(i) The major portion of a Category II approval is the evaluation of the flight guidance system. To certify the flight guidance system for a specific model rotorcraft, a demonstration of 50 ILS approaches with a 90 percent success rate (as defined in Part 91) must be accomplished. If the flight guidance system has not been previously certificated in the rotorcraft, a certification program should be completed for the system before the Category II evaluation is started. It should be determined that the flight guidance system does comply with all the certification requirements before 50 ILS approaches. This is particularly true of an autopilot system where hardover malfunctions must be considered.
(ii) The equipment to be installed for Category II operations must meet the performance criteria specified in AC 120-29, Appendix 1. This material details the criteria for approval of airborne equipment and its installations to meet Category II performance. This appendix covers the rotorcraft flight manual, the systems ground tests, and the installation requirements and tests. Transport category rotorcraft should meet the same systems performance requirements as transport category airplanes.
(iii) The flight demonstration required for Category II system approval is explained in Part 91, Appendix A, Paragraph (e). The accuracy requirements for the tracking equipment are included in Appendix 1 of AC 120-29. The usual met hod of determining the tracking accuracy is by measuring the localizer and glideslope deviations in microamperes and printing them on a continuous strip recorder. The observed cockpit date should also be recorded on a form similar to that in AC 91-16, Attachment 3 (figures AC 29 MG 3-1 and AC 29 MG 3-2). Each approach made during the evaluation should have a complete set of data.
(iv) Coupler systems that require manual trimming by the pilot to center the AFCS actuators should be carefully evaluated, especially in turbulent conditions or gusty crosswinds. These systems may not meet the trim requirements at the 100- foot decision height or may not provide sufficient tracking accuracy without excessive pilot attention and workload.
(v) The effects of coupler system hardover malfunctions should be evaluated in all axes to determine the minimum decision height. The altitude loss that would occur from a nose down hardover at the decision height should be determined.
This altitude loss should be included in the rotorcraft flight manual with the appropriate limitation on the minimum height above the ground for operation with the coupler engaged.
(vi) It is recommended that the demonstration approaches be made to Category II ILS facilities, although this is not required by either Part 91, Appendix A, or AC 91-16. Many Category I ILS installations do not provide good enough signals at the lower altitudes for the precise tracking required for Category II operations. In many cases, this is due to the effects of terrain or buildings off the approach end of the runway. Nevertheless, if satisfactory accuracy can be attained, all the approaches Page MG 3 - 3
required for a Category II approval may be made at Category I facilities. During the flight test, especially if simulated IFR conditions are used in good weather, the approach control and control tower of the facility being used should be advised that Category II operations are being conducted. The Category II ILS clear areas must be kept unobstructed to allow satisfactory ILS signals. The air traffic control agencies should assure that taxiing aircraft, airfield maintenance trucks, and other airfield traffic are kept out of the critical areas during the data-gathering approaches. These agencies can also monitor the ILS facility for proper operation to Category II standards and can advise the test aircraft if abnormal operation occurs.
(3) Rotorcraft Flight Manual. Upon satisfactory completion of an engineering inspection and test program, the FAA/AUTHORITY Rotorcraft Flight Manual (RFM), or supplements thereto, should reflect the following:
(i) The limitations, if any.
(ii) Revision to the performance section, if appropriate.
(iii) A statement of Category II approval to the effect that “The airborne instruments and equipment meet the performance standards for Category II approaches” and the following note:
“NOTE: Compliance with the performance standards referenced above does not constitute approval to conduct Category II operations.
Page MG 3 - 4
CATEGORY II APPROACH EVALUATION Pilot in Co mand Second in Command Date Registration No. Airport - Runway - - Weather Wind FAA Inspector This form will be completed whenever an approach is attempted utilizing the airbome low approach system, regardless of whether the approach is abandoned or concluded succesfully. APPROACH EVALUATION SAMPLE
1. Was the approach successful? YES NO
2. Flight control guidance system used
a. Auto-coupler
b. Flight director
c. If equipped and used, did a and b agree? YES NO Second in Comm and? YES NO FAA Inspector? YES NO
3. Airspeed at middle marker + - at 100' + - from program med speed?
4. If unable to initiate or complete approach (indicate which), was reason due to:
a. Airborne equipment Identify and describe nature of deficiency.
b. Ground equipment . Identify and describe nature of deficiency.
c. Approach control or tower request
d. Other State reason.
5. Was airplane in trim at 100' for continuation of flare and landings?
YES NO
6. If approach and landing abandoned, state altititude above runway.
feet (State reasons).
7. Quality of overall performance: Good Acceptable Unacceptable Pilot in Command's Signature FIGURE AC 29.MG 3-1 Page MG 3 - 5
CATEGORY II APPROACH EVALUATION (cont.)
INDICATE GLIDESLOPE AND LOCALIZER DISPLACEMENT AT MIDDLE MARKER AND 100 FT. A.G. POINT MIDDLE MARKER 100 FT. A. G.
INDICATE AIRPLANE DISPLACEMENT & ORIENTATION WITH
RESPECT TO RUNWAY CENTERLINE AT MIDDLE MARKER AND 100 FT. A.G. BY SYMBOL AT AIRPORTS AND RUNWAYS LISTED
THRESHOLD SAMPLE
•RUNWAY WIDTHS 1 0.5l 10.5 11.0 11.5 100 FT. A.G.
MIDDLE REMARKS:
MARKER
CL OF RUNWAY EXTENDED
TOUCHDOWN WAS FEET FROM THRESHOLD AND
FEET LEFT RIGHT OF CENTERLINE FIGURE AC 29. MG 3-2 Page MG 3 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 4 FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC)
a. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC) FOR INSTALLATIONS WITH CATEGORY A ENGINE ISOLATION.
(1) Background. The advent of “microprocessor technology” has resulted in rotorcraft engine controls being implemented by digital process control rather than by conventional means. These digital, processor-based full authority engine controls offer many performance advantages (such as isochronous governing) which were not feasible with conventional technology, pneumatic or hydromechanical controls.
Because of the incorporation of this advanced technology, some additional considerations must be made of the engine installation to ensure regulatory compliance.
(2) Requirements. T he following is a discussion of some special attention areas for a Part 29 Category A FADEC engine installation. Paragraph AC 29.1309.b.(9)(iii)(A)(4) contains a general definition of what constitutes a “full authority” control.
(i) Software Qualifications.
(A) Paragraph AC 29.1309.b.(7) contains a general discussion on the use of the RTCA/DO-178B document that is used for the approval of system software.
FADECs are generally developed to Level A software under RTCA document DO 178B based on the hazard category of the FADEC failure condition(s). However, if an applicant proposes a FADEC with Level B software based on the Functional Hazard Assessment results, this will require the proposal to be reviewed and approved by both the Engine Directorate and the Rotorcraft Directorate.
(B) RTCA/DO-178A may still be applicable for those FADECs that were previously developed and approved under DO-178A and the applicant is proposing to make changes to the FADEC software. Howe ver, if the applicant proposes to make changes to a DO-178A approved FADEC, the determination on whether the changes should be made under DO-178B or DO-178A will need to be made by the Engine Directorate and Rotorcraft Directorate. When utilizing DO-178A, one might arrive at the conclusion that the engine control, as a required function, is essential; therefore, level 2 software under DO-178A would be appropriate for the control functions. However, for this level 2 category software, errors are presumed to exist, and a software error in a full authority control could result in simultaneous unacceptable malfunctions in all engines.
The provisions of § 29.1309(b)(2)(i) for continued safe flight and landing and the engine isolation rule, § 29.903(b), would generally preclude the use of this classification.
Page MG 4 - 1
AC 29-2, Chg 4 5/1/2014 (C) System designs which provide redundant distinctive software or an alternate technology control which is automatically selected and meets all of the minimum regulatory requirements would reduce the impact of software errors and may allow the level 2; i.e., essential software classification. At level 1, it is accepted that the software is sufficiently error free that the software does not require further verification in the installation evaluation.
(ii) Lightning Strike Protection. Paragraph AC 29.1309.b.(9)(iii) contains a complete discussion of an acceptable method of demonstrating that the FADEC, as installed, is adequately protected against the catastrophic effects of lightning.
(iii) Electrical Power System Considerations.
(A) Normal Operation. The system should be evaluated with all power sources operating normally. If additional power source capability is being provided that is above the minimum required for certification, a certain portion of the evaluation should be conducted while operating in the minimum configuration. The minimum power source configuration should consider the provisions of § 29.903(b).
(B) Malfunction Conditions. B eginning with the minimum configuration that is required for certification, electrical power system malfunctions should be introduced and the impact on continued FADEC operation determined.
(C) Circuit Protection Location. The circuit protective devices for the FADEC should be located in the cockpit such that they can be readily reset or replaced in flight. The operation of the FADEC system is considered to be essential to safety in flight. Reference § 29.1357(d). The definition for “essential to safety in flight” is given in AC 29.1357.b.(4).
(D) System Separation. On mu ltiengine applications, each system should be separated from the other system to the maximum extent practical. Wiring should be routed separately. Power should be taken from independent busses and grounds, and system components should be independent of one another.
(E) Periodic Checks. Where peri odic checks are appropriate, they should be made at reasonable intervals. This woul d normally range from preflight checks for certain items of greater concern to a tie-in with normal aircraft maintenance intervals for other items. If a cr ew check is specified, it should be evaluated to ensure it is a reasonable check. If items to be checked are located in an area that can be covered by interior upholstery, for example, a crew check would not be considered reasonable, and further design considerations may be in order.
(iv) Powerplant Installation Considerations.
Page MG 4 - 2
(A) A demonstration of compliance with § 29.901(c) would generally include a failure mode and effects analysis (FMEA) of the powerplant systems as installed. When a FADEC is utilized, the analysis would consider the control’s failure modes, the installed engine reaction, the effect on the aircraft, and the crew response to the situation. Combinations of undetected failures should be considered. Engine failures which may be escalated in severity by the FADEC’s response to the initial failure should be analyzed. Potentially hazardous failures should be evaluated during flight testing. The requirements of §§ 29.903(b)(2) and §§ 29.1309(b)(2)(i) should be reviewed in determining acceptability of failures.
(B) Section 29.903(b)(2), Category A engine isolation, is intended to ensure that a failure will not prevent the continued safe operation of the remaining engine(s) or require immediate action of the crew to ensure continued safe operation. The FADEC’s of the individual engines should be independent. Where communication between FADEC’s is required (for example, for torque sharing), care should be exercised to ensure that failures which may occur will not result in a power loss to the extent that total power available is less than would be available under OEI conditions. The no- required immediate-crew-action provision would preclude credit for manually selected or operated backup systems in meeting the § 29.903(b) rule. These unrequired backup systems, which may offer the advantage of get-home multiengine capability rather than forced OEI operation, would be evaluated on a no hazard basis.
(C) Section 29.939, turbine engine operating characteristics, intends a flight investigation to ensure that no adverse characteristics are present to a hazardous degree during normal and emergency operation in the allowed flight envelope. The evaluation should include assessment of the minimum FADEC system certification configuration; i.e., the minimum proposed by the applicant to meet Part 29 requirements. Reduced capabilities (e.g., restrictions on normal collective movements, limited aircraft maneuvers, etc.) may be acceptable for degraded FADEC modes or backup systems not required to meet Part 29 requirements if those degraded capabilities are reasonable and not hazardous as determined by flight evaluation. The restrictions should be specified in the flight manual.
(D) The rotorcraft with FADEC engines must of course meet all of the Part 29 requirements, but the areas described herein are those which deserve special attention.
b. SINGLE CHANNEL FULL AUTHORITY DIGITAL ENGINE CONTROLS (FADEC) IN SINGLE ENGINE ROTORCRAFT APPLICATIONS.
(1) Background. The purpose of this appendix is to provide guidance for compliance to Part 27 and Part 29 Category B regulations when the powerplant installation is a single engine fitted with a single channel FADEC system. The Page MG 4 - 3
application of single channel FADECs in single engine helicopters requires special considerations because this combination can have a higher probability of FADEC-related malfunctions that could result in loss of ability to execute a controlled power-on landing or operate safely throughout the flight envelope, relative to dual channel FADEC systems or multiengine installations. The issues that should be addressed by the applicant are criticality level of failures as determined from the engine system safety analysis (SSA), the resulting integrity requirements, capability to detect and present failure/fault data to the crew, and the ability of the crew to manage any failures/faults. The term “must” in this policy is used in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein is used.
This policy establishes an acceptable means, but not the only means of certifying a single channel FADEC for single engine application.
(2) Definitions.
(i) Fault or Failure. An occurrence which affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
(ii) Integrity. The term “integrity” for the purpose of this policy includes the hardware reliability requirements as well as the software level requirements commensurate with the system criticality.
(iii) Single Channel FADEC. A single channel FADEC system is one which provides full authority control of the engine from below ground idle to 100 percent power and in some cases from engine start similar to more complex dual channel redundant FADEC systems, but without a fully capable second channel providing a dual redundant system. The backup for the single channel FADEC is provided by a less capable channel either by hydromechanical or electronic means, usually for “get-home” purposes rather than for dispatchability.
(3) References. FAR paragraphs 29.901, 29.903, 29.927, 29.939, 29.1143,
29.1309, 29.1581.
(4) Related Documents.
(i) Federal Aviation Regulations (FARs) paragraphs 21.21, 29.1301,
33.28, 33.75
(ii) FAA Advisory Circular AC 27-1B
(iii) Standards - Latest revision of RTCA/DO-178 and RTCA/DO-160;
SAE documents
(iv) ARP4754 and ARP4761 Page MG 4 - 4
(5) Design Requirements for Compliance with FAR 29.901. FAR paragraph 29.901(b)(2) requires that each component of the installation be constructed, arranged and installed to ensure its continued safe operation between normal inspections or overhauls. FAR paragraph 29.901(c) requires that no single failure or malfunction of the powerplant control system will jeopardize the safe operation of the rotorcraft. For an engine with a single channel FADEC some form of redundancy is needed to ensure the continued safe operation of the rotorcraft in the event of a random complete failure. This redundant system must be accessible and provide the pilot with the ability to perform a controlled power-on landing. In addition, FAR paragraph 29.939(a) requires that turbine engine operating characteristics be investigated in flight. Flight tests are required as noted below to demonstrate compliance with the FAR requirements. The following paragraphs provide guidance for meeting these general design requirements.
(i) Redundancy: Because of the random nature of electrical/electronic component failures, there is no assurance that the electronic systems will operate safely between established inspection periods. Therefore, some redundancy technique should be applied to the electrical/electronic part of the FADEC system to reduce the probability of losing the ability to land safely or continue safe flight. This redundancy is usually provided by some form of backup system or alternate method of control of the engine. The requirement for a backup system can be achieved with a number of approaches that include a simple mechanical/hydromechanical system, a simple electrical/electronic system that is not a completely redundant channel, or a completely redundant system.
(ii) Availability: A means must be provided either by system design or operational procedures to ensure that the primary and the backup or alternate system are available functionally to serve the intended purpose. The manufacturer’s required interval for testing the backup or alternate system should be based on the expected failure rate established during the failure analysis of the system. However, the pilot should have the capability to test the backup system at the pilot’s discretion. Additionally, failure of the primary system must not affect the safe operation of the backup or alternate system.
(iii) Capability of back-up system: Section 29.1143 requires that each power control provide a positive and immediately responsive means of controlling its engine. Additionally, § 29.903 requires that the powerplant systems associated with engine control systems are designed to give reasonable assurance that the engine operating limitations will not be exceeded in service. Although back -up control may be somewhat degraded, the system should allow for control of the engine and the aircraft within their operating limits. It should be demonstrated that upon failure of the primary control the aircraft can continue to be operated safely and execute a controlled power-on landing without creating an undue pilot workload. This includes demonstration of the ability to maintain rotor speed within Page MG 4 - 5
acceptable limits while transitioning to the backup mode and while using the backup control.
(iv) Ability of crew to switch to back-up: If crew action is required for switching to the back-up mode, this ability must be demonstrated during all phases of flight from any seat which may be occupied by the pilot in command or the copilot. The process to be used by the pilot to switch to the back -up mode should be clearly described in the Rotorcraft Flight Manual (RFM) as required by FAR paragraph 29.1581.
(v) : The transfer to the back-up mode from the primary control mo Transfer to backup de or an intermediate mode (fixed position) must occur without excessive time delay or variation in power. Time delays and power variations experienced during the transfer should be evaluated during flight test for acceptability. A means should be provided to alert the pilot that transfer to the back-up mode has occurred.
(vi) Annunciation: Adequate annunciations should be provided to cue the crew of faults/failures and/or transfer of engine controls. These annunciations are of visual and aural types and must be distinct as to purpose and should not be misleading, especially under any fault/failure. Flight evaluation of these annunciations is required before final acceptance can be made.
(vii) Automatic Transfer: If the system is designed to accomplish automatic transfer between control modes, the transfer should occur without excessive variation in power and a means should be provided to alert the pilot that transfer to the back-up mode has occurred. Multiple automatic transfers between control modes may cause aircraft instability. A method to lockout the primary control after its initial failure and automatic transfer to the backup should be provided. If pilot reset is to be allowed, the procedure should be described in the RFM.
(viii) Calculated failure rate (with unannunciated faults present): Before a calculation of the failure rate can be attempted, the failure should be defined. The determination of failure rate, using the definition of failure, can be the product of a Failure Mode Effects Analysis (FMEA) combined with a reliability analysis, using individual part reliability figures. The figures should come from some recognized data base. The failure rate calculations should consider the worst case application limitations such as flight operation, environmental considerations, and time of operation. The flight operations to be considered for the worst case scenario include all flight segments (take off, cruise, hover, landing, etc.) together and separately for the various missions the aircraft is expected to be used in. Another way to determine failure rate is to use service history. However, service history is applicable only if a high degree of similarity exists for the FADEC and its installed application. The calculated failure rate is the direct result of the FMEA, and should Page MG 4 - 6
meet the integrity level requirement determined by the Functional Hazard Assessment.
(6) Certification Approach:
(i) Analysis Requirements: Functional Hazard Assessment:
Compliance to the requirements of FAR paragraphs 29.1141 and 29.1309 for a single channel FADEC in a single engine application should be based on criticality of application for the system under consideration. This criticality of application may be determined by performing an aircraft level hazard assessment that starts with the type of possible failures and ends with the results of these failures. The results can be categorized into criticality levels and the required integrity levels can be obtained by matching the required integrity level to the criticality level. The main emphasis should be on determining the higher levels of criticality (Major and above) and their source. This process should include consideration of failures seen at the operational level and interaction of the failures with the airframe and crew as well as the system itself. The following subject areas are related to this assessment.
(A) Assumptions: Assumptions should be made about the airframe/crew interface in order to perform the aircraft level hazard assessment.
These assumptions are prerequisites to perform an aircraft level hazard assessment and must be listed in this hazard assessment and validated by airframe testing when the airframe is available. If the assumptions cannot be validated, the actual airframe test data must be substituted for the invalidated assumptions (assumed prerequisites) and the hazard assessment re-evaluated with the new data supported prerequisites. The results of this new assessment would be the deciding factor for acceptance of the FADEC system for the installation as designed or provide the necessity for design changes.
(B) Criteria: Acceptance of an engine fitted with a single channel FADEC system in a single engine rotorcraft application requires that the integrity levels of the FADEC system be compliant with the criticality levels determined by the aircraft level Functional Hazard Assessment (FHA). In addition, final acceptance of the system at the aircraft level for the application is based on the integrity level(s) that match the criticality level(s) determined by the hazard assessment that uses data that has been validated during the aircraft flight test program. These assumptions/prerequisites would include operational aspects associated with the possible FADEC failures and would include as a minimum the following:
(1) Crew/aerodynamic response to failure.
(2) Worst case flight operation for failure to occur. (Landing, IFR, etc.)
(3) Duration of flight operation (exposure time).
Page MG 4 - 7
(4) System interaction with shared Inputs/Outputs with other systems and/or with back-up systems.
(5) Adequate annunciation of failure.
(ii) Validation Criteria:
(A) General:
(1) Validation of the assumptions/prerequisites made by the engine manufacturer in developing the SSA, using aircraft level FHA requirements, must be validated by conducting flight testing during the certification of the installation. The possibility exists that if the assumptions cannot be validated during flight testing, then engine and/or FADEC redesign may be required.
(2) Failure management methods that are related to operational characteristics should be addressed. It should be determined that the FADEC/engine manufacturer's envisioned failure management is desirable and compatible with the operational requirements. Therefore, the following basic FADEC related information should be identified:
(i) The detected failures.
(ii) The failures that are not detected.
(iii) The action that the FADEC takes when failures are detected.
(iv) The failures that are annunciated to the crew and in what manner.
(v) The anticipated operational action required as a result of detected failures.
(vi) Possible operational results of the undetected failures.
(vii) Verification that the assumed worst case flight operation is the worst case.
(B) Manual Backup: Additional aircraft operational testing is required to specifically evaluate the manual backup system for compliance with the FAR requirements. The acceptability of the manual backup system depends substantially on its installation and interface with the airframe. The following items need to be demonstrated in accordance with § 29.927 and § 29.939 or accomplished on each application prior to the acceptance of the manual backup system:
Page MG 4 - 8