CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 17 GUIDANCE ON ANALYZING AN ADVANCED FLIGHT CONTROLS (AdFC) SYSTEM
a. Purpose.
(1) This MG provides certification guidance for installation of an AdFC system in rotorcraft. An AdFC is a flight control system that utilizes or replaces mechanical parts in conventional mechanical flight control systems with electronic parts such that there is no remaining direct mechanical link from the pilot to the control surfaces or swashplate.
Typical systems include fly-by-wire and fly-by-light. For the purpose of this document, conventional limited-authority or full-authority stability augmentation systems are not considered a subset of AdFC.
(2) This MG describes acceptable guidance for analyzing an AdFC system to determine compliance with all applicable sections of 14 CFR part 27. An applicant for a type certificate, amended type certificate, supplemental type certificate, amended supplemental type certificate, and technical standard order authorization may use the "Rotorcraft Advanced Flight Controls (AdFC) Handbook" (being published under Policy Statement PS-ASW-27,29-09), in conjunction with applicable ACs, to comply with relevant regulations.
b. References and Related Documents.
(1) Applicable 14 CFR part 27 regulations:
27.141, 27.143, 27.151, 27.161, 27.171, 27.173, 27.175, 27.177, 27.241,
27.391, 27.395, 27.397, 27.399, 27.602, 27.663, 27.671, 27.672, 27.674,
27.675, 27.681, 27.683, 27.685, 27.687, 27.771, 27.773, 27.777, 27.779,
27.1301, 27.1309, 27.1317, 27.1321, 27.1322, 27.1329, 27.1335, 27.1351,
27.1367, 27.1555, 27.1581, 27.1585, and Appendix B
(2) Applicable ACS (current version):
(i) AC 20-174, Development of Civil Aircraft and Systems.
(ii) AC 20-175, Controls for Flight Deck Systems.
(iII) AC 27-1, section 27.1309; Equipment, Systems, and Installations.
(3) Applicable Orders (current version):
(i) 4040.26, Aircraft Certification Service Flight Test Risk Management Program.
Page MG 17 - 1
AC 27-1B, Chg 5 6/13/2014
(ii) 8110.4, Type Certification.
(4) Applicable guidance:
(i) Policy Statement PS-ASW-27,29-09, Rotorcraft Advanced Flight Controls (AdFC) Handbook.
(ii) SAE, International ARP 4754A, Guidelines for Development of Civil Aircraft and Systems.
(iii) SAE, International ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
c. Background. The FAA recognizes that technology utilized in commercial rotorcraft consistently lags behind state-of-the-art air transport aircraft and military technologies. AdFC technology has been in use for many years, but guidance material on the safety aspects of certification, continued operational safety, and especially the use of that technology has been limited within the FAA.
d. Application. Applicants seeking approval for the installation of an AdFC system in rotorcraft should apply this guidance as a means, but not the only means, for showing compliance with the applicable rules.
(1) Since part 27 regulations are inadequate for addressing the new and novel features of AdFC systems, special conditions, equivalent means of compliance, and methods of compliance issue papers may be required to establish safety standards in the following areas:
(i) Interaction of Systems and Structures. Since rotorcraft with AdFC systems may contain control functions that affect the structural integrity of the rotorcraft, additional safety considerations are necessary to address the effects of these systems on structural integrity, either directly or because of AdFC failures.
(il) Pilot and Co-Pilot Dual Controls. Since the current regulations address mechanically linked controls only, additional safety considerations are necessary to address potentially confusing aspects of pilot and co-pilot dual, non-linked controls. As an example, a non-responsive control input could prevent compliance with § 27.779.
(IlI) Lateral-Directional and Longitudinal Stability and Low Energy Awareness.
An AdFC allows for many possibilities in developing laws for novel flight control. In the simplest form, an AdFC could replace the function of a direct link between the flight controls and the swashplate. The current requirements were written with the conventional systems of the rotorcraft handling qualities in mind. A more likely situation is the use of an AdFC to modify the relationship between control input and rotorcraft response.
Page MG 17 - 2
(iv) Control Margin Awareness. Additional safety considerations are required to address pilot awareness when employing AdFC systems since certain provisions of § 27.143 are not adequate for AdFC systems.
(v) Flight Characteristics Compliance via the Handling Quantities Rating Method (HQRM). Additional safety considerations are required to address a methodology for compliance with § 27.1309 by using the HQRM to show an HQ rating of "satisfactory" for flying qualities in degraded modes.
(vi) Flightcrew Alerting. Additional safety considerations are required to address the unique alerting characteristics of AdFC systems. The current regulations may be inadequate to handle the display of possible degraded modes where a pilot needs to be aware of the state of the primary flight controls.
(vii) Data Integrity. Additional safety considerations are required to ensure that the primary signals from the flight control system cannot be altered unintentionally, that the altered signal characteristics will maintain stable gain and phase margins with sufficient power to each axis, and that un-commanded signals are extremely improbable.
(vili) Flight Envelope Protection (FEP). Additional safety considerations are required to ensure that an FEP system, if implemented, prevents the pilot or autopilot from making control commands that would force the aircraft to exceed its structural or aerodynamic operating limits.
(2) Evaluation Methodology. There should be an evaluation of the AdFC system's performance, the same as with conventional flight control systems, to demonstrate adherence to the safety requirements under all failure conditions. In each case, the software and hardware used must be under configuration control to comply with the regulations. We recognize the following evaluation methods; however, there may be other acceptable methods:
- Computer Analysis.
- Pilot-in-the-Loop Simulator Test.
- Bench Test.
- Ground Test.
- Flight Test.
(i) There may be a relationship between the levels of integrity provided to satisfy a determined failure condition category and the methodology used to validate the adequacy of the provided integrity. The below table, Figure AC 27 MG 17-1, addresses this relationship:
Page MG 17 - 3
AC 27-1B, Chg 5 6/13/2014 Failure Condition Suggested Verification Possible Additional Categories Method Methods Minor Analysis Flight Testing Major Analysis Simulation Ground Test Flight Test Hazardous/ Analysis Simulation Severe-Major Ground Test Limited Flight Tests *1, *2 Catastrophic Analysis Limited Flight Tests "1, "2 Simulation Ground Test * - Notes:
1 - This should be determined on a case-to-case basis.
2 - Minimize flight testing as a verification methodology, for this combination of provided integrity and failure condition category, due to safety in testing considerations. However, desirable flight testing may be feasible for some aspects if observing proper identification of flight test risk and assessments, and risk mitigations, in accordance with FAA Order 4040.26.
3 - For analysis or verification, those probable failures evaluated as having minor effects, flight testing is an option if the effects are not obvious or if there can only be evaluation of closed loop effects in flight.
Figure AC 27 MG 17-1 Verification Methodology
(il) Due to AdFC inherent complexity, AdFC systems that typically have a large number of test cases of single and multiple failures should be investigated to verify the safety functions under all failure conditions.
(A) Non-Real Time Computer Analysis. At the beginning of the development process, when system components are not yet available in hardware, non-real time computer simulation is a useful tool for supporting the preliminary system safety assessment. This allows, at an early stage of the development, a prediction of the effects and an assessment of the criticality of failure modes of the flight control system.
(B) Pilot-in-the-Loop Simulator Test. It may be practical to use a flight simulator (FS) to qualitatively verify safety assessments for certain AdFC failure conditions that would be high risk or unsafe to perform in flight. These assessments may be part of the SA process used to show compliance with specific regulations. For Page MG 17 - 4
example, use the FS to gather data on aircraft transients caused by a failure, crew recognition of the abnormal event, recoverability after the failure transient, and the ability to continue safe flight and landing after recovery. There can be accomplishment of these assessments for critical, selected conditions using the FS without presenting a safety risk to the flight test crew.
(1) Test Environment. The test environment for pilot-in-the-loop simulator tests includes:
- Cockpit, equipped with AdFC representative displays and controls.
- Computer Generated Imagining (CGI).
- Simulated AdFC system.
- Simulated rotorcraft visuals and behavior.
(2) Verification of Simulation Tools.
1) Before final evaluation of failure mode effects using a FS, validate the FS for the specific test conditions identified in the test plan. This validation may be done quantitatively, qualitatively, or both and must be in a manner suitable to the FAA.
(I) There should be control of the FS configuration, including hardware and software, to ensure there is no corruption of the functional performance, as validated, during the certification process. The FS should be assessed to identify and preclude opportunities for misleading simulator results that could affect the certification process and ultimately the design of the AdFC systems.
3) Test Procedure and Expected Results. The test procedure for pilot-inthe-loop simulator tests includes real-time simulation of performance with simulated failures. The expected test results are:
I) Evaluation of pilot intervention time (recognition and reaction time) for the occurrence of failures under various flight conditions.
(I) Assessment of handling qualities during recovery maneuvers.
(iii) Assessment of man-machine interface (controls and displays, warnings, cautions, and advisories).
(iv) Evaluation of rotorcraft transients.
(C) Bench Test. The installation of an AdFC system should include the actual hardware and appropriate software version under configuration control. Any tests performed should be documented and also maintained under configuration management for repeatability.
Page MG 17 - 5
AC 27-1B, Chg 5 6/13/2014
(1) Test Environment. The environment for bench tests includes:
(i) AdFC system should be realistic to the aircraft environment, including, but not limited to, the mechanical equipment, wiring, cooling, electrical and hydraulic power supplies, cockpit controls and displays, trim system, actuation system, and actuator loads.
(il) If simulation is used, the model must be validated by a means acceptable to the FAA.
(2) Test Procedure and Expected Results. The test procedures for bench tests and rig tests should include open loop and closed-loop tests with simulated failures. The expected results are:
(1) Verification of failure logic, failure management, and resultant degraded modes.
(i) Evaluation of transients during and after failure modes.
Note: Compared to validation of failure management in the simulator, the use of hardware-in-the-loop simulation provides more realistic results with respect to signal accuracy and resolution, phase delay, and other hardware or software related effects.
(D) Rotorcraft Test.
(1) Ground Test. Verification of some aspects of the AdFC functionality should be possible on the ground, such as determination of stuck or jammed controls or actuators. Ground testing should be performed to check the safety functions with the equipment installed in the aircraft. Operation tests should demonstrate that the flight control system is free from jamming. Limit load static tests should demonstrate compliance with limit load requirements.
(2) Flight Test. The objective of flight tests is to show compliance with applicable rules and safety requirements, and to verify assumptions for those objectives that are not possible during ground testing. Certain effects can only be addressed in flight, such as aircraft stability and control, aircrew human factors and ergonomics, pilotinduced oscillations, air resonance, and structural coupling. Rotorcraft performance and handling qualities under normal and failure operating conditions should be assessed. If necessary, testing conditions should provide for resetting of failures at any time to return to the faultless system configuration. Flight tests at various flight conditions with and without simulated failures should be performed considering event risk assessments and risk mitigations.
Page MG 17 - 6
) Tvoe Inspection Authorization (TIA) reduirements. In addition to th equirements of Order 8110.4 (current version) and prior to performina a TIA flight. th applicant should provide the following documentation to the FAA:
(i) A failure condition analysis, preferably an approved FHA, with all disagreements resolved.
(ii) Evidence of completion of software Stage of Involvement (SOI) #3 including all SOI #3 findings and observations, along with their disposition.
(ii) Adequate disposition of all open problem reports.
Page MG 17 - 7
AC 27-1B, Chg 5 6/13/2014 Page MG 17 - 8
CHAPTER 3
AIRWORTHINESS STANDARDS
NORMAL CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 27 MG 18. HELICOPTER TERRAIN AWARENESS AND WARNING SYSTEM (HTAWS).
a. Background.
(1) HTAWS is a computer-based system that provides the flight crew with alerts (both aural and visual) of pending collision of the rotorcraft with the terrain, considering such items as crew recognition and reaction times. HTAWS evolved from earlier rotorcraft alerting systems to support specific helicopter operational requirements.
(2) HTAWS takes inputs from a horizontal position source, vertical position source, terrain database, and an obstacle database to provide enhanced terrain and obstacle awareness. The intended function of HTAWS is an alerting system, which presents terrain and obstacle aural and visual alerts within a chosen flight/alert envelope.
Guidance for rotorcraft specific requirements and system performance is found in Technical Standard Order (TSO)-C194, Helicopter Terrain Awareness and Warning System (HTAWS). TSO-C194 was developed to support rotorcraft specific operational requirements and prescribes the minimum performance standards that a HTAWS must meet for approval and identification with the applicable TSO label.
Note: The issuance of a technical standard order authorization (TSOA) against TSO-C194 (or further amendments) does not constitute an installation approval.
(3) HTAWS is required for operations under 14 CFR part 135 subpart L, Helicopter Air Ambulance Equipment, Operation, and Training Requirements; § 135.605, Helicopter Terrain Awareness and Warning System (HTAWS).
b. Purpose.
(1) This guidance sets forth a method of compliance with the requirements of 14 CFR part 27 pertaining to installations of HTAWS equipment. It is for guidance purposes and provides an acceptable method of compliance. This guidance covers the safety assessment, types of environmental testing that should be considered for such installations, and identifies other installation considerations. The guidance does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. The applicant may elect to follow an alternate method provided the FAA also finds the alternate method acceptable. It describes the airworthiness considerations for such installations as they apply to the unique features of the HTAWS and the interfaces with other systems on the helicopter. The HTAWS certification should address the complete certification process. There are five basic Page MG 18 - 1
AC 27-1B, Chg 4 2/27/2014 aspects for certification of HTAWS installations that are discussed throughout this document: equipment qualification, installation, system performance validation, testing considerations, and instructions for continued airworthiness (ICA).
(2) AC 27-1 provides general guidance for certification and compliance of systems and equipment installation on part 27 rotorcraft. TSO-C194 specifies HTAWS equipment requirements and prescribes, by reference to RTCA specification DO-309, the minimum performance standards that a HTAWS must meet for approval. RTCA DO-309 defines specific Minimum Operational Performance Standards (MOPS) for HTAWS equipment. Compliance with RTCA DO-309 provides a method of compliance for qualification of HTAWS equipment. A method of compliance other than described in this AC may be used provided it is determined to be acceptable to the Administrator.
(3) HTAWS required by operational regulation must comply with TSO-C194 and should be installed in accordance with this AC or other methods acceptable to the Administrator. Terrain and obstacle warning systems that do not comply with TSO- C194 and are not installed according to this AC or other method acceptable to the Administrator may be installed as non-required equipment but may not be identified as HTAWS. The certification data, including the rotorcraft flight manual supplement (RFMS) and ICA, must state that the installed system does not comply with any operational regulation that requires HTAWS, and may require a placard.
c. Related Regulations and Documents.
(1) Regulation Sections:
Section Title § 27.1301 Function and installation.
§ 27.1303 Flight and navigation instruments.
§ 27.1309 Equipment, systems, and installations.
§ 27.1316 Electrical and electronic system lightning protection.
§ 27.1317 High-intensity Radiated Field (HIRF) Protection.
§ 27.1321 Arrangement and visibility.
$ 27.1322 Warning, caution, and advisory lights.
§ 27.1351 General. [Electrical Systems and Equipment] § 27.1357 Circuit protective devices.
§ 27.1381 Instrument lights.
§ 27.1459 Flight data recorders.
§ 27.1529 Instructions for Continued Airworthiness.
§ 27.1541 General. [Markings and Placards] General. [Rotorcraft Flight Manual and Approved § 27.1581 Manual Material] § 27.1585 Operating procedures.
Part 91 General Operating and Flight Rules.
Page MG 18 - 2
Section Title Operating Requirements: Commuter and On Demand Part 135 Operations and Rules Governing Persons on Board Such Aircraft.
(2) ACs, Orders, and TSOs:
Publication Title AC 20-115 Airborne Software Assurance.
AC 20-136 against the Indirect Effects of Lightning. Protection of Aircraft Electrical/Electronic Systems RTCA, Inc. Document RTCA/DO-254, Design AC 20-152 Assurance Guidance for Airborne Electronic Hardware.
AC 20-153 Acceptance of Aeronautical Data Processes and Associated Databases.
The Certification of aircraft Electrical and Electronic AC 20-158 Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment.
AC 20-174 Development of Civil Aircraft and Systems RTCA Document DO-160 versions D, E, F, and G, AC 21-16 Environmental Conditions and Test Procedures for Airborne Equipment.
AC 21-40 Guide for Obtaining a Supplemental Type Certificate.
AC 27-1 Certification of Normal Category Rotorcraft.
Order 8110.4 Type Certification.
Order 8110.49 Software Approval Guidelines.
Instructions for Continued Airworthiness Order 8110.54 Responsibilities, Requirements, and Contents.
Simple and Complex Electronic Hardware Approval Order 8110.105 Guidance.
TSO-C92c Alerting Equipment. Ground Proximity Warning/Glide slope Deviation TSO-C194 Helicopter Terrain Awareness and Warning System.
(3) Industry documents.
(i) RTCA documents listed below are available from RTCA, Inc., 1140 Connecticut Avenue N.W., Suite 1020, Washington, D.C. 20036-4001.
Page MG 18 - 3
AC 27-1B, Chg 4 2/27/2014 Publication Title Environmental Conditions and Test Procedures for DO-160 Airborne Equipment.
DO-161A Minimum Performance Standards - Airborne Ground Proximity Warning Equipment.
DO-178 Software Considerations in Airborne System and Equipment Certification.
Design Assurance Guidance for Airborne Electronic DO-254 Hardware.
DO-200A Standards for Processing Aeronautical Data.
Minimum Operational Performance Standard (MOPS) DO-309 for Helicopter Terrain Awareness and Warning System (HTAWS) Airborne Equipment.
(ii) The Society of Automotive Engineers (SAE) Aerospace Recommended Practices documents listed below are available from SAE Customer Service, 400 Commonwealth Drive, Warrendale, PA 15096-001.
Publication Title SAE ARP Certification Considerations for Highly Integrated or 4754A Complex Aircraft Systems.
SAE ARP Guidelines and Methods for Conducting the System 4761 and Equipment. Safety Assessment Process on Civil Airborne Systems
d. Definitions.
(1) Alert: A visual or aural stimulus presented either to attract attention or to convey information regarding system status or condition, or both.
(2) Aural Alert: A verbal statement used to annunciate a condition, situation, or event.
(3) Caution Alert: An alert requiring flight crew awareness. Subsequent corrective action will normally be necessary.
(4) Failure: The inability of the equipment or any subpart of that equipment to perform its intended function within previously specified limits.
(5) False Alert: A warning or caution that occurs when the designed terrain or obstacle warning or caution threshold of the system is not exceeded.
(6) Hazard: A state or set of conditions that, together with other conditions in the environment, could result in an adverse safety impact.
Page MG 18 - 4