HUMS GROUND APPLICATION FOR SOFTWARE WITH COTS Criticality Category Determination through a Functional Hazard Assessment (FHA) 1309 Integrity Requirements Software - DO178B Level Determination Independent Verification Means Final HUMS Ground Ground COTS DO178B Software Level Application DO178B Software for HUMS Application (If applicable) Ground COTS Hardware Independent COMPARE Verification Means HUMS Results HUMS Results Data Out-Put Data Out-Put FIGURE AC 27 MG 15-2: Flow chart for application of HUMS specific software with a ground base that uses COTS software for operational software.
(1) COTS. This type of software can only be accepted by subjective considerations, such as service history, independent verification means, and design of the system to limit access to the operational COTS software to make changes. The independent means of verification activity is required due to the use of COTS software.
(2) HUMS Specific Software. This software should be developed to the integrity level required by the system criticality assessment using RTCA/DO-178 as the Page MG 15 - 11
AC 27-1B, Chg 1 2/12/03 standard. This system determined level should be a result of the end-to-end criticality assessment and, in general, the same as the airborne software. Use of mitigating actions is dependent on constraints stated in paragraph f(1)(ii).
(E) Data Processing. Data processing equipment and software should have the capacity to process the amount of data required. It should not introduce errors or provide out of specification accuracy for any parameter. The speed of processing should not be limited, by the hardware or software, to an unacceptable rate. The acceptability of speed will depend on the amount of data to be processed and the specified performance for HUMS data processing. The speed should be reasonable to accomplish data processing in a reasonable time for the particular HUMS application.
Hazardous/Severe Major or Major criticality applications that contain COTS should be part of a dedicated system or demonstrate adequate protection for the higher level processing from anything else processed on the same equipment. Subject to a favorable comparison to the required independent verification means, Minor criticality applications need not be part of a dedicated system.
(F) Display and Peripheral Equipment. The display, for most cases, may be a part of the processing equipment or closely interface with it. It must be compatible with other parts of the system and provide a clear usable presentation.
(G) Data Communications. Network applications, modem interfaces, and other system sharing and transmission features may be utilized for integrity levels associated with Major and Minor criticality categories, provided that the independent verification means covers the use of these features. Integrity levels associated with Hazardous/Severe Major criticality categories may utilize these features only if sufficient protection can be shown to assure that this level of integrity is maintained throughout any foreseeable failure/malfunction or mistake in any associated application, in addition to required independent verification means.
g. Credit Validation. HUMS applications for which credits are sought must be validated. For each application, evidence shall be provided that the physics involved is understood and therefore that the monitoring technique/algorithm/parameter, rejection criteria, and associated intervention actions are well chosen. The designer of the component/equipment to be monitored is the most logical choice for this determination.
However, in some cases the source can be from any organization as long as the validation criteria herein can be satisfied. If changes are proposed to an approved system, re-evaluation is required to ensure existing credit(s) are not invalidated. The degree of effort will vary and depend on the application type, the credit sought, and the consequences of failure or any other malfunction. The validation process would generally need to include the following:
• Description of application and associated credit.
• Understanding of the physics involved.
• Validation methodology.
• Introduction to service.
Page MG 15 - 12
• Continued airworthiness (synthesis).
NOTE: Early notification to the regulatory Authority of the credit type and the proposed method for validation is recommended.
(1) Description of Application and Associated Credit.
There are many types of HUMS credits with different levels of criticality. Some may be the introduction of new maintenance practices, in place of the established maintenance practices, and others may be the introduction of additional safeguards for safety where all standard practices are retained.
(ii) It is important to fully evaluate and describe the proposed credit and the worst effect on the rotorcraft should the application fail or malfunction. This evaluation is needed to determine the system criticality, the system installation integrity requirements, and the depth and scope of the credit validation effort.
(2) Understanding the Physics Involved.
The mechanisms of failure and/or degradations associated with the requested credit should be understood. This includes how a failure occurs and/or at what rate the degradation progresses and a determination of the point where intervention action is necessary. For some complex applications, this may include supporting information from validated analytical tools such as finite element analysis and fracture mechanics.
(ї¡) These understandings should be used to determine the four important characteristics of a HUMS application.
(A) The technique to be used.
(B) The appropriate alert limits, including trending where appropriate.
(C) The appropriate intervention action.
(D) How often to monitor to give optimum opportunity for the intervention action to be effective.
(III) This should also recognize the different characteristics of the failure/degradation and determine when trending or a step function is most appropriate.
(3) Validation Methodology. All HUMS applications should have their validation process based on suitably representative physical data. This process may use direct or indirect evidence, or a combination of the two, depending upon the credit type and the criticality on the aircraft of any HUMS failure or malfunction.
Page MG 15 - 13
AC 27-1B, Chg 1 2/12/03
(i) Direct Evidence.
(A) When the HUMS application is classified as Hazardous/Severe Major, then direct evidence must be gathered. Examples of where this might be the most appropriate method include maintenance tasks such as vibration checks for imbalance/misalignment of high energy rotating equipment, fatigue life counting, or going "on-condition" for flight critical assemblies.
(B) Direct evidence is required for establishing that the HUMS application is sensitive to and obeys predicted response rules for the damage type, giving consistent alerts. This evidence may be gathered from several sources as follows:
(1) Actual service experience on HUMS equipped aircraft,
(2) "Seeded tests" (where the wear, defect, or deterioration is introduced, allowed to develop, and the technique response verified), and
(3) On- aircraft trials, investigating cause and effect (for example, introducing degrees of imbalance and calibrating the techniques response).
(C) Tests should be representative of the aircraft for which the credit is being sought and of test conditions representing the flight regime that would prevail when data is normally gathered (e.g., cruise). It should be established that the evidence gathered from on-aircraft ground trials or rig based seeded tests is valid in flight.
(її) Indirect Evidence (A) When the HUMS application is classified as "Major" or lower, indirect evidence may be gathered. Criteria for this approach includes a criticality determination of Major or lower and either or both; application to "on-condition" maintenance actions, and/or lowering the probability of undetected failures. Monitoring of a high number of potential failure modes can collectively determine the probability of undetected failures.
Here, it may not be practicable to generate direct evidence for each failure.
(B) Proven analytical methods may be combined with sound engineering judgment to provide calculated/derived criteria; tests can be performed to validate these criteria. Model based analytical methods for predicting damage progression (e.g., finite element analysis and fracture mechanics) may allow for a validation by claiming analogy with 'direct' evidence generated for other aircraft types or equipment. However, to more fully validate this analogous data set, a degree of direct evidence for the actual equipment being monitored is still likely to be necessary to prove similarity of application. This might be achieved by performing an appropriate number of seeded defect tests and, in effect, "sampling" the range of failure types contained.
NOTE: For both direct and indirect evidence, the whole system must be validated endto-end.
Page MG 15 - 14
(4) Controlled Introduction to Service.
(i> For some credit applications, full validation and implementation may be possible during the development period. However, for many HUMS techniques, a plan for a controlled introduction to service may be necessary to fully validate the credit.
(i) There must be provisions in the certification process to instruct the continued airworthiness effort to ensure compliance with the aforementioned plan.
(iii) During the implementation of this plan, data is accumulated by operational aircraft, and from this data, refinements and adjustments to the original criteria can be made. This period may also allow a proposed credit to be operated in parallel with alternative or standard procedures when it is necessary to gain additional in-service validation by way of back-to-back comparison
(iv) The plan should include procedures and provisions for this controlled period and should include clear goals by which progress and ultimately termination of this phase can be measured. The plan may include a multi-credit HUMS that will require a phased introduction of credits.
(5) Continued Airworthiness and Synthesis of Credit. Normal and establisned procedures will prevail for HUMS as for all other continued airworthiness matters.
Arrangements should be made to validate the performance of an approved credit throughout its service use. Provisions should be made to allow for the synthesis of the service experience with relevant engineering evidence from rejected components, development testing, seeded testing, etc. Any necessary or desired modifications to the HUMS application or the component/equipment being monitored must be re-evaluated.
h. Instructions for Continued Airworthiness (ICA) and Other Requirements for Health and Usage Monitoring System (HUMS). This section addresses the ICA, operator's HUMS program, HUMS training, and Master Minimum Equipment List (MMEL) revision to incorporate HUMS.
(1) Instructions for Continued Airworthiness. The applicant for HUMS is required to provide ICA developed in accordance with FAR/JAR Part 27 and Appendix A. This section provides supplemental guidance with addressing aspects unique to HUMS. The applicant may be an airframe manufacturer, HUMS equipment manufacturer, or an operator. The ICA should address HUMS integration with the aircraft. This section addresses both airborne and ground based systems and equipment.
(i) HUMS ICA Items. The applicant must address the following subjects in addition to FAR/JAR Part 27. These subjects should address both airborne and ground based systems and equipment unless specifically indicated otherwise.
Page MG 15 - 15
AC 27-1B, Chg 1 2/12/03 (A) Control and operating instructions must be provided for each element of HUMS, and where applicable, include data acquisition, transfer processing, display, configuration management, and resulting actions.
(B) Acceptance and rejection criteria and associated actions must be defined.
(C) A procedure is required when the system becomes inoperative because data is missing.
(D) When required, there must be a procedure for collecting and transferring HUMS data when the aircraft is away from the main HUMS data processing base.
(E) Provide a procedure for independent verification as defined in paragraph f(3), if applicable.
(F) Provide a procedure for implementing mitigating actions, when mitigating actions are applied.
(G) Provide a procedure for implementing controlled introduction to service instructions as defined in paragraph g(4), if applicable.
(H) Provide a training program on HUMS airborne and ground based systems and equipment.
(1) The airworthiness limitation section must be amended to address the tollowing, if required:
(1) Requirements for independent verification and associated procedures.
(2) Requirements for mitigation actions and associated procedures.
(3) Requirements for controlled introduction to service and associated procedures.
(ii) Ground Based System and Equipment. A procedure must be defined to ensure the security of the ground-based system and equipment and the integrity of the HUMS data.
(2) Owner/Operator's HUMS Program.
General. An owner/operator that installs and utilizes health and usage monitoring equipment on aircraft and intends to request maintenance credit will need a program. This program and revision to existing maintenance and/or inspection programs must be submitted to the aviation Authority for approval. This is due to the Page MG 15 - 16
fact that maintenance credit may change existing maintenance inspection, overhaul requirements, and/or life limits.
HUMS Program Items. Regardless of the size and complexity of the health and usage monitoring equipment, the HUMS program must contain the following:
(A) A system must be provided for tracking the HUMS monitored component/system, including identification of component/system, recording requirement, tracking procedure, and other related activities.
(B) A system to assure that a maintenance credit must be maintained.
The historical HUMS data must be traceable when such components/assemblies are transferred between aircraft.
(C) A procedure for new or overhauled HUMS monitored components.
(D) A procedure to address inoperative HUMS in accordance with paragraph j(1)(i)(C).
(E) A means for implementing procedures specified in paragraph j(1)(ii).
(F) A procedure for adjusting maintenance credits.
(G) An organization with clearly defined responsibilities to collect, analyze, and act upon the HUMS data.
(H) A procedure for implementing the training program specified in paragraph J(1)(1)(H).
(1) Where appropriate, a procedure for implementing the controlled introduction to service plan. See section g(4), Controlled Introduction to Service.
(iii) Ground Based System and Equipment.
(A) A procedure for troubleshooting and testing of the HUMS.
(B) A procedure for revising and using the operator's Minimum Equipment List (MEL) for HUMS.
(iv) Master Minimum Equipment List (MMEL)/Minimum Equipment List.
(A) The MMEL may need to be revised to include the HUMS equipment.
Once the MMEL contains the HUMS equipment, the operator can revise their MEL to include HUMS and submit the MEL to the aviation Authority for approval.
Page MG 15 - 17
AC 27-1B, Chg 1 2/12/03 (B) The aviation Authority should coordinate with engineering in evaluating the revised MEL.
VOTE: Any MMEL allowance should be determined considering the criticality of the credit effect resulting trom the HUMS application (s). MMEL allowances should be substantiated based on a Functional Hazard Assessment (FHA).
Page MG 15 - 18
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 16. CERTIFICATION GUIDANCE FOR ROTORCRAFT NIGHT VISION IMAGING SYSTEM (NVIS) AIRCRAFT LIGHTING SYSTEMS.
a. Purpose. The guidance in this MG is one method to show compliance with 14 CFR part 27 regarding aircraft lighting modification for NVIS compatibility Additional guidance is found in RTCA Document DO-275, Minimum Operational Performance Standards for Integrated Night Vision Imaging System Equipment, issued October 12, 2001. The applicant should also be familiar with RTCA Document DO-268, Concept of Operations: Night Vision Imaging System for Civil Operators, issued March 27, 2001. For operations within Europe, applicants should also be familiar with Joint Aviation Authorities Temporary Guidance Leaflet No. 34, Night Vision Imaging System (NVIS) Operations. For NVIS operations outside the United States, other similar documents may also apply.
b. Revisions.
(1) This revision focuses the guidance on NVIS lighting and night vision goggles (NVG) and NVIS lighting cockpit compatibility
(2) NVIS and NVG cockpit evaluation guides and checklists are located at http://www.faa.gov/aircraft/air_cert/design_approvals/rotorcraft/nvis/.
c. Definitions.
(1) Cultural lighting. Light emitted from cities, towns, residences, streetlights, or other artificial sources. Cultural lighting may help or hinder the pilot's external view through NGs depending on intensity, reflection off cloud cover, landing zone, and topography.
(2) Night vision imaging system (NVIS). A system that integrates all elements (including the NVG, windshield, and lighting system) required to operate an aircraft successfully and safely with the aid of NVGs.
(3) NVIS lighting component. Any component intended for use with NVGs that emits or transmits light within the flight deck or other crew compartments, or attached to the aircraft exterior, and does not degrade NVG performance.
(4) NVIS lighting system. An aircraft lighting system modified or designed to incorporate NVIS lighting components. It provides adequate illumination, under day and night conditions, of instruments, displays, and controls for the unaided eye without degrading NVG performance. NVIS lighting systems must meet part 27 lighting requirements.
(5) NVIS-friendly (as applicable to external lights). NVIS-friendly exterior lights can be viewed by the unaided eye, meet the position light requirements of §27.1385, and do not significantly interfere with NVG performance. An NVIS-friendly exterior light emits more NVG-detectable (usually infrared (IR)), wavelengths of energy as compared to lights that are completely NVIS-compatible. An NVIS-friendly exterior light will be detected when viewed through the NGs and not overwhelm the aircraft outline or cause shadowing or objectionable reflections off the aircraft. When viewed through NVGs, the light does not cause excessive "blooming," where lights merge together and obscure the outline of the aircraft.
(6) NG-compatible. Aircraft internal and external lighting is NVG-compatible when it does not adversely affect the NVG image.
Page MG 16-1
AC 27-1B, Chg 7 2/4/2016
(7) Aided flight. A flight in which the flight crew references NVG imagery to assist visual flight.
(8) Unaided flight. A flight in which the flight crew does not reference NVG imagery.
(9) Transparencies. Windshields, windows, chin bubbles, and overhead windows through which the crew views the outside scene with NVGs.
(10) Inadvertent instrument meteorological conditions (IMC). An unplanned encounter with visual conditions that do not permit continued flight under VFR where conditions do not allow for the visual determination of a usable horizon (e.g., fog, snow showers, or night operations over unlit surfaces such as water). Some examples where inadvertent IMC may occur are flight into areas with no lights or other features that allow for visual contact with the ground or horizon; actual IMC-like entering clouds; brownout or white out during approaches or takeoffs from dusty or snow covered unimproved landing zones; or whiteout because of blowing and falling snow.
(11) Unimproved landing area. Any site that is not an airport, heliport, or other civil aviation authority approved landing site.
d. References (use the current versions of the following references).
(1) Regulatory (14 CFR sections).
27.1 27.1322 27.1501
27.21 27.1351 27.1523
27.141(c) 27.1357 27.1525
27.603(c) 27.1367 27.1529
27.771 27.1381 27.1541
27.773 27.1383 27.1543
27.777 27.1385 27.1545
27.785 27.1387 27.1549
27.807(b)(3) 27.1389 27.1553
27.853 27.1391 27.1555
27.1301 27.1393 27.1557
27.1303 27.1395 27.1561
27.1305 27.1397 27.1581
27.1307 27.1399 27.1583
27.1309 27.1401 27.1585
27.1321
(2) Other reference.
Document Title AC 25-11 Electronic Flight Displays AC 20-74 Aircraft Position and Anticollision Light Measurements AC 20-88 Guidelines on the Marking of Aircraft Powerplant Instruments (Displays) AC 20-152 RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware RTCA DO-268 Concept of Operations, Night Vision Imaging System for Civil Operators RTCA DO-275 Minimum Operational Performance Standards for Integrated Night Vision Imaging System Equipment SAE ARP 4754 Guidelines for Development of Civil Aircraft and Systems SAE ARP 4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment Page MG 16-2
Document Title SAE ARP 5825 Design Requirements and Test Procedures for Dual Mode Exterior Lights TSO-C4c Bank and Pitch Instruments TSO-C8e Vertical Velocity Instruments (Rate-of-Climb) TSO-C87 Airborne Low-Range Radio Altimeter TSO-C164 Night Vision Goggles
e. Background.
(1) The guiding technical specifications document for NVIS lighting is RTCA/DO-275, Minimum Operational Performance Standards for Integrated Night Vision Imaging System Equipment, in addition to the means of compliance presented in this advisory circular. The lighting system should be designed to be used with NVGs that meet the performance requirements of FAA TSO-C164 Night Vision Goggles.
(2) We harmonized this guidance with the European Aviation Safety Agency (EASA) and Transport Canada Civil Aviation (TCCA) NVIS lighting guidance documents.
(3) Certification of NGs is not included in this guidance.
(4) The primary tenet of the use of NVGs in civil flight operations is that they are an aid to VFR flight. NGs are not intended to expand an aircraft's operational envelope or expand operational capabilities.
(5) NVGs used to evaluate NVIS lighting systems will be the same make-model part number used by the operator whose aircraft is being modified, and the NVGs should meet the performance requirements of TSO-C164 and RTCA Document DO-275.
(6) This guidance is for use with NVIS using NGs and does not apply to other night or low visual environment enhancement devices (forward-looking infrared system (FLIR), enhanced vision system (EVS), etc.).
(7) NGs enhance a pilot's night vision by amplifying certain energy frequencies. The NGs for civil use are based on performance criteria in TSO-C164 and RTCA Document DO-275.. These NGS are known as "Class B NVG" because they have a filter applied to the objective lens that blocks energy below the wavelength of 665 nanometers (nm). The Class B objective lens filter allows more use of color in the cockpit with truer reds and ambers. The TSO specifies Class B NVGs for civil use. Because NVGS will amplify energy that is not within the range of the filter, it is important that the NVIS lighting system keep those incompatible frequencies out of the cockpit. However, there are NVGs in civil use that do not conform to the TSO-C164 standard because they have Class A filters on their objective lenses. Class A filters block energy below the wavelength of 625 nm. As a result, Class A NGs will amplify more wavelengths of visible light requiring special care in the use of color in the cockpit. Applicants and operators are advised to review RTCA Document DO-275 to familiarize themselves with Classes of
(8) Modifications that make an aircraft NVIS-compliant are a major alteration or change, due to the fundamental effect visible and near-IR wavelength energy has on NVGs that, in turn, directly affects the pilot's visual perception.
(9) Any changes to a certificated NVIS lighting system are major changes under § 21.93(a) since they may affect the operational characteristics of the aircraft). Consequently, evaluate any changes in accordance with this guidance.
(10) There are two processes involved in the certification of aircraft NVIS lighting:
Page MG 16-3
AC 27-1B, Chg 7 2/4/2016
(i) Installation and certification of the NVIS-compatible lighting on the aircraft. This process ensures the NVIS lighting installation is compatible with day and night-unaided (without NVG) use.
(ii) Certification that the installed NVIS lighting is compatible with NVG operations. The structure of this guidance is to assist in both the design and installation of the NVIS lighting system and in the certification that the lighting system is NVG compatible. Compatibility of the NVIS installation and NGs must be assessed using each make and model part number of the NVG that the applicant proposes for NVIS operations. Any subsequent change in the goggle specification or cockpit lighting configuration may render the current approval invalid and will require a re-evaluation for NVIS cockpit and NVG compatibility.
Notes: Aircraft intended for NVG operations must go through the NVIS certification process, whether modified by supplemental type certificate (STC) or produced by the aircraft manufacturer.
Basic aircraft approval for day and night VFR does not constitute NVIS certification. In addition, some rotorcraft may not be suitable for NVIS certification due to factors such as cockpit obstructions, inability of pilots to move their heads while wearing NVGs, inability of the cockpit to accommodate a pilot wearing a helmet, etc.
Certification ground and flight test scheduling should account for nighttime ambient lighting conditions. Type inspection authorization (TIA) flights should be accomplished in no-moon conditions to avoid masking possible low illumination, incompatible lighting effects during the NVIS cockpit, and NVG interface evaluations. In addition, fly the flight test in areas where there is little or no cultural lighting.
Installation of a NVIS lighting system does not authorize the operation of NVGs. The operator must coordinate with the FAA oversight office to obtain operational authorization.
Page MG 16-4