AC 27-1B, Chg 7 2/4/2016
2.3 Additional Required Equipment Functioning Correctly for NVG Operations (define this for each helicopter).
2.3.1 Vertical speed indicator or equivalent.
2.3.2 List other aircraft equipment identified in the STC required for the operation like curtains separating the cockpit from the passenger cabin, chin bubble mats, etc.
2.3.3 If a design method (e.g., chin mats) is used to block the light from entering the cockpit, a caution such as the one below may be required. Only add requirements for chin mats or other light blocking items, like curtains, if they are required by the STC. Do not add generic statements or "if needed" statements to the limitations section of the RFMS.
"CAUTION:
Ensure ‹enter chin mats, or whatever is used to block chin bubble light> are positioned and secured properly, allow sufficient view out of the chin bubble, and that they do not block or restrict operation of the flight controlsi
2.4 Minimum Crew. For foreign certifications, check with the foreign authority for correct wording.
2.4.1 Additional crewmember use of NVGs during single-pilot operations into and out of unimproved sites:
2.4.1.1 Landing. An additional NVG trained crewmember must be equipped with and use NVGs during landing to assist in obstacle identification and clearing.
2.4.1.2 Takeoff. An additional NVG trained crewmember must use NVGs during takeoff from unimproved sites to assist in obstacle identification and clearance if operational conditions permit (i.e., patient status allows).
2.5 Incompatible NVIS Lights. Specifically identify installed lighting in the cockpit and cabin that the STC did not modify and that are not useable during NVG operations. Additionally, include instructions on the use of non-NVIS lighting modified carry on equipment (e.g., cell phones, mission equipment, medical equipment) during NVG operations. For example, instructions should be the following or similar:
"Use of non-NVIS modified carry-on or personal equipment in the cockpit is prohibited during NVG operations."
The pilot must coordinate with other crewmembers and passengers before the use of non-NVIS modified carry-on equipment is used during NVG operations.
3. EMERGENCY AND MALFUNCTION PROCEDURES.
3.1 NVG Malfunction or Failure. Describe procedures for NVG failure and for transition from aided to unaided flight, as may be required.
NVIS Lighting Malfunction or Failure in Flight. Describe procedures for handling NVIS lighting malfunctions, including procedures if the malfunction or failure degrades NVIS compatibility.
NORMAL PROCEDURES. Provide configuration and check procedures to ensure aircraft is capable of NG operations. Suggested procedures are:
4.1 Operational Procedures.
4.1.1 Preflight.
Page MG 16-14
• Check windshield, windows, and chin bubble windows for suitability (e.g., scratches, crazing, cleanliness).
• Check filter condition for fogging, crazing, cracking, etc., which impairs unaided readability of the instrument or gauge to which the filter is applied.
• Check NVIS lighting for light leakage and compatibility.
• NVG adjustment and alignment.
• Check function of additional NVIS equipment.
• Interior configuration check for NVIS equipment (e.g., deselect incompatible light sources).
• Exterior configuration check for NVIS equipment (e.g., position lights, taxi and landing light, search light are selected to correct mode, if applicable).
• Adjust lighting as required.
4.1.2 In-flight.
• Control of cockpit and external NVIS illumination. Adjust lighting, as required.
• Transition to aided from unaided operations (and vice versa), as necessary.
• Radar altimeter and additional equipment procedures, as necessary.
4.1.3 Post flight. Report NVIS lighting or equipment and windscreen/transparency discrepancies.
5. WEIGHT AND BALANCE. The weight and balance should include the installation of NVIS equipment. Provide a sufficiently detailed system description. Refer to AC 43.13-1B, Chapter 10 for additional guidance.
(End of the section of one template for use as an RFMS.)
Page MG 16-15
AC 27-1B, Chg 7 2/4/2016
h. Instructions for Continued Airworthiness (ICA)
(1) General. ICA must contain the information necessary for carrying out ongoing maintenance and inspections on NVIS equipment installed in the rotorcraft. Refer to section AC 27.1529 and Appendix A of this guidance RTCA Document DO-275, section 5.5 also contains information related to the development of NVIS lighting ICA's, At a minimum, the following should be included:
(i) Appliance, system or accessory maintenance manual, or section.
(ii) Maintenance Instructions and Inspection Requirements. Ensure that the ICA instructions are clear on whether the operator must remove the filter or other NVIS modification prior to returning an instrument, gauge, or light to the manufacturer for maintenance. Ensure the ICAs have sufficient instructions on how to de-modify and re-modify instruments and gauges. Additionally, we recommend periodic inspections to ensure the NVIS lighting system is still NVG compatible and the configuration of the aircraft still agrees with the approved data. One acceptable method is the inclusion of an annual or time-interval inspection procedure..
(iii) Airworthiness Limitations.
(iv) Illustrated Parts Breakdown. The ICA should cover (as a minimum) aircraft transparencies (windscreen, windows, etc.), NVIS lighting, and any additional aircraft equipment that support NVIS operations. The NVG manufacturer should have ICA and maintenance schedules for its goggles that the operator should follow.
(v) It is recommended that a storage location or compartment is provided on the aircraft to protect the continued airworthiness of the NVGs. However, storing the NVGs in a location that could cause damage to the aircraft or an aircraft component, hinder crashworthiness, or result in loss of the intended function of a component is prohibited.
(2) Modifications or Maintenance.
(i) Post - Type Certificate (TC) or STC Approved Modifications. Any subsequent aircraft modifications (internal or external), including operational equipment (FLIR, EMS equipment, etc.)
involving a light emitting or reflecting device should be considered major since it could affect the operational characteristics of the NVIS lighting system and should be re-assessed against the original requirements for the NVIS certification.
(ii) Multiple TC or STC Approvals. If an approval is granted for multiple aircraft, installation and production procedures should ensure all aircraft comply with the type design. Provide this information in the initial certification data package so that the FAA knows it is intended for multiple approvals. The production procedures should be sufficiently detailed to detect minor differences between the different aircraft. Expect that post-production tests will include the ground and flight tests described above for each individual aircraft.
(ili) STC and Type Certificate Data Sheet (TCDS) verbiage: The following verbiage was developed to help with f.(2)(i) and f.(2)(ii) above and should be included in the "Limitations" section of the STC and the TC TCDS:
"Any deviation from the cockpit or cabin configuration specified in the STC or TC Type Design may affect the compatibility of the NVIS and will require a re-evaluation for NVIS cockpit and NVG compatibility. The aircraft is not certificated for NVG operations until the evaluation is completed."
Note: Find the NVIS/NG cockpit evaluation guides/checklists at http://www.faa.gov/aircraft/air_cert/design_approvals/rotorcraft/nvis.
Page MG 16-16
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 17 GUIDANCE ON ANALYZING AN ADVANCED FLIGHT CONTROLS (AdFC) SYSTEM
a. Purpose.
(1) This MG provides certification guidance for installation of an AdFC system in rotorcraft. An AdFC is a flight control system that utilizes or replaces mechanical parts in conventional mechanical flight control systems with electronic parts such that there is no remaining direct mechanical link from the pilot to the control surfaces or swashplate.
Typical systems include fly-by-wire and fly-by-light. For the purpose of this document, conventional limited-authority or full-authority stability augmentation systems are not considered a subset of AdFC.
(2) This MG describes acceptable guidance for analyzing an AdFC system to determine compliance with all applicable sections of 14 CFR part 27. An applicant for a type certificate, amended type certificate, supplemental type certificate, amended supplemental type certificate, and technical standard order authorization may use the "Rotorcraft Advanced Flight Controls (AdFC) Handbook" (being published under Policy Statement PS-ASW-27,29-09), in conjunction with applicable ACs, to comply with relevant regulations.
b. References and Related Documents.
(1) Applicable 14 CFR part 27 regulations:
27.141, 27.143, 27.151, 27.161, 27.171, 27.173, 27.175, 27.177, 27.241,
27.391, 27.395, 27.397, 27.399, 27.602, 27.663, 27.671, 27.672, 27.674,
27.675, 27.681, 27.683, 27.685, 27.687, 27.771, 27.773, 27.777, 27.779,
27.1301, 27.1309, 27.1317, 27.1321, 27.1322, 27.1329, 27.1335, 27.1351,
27.1367, 27.1555, 27.1581, 27.1585, and Appendix B
(2) Applicable ACS (current version):
(i) AC 20-174, Development of Civil Aircraft and Systems.
(ii) AC 20-175, Controls for Flight Deck Systems.
(iII) AC 27-1, section 27.1309; Equipment, Systems, and Installations.
(3) Applicable Orders (current version):
(i) 4040.26, Aircraft Certification Service Flight Test Risk Management Program.
Page MG 17 - 1
AC 27-1B, Chg 5 6/13/2014
(ii) 8110.4, Type Certification.
(4) Applicable guidance:
(i) Policy Statement PS-ASW-27,29-09, Rotorcraft Advanced Flight Controls (AdFC) Handbook.
(ii) SAE, International ARP 4754A, Guidelines for Development of Civil Aircraft and Systems.
(iii) SAE, International ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
c. Background. The FAA recognizes that technology utilized in commercial rotorcraft consistently lags behind state-of-the-art air transport aircraft and military technologies. AdFC technology has been in use for many years, but guidance material on the safety aspects of certification, continued operational safety, and especially the use of that technology has been limited within the FAA.
d. Application. Applicants seeking approval for the installation of an AdFC system in rotorcraft should apply this guidance as a means, but not the only means, for showing compliance with the applicable rules.
(1) Since part 27 regulations are inadequate for addressing the new and novel features of AdFC systems, special conditions, equivalent means of compliance, and methods of compliance issue papers may be required to establish safety standards in the following areas:
(i) Interaction of Systems and Structures. Since rotorcraft with AdFC systems may contain control functions that affect the structural integrity of the rotorcraft, additional safety considerations are necessary to address the effects of these systems on structural integrity, either directly or because of AdFC failures.
(il) Pilot and Co-Pilot Dual Controls. Since the current regulations address mechanically linked controls only, additional safety considerations are necessary to address potentially confusing aspects of pilot and co-pilot dual, non-linked controls. As an example, a non-responsive control input could prevent compliance with § 27.779.
(IlI) Lateral-Directional and Longitudinal Stability and Low Energy Awareness.
An AdFC allows for many possibilities in developing laws for novel flight control. In the simplest form, an AdFC could replace the function of a direct link between the flight controls and the swashplate. The current requirements were written with the conventional systems of the rotorcraft handling qualities in mind. A more likely situation is the use of an AdFC to modify the relationship between control input and rotorcraft response.
Page MG 17 - 2
(iv) Control Margin Awareness. Additional safety considerations are required to address pilot awareness when employing AdFC systems since certain provisions of § 27.143 are not adequate for AdFC systems.
(v) Flight Characteristics Compliance via the Handling Quantities Rating Method (HQRM). Additional safety considerations are required to address a methodology for compliance with § 27.1309 by using the HQRM to show an HQ rating of "satisfactory" for flying qualities in degraded modes.
(vi) Flightcrew Alerting. Additional safety considerations are required to address the unique alerting characteristics of AdFC systems. The current regulations may be inadequate to handle the display of possible degraded modes where a pilot needs to be aware of the state of the primary flight controls.
(vii) Data Integrity. Additional safety considerations are required to ensure that the primary signals from the flight control system cannot be altered unintentionally, that the altered signal characteristics will maintain stable gain and phase margins with sufficient power to each axis, and that un-commanded signals are extremely improbable.
(vili) Flight Envelope Protection (FEP). Additional safety considerations are required to ensure that an FEP system, if implemented, prevents the pilot or autopilot from making control commands that would force the aircraft to exceed its structural or aerodynamic operating limits.
(2) Evaluation Methodology. There should be an evaluation of the AdFC system's performance, the same as with conventional flight control systems, to demonstrate adherence to the safety requirements under all failure conditions. In each case, the software and hardware used must be under configuration control to comply with the regulations. We recognize the following evaluation methods; however, there may be other acceptable methods:
- Computer Analysis.
- Pilot-in-the-Loop Simulator Test.
- Bench Test.
- Ground Test.
- Flight Test.
(i) There may be a relationship between the levels of integrity provided to satisfy a determined failure condition category and the methodology used to validate the adequacy of the provided integrity. The below table, Figure AC 27 MG 17-1, addresses this relationship:
Page MG 17 - 3
AC 27-1B, Chg 5 6/13/2014 Failure Condition Suggested Verification Possible Additional Categories Method Methods Minor Analysis Flight Testing Major Analysis Simulation Ground Test Flight Test Hazardous/ Analysis Simulation Severe-Major Ground Test Limited Flight Tests *1, *2 Catastrophic Analysis Limited Flight Tests "1, "2 Simulation Ground Test * - Notes:
1 - This should be determined on a case-to-case basis.
2 - Minimize flight testing as a verification methodology, for this combination of provided integrity and failure condition category, due to safety in testing considerations. However, desirable flight testing may be feasible for some aspects if observing proper identification of flight test risk and assessments, and risk mitigations, in accordance with FAA Order 4040.26.
3 - For analysis or verification, those probable failures evaluated as having minor effects, flight testing is an option if the effects are not obvious or if there can only be evaluation of closed loop effects in flight.
Figure AC 27 MG 17-1 Verification Methodology
(il) Due to AdFC inherent complexity, AdFC systems that typically have a large number of test cases of single and multiple failures should be investigated to verify the safety functions under all failure conditions.
(A) Non-Real Time Computer Analysis. At the beginning of the development process, when system components are not yet available in hardware, non-real time computer simulation is a useful tool for supporting the preliminary system safety assessment. This allows, at an early stage of the development, a prediction of the effects and an assessment of the criticality of failure modes of the flight control system.
(B) Pilot-in-the-Loop Simulator Test. It may be practical to use a flight simulator (FS) to qualitatively verify safety assessments for certain AdFC failure conditions that would be high risk or unsafe to perform in flight. These assessments may be part of the SA process used to show compliance with specific regulations. For Page MG 17 - 4
example, use the FS to gather data on aircraft transients caused by a failure, crew recognition of the abnormal event, recoverability after the failure transient, and the ability to continue safe flight and landing after recovery. There can be accomplishment of these assessments for critical, selected conditions using the FS without presenting a safety risk to the flight test crew.
(1) Test Environment. The test environment for pilot-in-the-loop simulator tests includes:
- Cockpit, equipped with AdFC representative displays and controls.
- Computer Generated Imagining (CGI).
- Simulated AdFC system.
- Simulated rotorcraft visuals and behavior.
(2) Verification of Simulation Tools.
1) Before final evaluation of failure mode effects using a FS, validate the FS for the specific test conditions identified in the test plan. This validation may be done quantitatively, qualitatively, or both and must be in a manner suitable to the FAA.
(I) There should be control of the FS configuration, including hardware and software, to ensure there is no corruption of the functional performance, as validated, during the certification process. The FS should be assessed to identify and preclude opportunities for misleading simulator results that could affect the certification process and ultimately the design of the AdFC systems.
3) Test Procedure and Expected Results. The test procedure for pilot-inthe-loop simulator tests includes real-time simulation of performance with simulated failures. The expected test results are:
I) Evaluation of pilot intervention time (recognition and reaction time) for the occurrence of failures under various flight conditions.
(I) Assessment of handling qualities during recovery maneuvers.
(iii) Assessment of man-machine interface (controls and displays, warnings, cautions, and advisories).
(iv) Evaluation of rotorcraft transients.
(C) Bench Test. The installation of an AdFC system should include the actual hardware and appropriate software version under configuration control. Any tests performed should be documented and also maintained under configuration management for repeatability.
Page MG 17 - 5
AC 27-1B, Chg 5 6/13/2014
(1) Test Environment. The environment for bench tests includes:
(i) AdFC system should be realistic to the aircraft environment, including, but not limited to, the mechanical equipment, wiring, cooling, electrical and hydraulic power supplies, cockpit controls and displays, trim system, actuation system, and actuator loads.
(il) If simulation is used, the model must be validated by a means acceptable to the FAA.
(2) Test Procedure and Expected Results. The test procedures for bench tests and rig tests should include open loop and closed-loop tests with simulated failures. The expected results are:
(1) Verification of failure logic, failure management, and resultant degraded modes.
(i) Evaluation of transients during and after failure modes.
Note: Compared to validation of failure management in the simulator, the use of hardware-in-the-loop simulation provides more realistic results with respect to signal accuracy and resolution, phase delay, and other hardware or software related effects.
(D) Rotorcraft Test.
(1) Ground Test. Verification of some aspects of the AdFC functionality should be possible on the ground, such as determination of stuck or jammed controls or actuators. Ground testing should be performed to check the safety functions with the equipment installed in the aircraft. Operation tests should demonstrate that the flight control system is free from jamming. Limit load static tests should demonstrate compliance with limit load requirements.
(2) Flight Test. The objective of flight tests is to show compliance with applicable rules and safety requirements, and to verify assumptions for those objectives that are not possible during ground testing. Certain effects can only be addressed in flight, such as aircraft stability and control, aircrew human factors and ergonomics, pilotinduced oscillations, air resonance, and structural coupling. Rotorcraft performance and handling qualities under normal and failure operating conditions should be assessed. If necessary, testing conditions should provide for resetting of failures at any time to return to the faultless system configuration. Flight tests at various flight conditions with and without simulated failures should be performed considering event risk assessments and risk mitigations.
Page MG 17 - 6
) Tvoe Inspection Authorization (TIA) reduirements. In addition to th equirements of Order 8110.4 (current version) and prior to performina a TIA flight. th applicant should provide the following documentation to the FAA:
(i) A failure condition analysis, preferably an approved FHA, with all disagreements resolved.
(ii) Evidence of completion of software Stage of Involvement (SOI) #3 including all SOI #3 findings and observations, along with their disposition.
(ii) Adequate disposition of all open problem reports.
Page MG 17 - 7
AC 27-1B, Chg 5 6/13/2014 Page MG 17 - 8
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 18. HELICOPTER TERRAIN AWARENESS AND WARNING SYSTEM (HTAWS).
a. Background.
(1) HTAWS is a computer-based system that provides the flight crew with alerts (both aural and visual) of pending collision of the rotorcraft with the terrain, considering such items as crew recognition and reaction times. HTAWS evolved from earlier rotorcraft alerting systems to support specific helicopter operational requirements.
(2) HTAWS takes inputs from a horizontal position source, vertical position source, terrain database, and an obstacle database to provide enhanced terrain and obstacle awareness. The intended function of HTAWS is an alerting system, which presents terrain and obstacle aural and visual alerts within a chosen flight/alert envelope.
Guidance for rotorcraft specific requirements and system performance is found in Technical Standard Order (TSO)-C194, Helicopter Terrain Awareness and Warning System (HTAWS). TSO-C194 was developed to support rotorcraft specific operational requirements and prescribes the minimum performance standards that a HTAWS must meet for approval and identification with the applicable TSO label.
Note: The issuance of a technical standard order authorization (TSOA) against TSO-C194 (or further amendments) does not constitute an installation approval.
(3) HTAWS is required for operations under 14 CFR part 135 subpart L, Helicopter Air Ambulance Equipment, Operation, and Training Requirements; § 135.605, Helicopter Terrain Awareness and Warning System (HTAWS).
b. Purpose.
(1) This guidance sets forth a method of compliance with the requirements of 14 CFR part 27 pertaining to installations of HTAWS equipment. It is for guidance purposes and provides an acceptable method of compliance. This guidance covers the safety assessment, types of environmental testing that should be considered for such installations, and identifies other installation considerations. The guidance does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. The applicant may elect to follow an alternate method provided the FAA also finds the alternate method acceptable. It describes the airworthiness considerations for such installations as they apply to the unique features of the HTAWS and the interfaces with other systems on the helicopter. The HTAWS certification should address the complete certification process. There are five basic Page MG 18 - 1