determination is a primary decision point relating to the depth of requirements for certification. The intended application can range from systems that acquire data for proof of concept only, to a system that acquires and processes data to determine if a life-limited part should be replaced. This range of applications will have a corresponding range of criticality for the systems from No Effect to Hazardous/Severe-Major. Systems in the Catastrophic criticality category are not addressed in AC 27 MG 15.
(B) If any credit is to be gained, the general guidelines for determination of criticality levels will be either Minor, Major, or Hazardous/Severe-Major. They will be in agreement with the resulting effect of the end-to-end criticality assessment.
(C) Typical examples of applications which may be classified as Catastrophic are as tollows :
Page MG 15 - 5
AC 27-1B, Chg 1 2/12/03
(1) Applications providing cockpit warning(s) which are the only means of detection with associated flight manual instructions to land immediately.
(2) System applications, for which constantly misleading information could be assessed as leading to a Catastrophic condition, must be designed to either detect these errors (e.g. Built-In-Test, system redundancy, etc.) and/or be tolerant to these errors (i.e., procedural, etc.).
(D) The Functional Hazard Assessment (FHA) may be a preliminary document to the Preliminary Safety Assessment (PSA) or a part of the PSA. The FHA is a top down analysis (which should involve pilots and flight analysts as well as engineers) that starts with the hazards to the rotorcraft and traces these hazards to the system, subsystem, and component level in the areas affected by HUMS. This type of analysis starts with the determination of what undesirable effects can occur as a direct or indirect result of using HUMS for maintenance or operational actions. The level of severity associated with this effect will result in assigning a criticality level that uses the definitions of criticality contained herein.
(E) The final level of equipment qualification may not only be the result of technical considerations, but also of other mitigating actions, of which there are many types. Many of these actions can result in a reduction of qualification levels for equipment.
(її) Mitigating Actions.
(A) A mitigating action is an autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS application. These actions are often performed as part of continued airworthiness considerations and are also an integral part of the certification. As such, the continuation of certification limitations, where appropriate, must be included in the Instructions for Continued Airworthiness (ICA). Mitigating actions are subjective in nature and are an intended method(s) of application where the pre-mitigated levels of integrity are defined.
(B) Applications that use COTS software and therefore may not be fully qualified applying RTCA/DO-178/ED-12 methodology may be accepted by alternative qualification methods as stated in paragraph f(3). Therefore, the subsequent use of mitigating actions that are of themselves of a subjective nature should be approached with caution. A mitigating action must be based upon the integrity level derived from the FHA.
(C) If the mitigating action is an operational consideration, the same concerns apply for continuing the mitigating action. The mitigating action should be recorded in the certification limitations and in the approved flight manual.
Page MG 15 - 6
(iii) Performance. There must be minimum end-to-end performance criteria consistent with the application's intended use. Performance criteria, as a minimum, should consider accuracy, timing/sampling, resolution, event recognition, and consistency. The HUMS signal source must be compatible with the determined qualification level. Tests should be conducted to demonstrate that these criteria are met.
(2) Airborne Equipment Installation. Airborne equipment and the associated installation qualification procedures are the same as for any other airborne equipment.
The installation qualification and the equipment qualification may be considered two separate activities although there is an obvious relationship between them. Signal independence, irrespective of method of implementation, should exist to the extent that acquisition of HUMS signals should not compromise the level of safety or reliability of functions provided by other equipment as a result of signal sharing.
(i) Equipment Installation. Equipment not approved by other methods must be approved as part of the installation and must consider overall system requirements.
(A) Equipment Qualified as Part of Installation. Equipment qualified all or in part as a part of the installation includes minor and major parts. Examples of minor parts are: connectors, common usage relays, diodes, etc. Examples of major parts are non-prequalified equipment (equipment not TSO'd or not qualified under the TSO to the required level for installation approval), consisting of significant system components and as transducers with their interfaces. Equipment qualification must consider environmental qualification (RTCA/DO-160/ED 14) including high intensity radiated fields (HIRF) and lightning.
(B) Software. RTCA/DO-178/ED-12 should be used for the software development standard. (See following figure for typical airborne application process for software not containing COTS.)
Page MG 15 - 7
AC 27-1B, Chg 1 2/12/03
HUMS APPLICATION FOR SOFTWARE WITHOUT COTS Criticality Category Determination through a Functional Hazard Assessment (FHA) 1309 Integrity Requirements Software - NO178R I aval Mitigating YES Mitigating Action? Action NO Final HUMS Mitigated Application DO178B Software DO178B Level (Reduced) Softwaro FIGURE AC 27 MG 15-1: Flow chart for use of Mitigating Actions applied for reduction of Software Level.
Installation Specific Considerations. The overall installation considerations should include, as a minimum, supply of electrical power, environmental conditions, system non-interference, and human factors if operations are affected.
(A) Supply of Electrical Power. An adequate source of electrical power for HUMS must be provided. The reliability of the power source must be commensurate with the required equipment qualification level. There should be no unacceptable reduction in the level of safety or reliability for other equipment as a result of acquiring power for HUMS.
(B) Electromagnetic Compatibility. Electromagnetic compatibility (EMC) must be addressed. Complex systems may require an EMC test plan, which includes a matrix of aggressors versus victims. The end result should be to assure that HUMS does not interfere with or is not affected by any other installed equipment.
Page MG 15 - 8
(3) Ground Based Equipment Installation.
Ground based equipment is typically used to process and display the data collected by airborne means. This processed data will ultimately be used to make decisions pertaining to some intervention action or provide data to other processing means to make the intervention action determination. Since the ground based equipment may be an important part of the process for determination of intervention actions, its integrity and accuracy requirements must be the same as any other part of the HUMS process.
(її) The determination of compliance to the integrity requirements for ground based equipment is difficult when it is recognized that this equipment may, for the most part, be commercial and not necessarily designed specifically for the HUMS application. This section is intended to allow for the possibility of systems that contain COTS hardware and software, where the hardware is likely to be a personal computer and the operational software is COTS. The determination of compliance to the integrity requirements for COTS is based on equivalence, which is subjective. COTS service history alone will not be sufficient to comply with the requirements herein. Any ground based processing equipment that consists of commercial hardware and software must have satisfactory service history and an independent means of verifying the results of the processing. This independent verification means may be discontinued with the certifying Authority's agreement to modify the original HUMS approval and remove this requirement after significant quantities of the processed data consistently agree with the verifying means.
NOTE: The suggested processes contained in this document for acceptance of a ground based system that possibly includes COTS hardware and software is limited to ground based equipment for HUMS applications only. The integrity determination methods for systems that do not contain COTS is the same as described for the airborne systems.
(A) Independent Verification Means. The required independent verification means may consist of any one of many methods. Independent verification means may parallel only the ground based system processing or parallel all or any portion of the process that includes the COTS equipment processing. Some acceptable methods may include the following:
(1) Physical inspection(s).
(2) Redundant processing by a second dissimilar PC with different COTS trom the primary processor.
(3) A combination of physical inspection(s) and independent dissimilar processing.
Page MG 15 - 9
AC 27-1B, Chg 1 2/12/03
(4) Satisfactory comparison of processed directed action to actual maintenance performed as a result of inspection. This approach would require data collection on the system prior to actual credit application. The amount and duration of data collection should be agreed between the applicant and the certifying authority at the beginning of the project on a case-by-case basis.
(5) Any other independent means of verifying the accuracy/integrity of the equipment including software by a satisfactory comparison to the directed action of the HUMS processed data.
(B) Integrity Level Considerations. The methodology is the same for different integrity level requirements as they relate to COTS hardware/software, but the compliance requirement will vary. The processes described in the previous and subsequent paragraphs of f(3) should be applied to meet the initial integrity requirements for the criticality categories of Hazardous/Severe Major and Major. Minor criticality category level will also require qualification by this process, except that independent verification can be performed after certification, provided that an approved plan is submitted for this activity. Other applications that do not employ COTS will use standard engineering practices to satisfy the integrity level considerations.
Modification of Approved Systems. Changes to the equipment including software should be qualified on a case-by-case basis that is dependent on the effect on the integrity and functionality of the system. If mitigation had been successfully demonstrated for the original configuration, the mitigation must be shown to provide the same level of integrity for the changed configuration.
(C) Ground Based Equipment Hardware. This hardware may consist of data processing, display, and possibly printing equipment or other accessories. The hardware must be compatible with the intended application and software. The independent means of verification activity is required due to the use of COTS hardware.
(D) Software. Most systems will employ two types of software. One type is the operational software and the other is the HUMS specific software. The operational software may be COTS. (See following figure for typical ground based application process for HUMS specific software using COTS as an operational software.)
Page MG 15 - 10