CATEGORY II APPROACH EVALUATION (cont.)
INDICATE GLIDESLOPE AND LOCALIZER DISPLACEMENT AT MIDDLE MARKER AND 100 FT. A.G. POINT MIDDLE MARKER 100 FT. A. G.
INDICATE AIRPLANE DISPLACEMENT & ORIENTATION WITH
RESPECT TO RUNWAY CENTERLINE AT MIDDLE MARKER AND 100 FT. A.G. BY SYMBOL AT AIRPORTS AND RUNWAYS LISTED
THRESHOLD SAMPLE
•RUNWAY WIDTHS 1 0.5l 10.5 11.0 11.5 100 FT. A.G.
MIDDLE REMARKS:
MARKER
CL OF RUNWAY EXTENDED
TOUCHDOWN WAS FEET FROM THRESHOLD AND
FEET LEFT RIGHT OF CENTERLINE FIGURE AC 29. MG 3-2 Page MG 3 - 6
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 4 FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC)
a. FULL AUTHORITY DIGITAL ELECTRONIC CONTROLS (FADEC) FOR INSTALLATIONS WITH CATEGORY A ENGINE ISOLATION.
(1) Background. The advent of “microprocessor technology” has resulted in rotorcraft engine controls being implemented by digital process control rather than by conventional means. These digital, processor-based full authority engine controls offer many performance advantages (such as isochronous governing) which were not feasible with conventional technology, pneumatic or hydromechanical controls.
Because of the incorporation of this advanced technology, some additional considerations must be made of the engine installation to ensure regulatory compliance.
(2) Requirements. T he following is a discussion of some special attention areas for a Part 29 Category A FADEC engine installation. Paragraph AC 29.1309.b.(9)(iii)(A)(4) contains a general definition of what constitutes a “full authority” control.
(i) Software Qualifications.
(A) Paragraph AC 29.1309.b.(7) contains a general discussion on the use of the RTCA/DO-178B document that is used for the approval of system software.
FADECs are generally developed to Level A software under RTCA document DO 178B based on the hazard category of the FADEC failure condition(s). However, if an applicant proposes a FADEC with Level B software based on the Functional Hazard Assessment results, this will require the proposal to be reviewed and approved by both the Engine Directorate and the Rotorcraft Directorate.
(B) RTCA/DO-178A may still be applicable for those FADECs that were previously developed and approved under DO-178A and the applicant is proposing to make changes to the FADEC software. Howe ver, if the applicant proposes to make changes to a DO-178A approved FADEC, the determination on whether the changes should be made under DO-178B or DO-178A will need to be made by the Engine Directorate and Rotorcraft Directorate. When utilizing DO-178A, one might arrive at the conclusion that the engine control, as a required function, is essential; therefore, level 2 software under DO-178A would be appropriate for the control functions. However, for this level 2 category software, errors are presumed to exist, and a software error in a full authority control could result in simultaneous unacceptable malfunctions in all engines.
The provisions of § 29.1309(b)(2)(i) for continued safe flight and landing and the engine isolation rule, § 29.903(b), would generally preclude the use of this classification.
Page MG 4 - 1
AC 29-2, Chg 4 5/1/2014 (C) System designs which provide redundant distinctive software or an alternate technology control which is automatically selected and meets all of the minimum regulatory requirements would reduce the impact of software errors and may allow the level 2; i.e., essential software classification. At level 1, it is accepted that the software is sufficiently error free that the software does not require further verification in the installation evaluation.
(ii) Lightning Strike Protection. Paragraph AC 29.1309.b.(9)(iii) contains a complete discussion of an acceptable method of demonstrating that the FADEC, as installed, is adequately protected against the catastrophic effects of lightning.
(iii) Electrical Power System Considerations.
(A) Normal Operation. The system should be evaluated with all power sources operating normally. If additional power source capability is being provided that is above the minimum required for certification, a certain portion of the evaluation should be conducted while operating in the minimum configuration. The minimum power source configuration should consider the provisions of § 29.903(b).
(B) Malfunction Conditions. B eginning with the minimum configuration that is required for certification, electrical power system malfunctions should be introduced and the impact on continued FADEC operation determined.
(C) Circuit Protection Location. The circuit protective devices for the FADEC should be located in the cockpit such that they can be readily reset or replaced in flight. The operation of the FADEC system is considered to be essential to safety in flight. Reference § 29.1357(d). The definition for “essential to safety in flight” is given in AC 29.1357.b.(4).
(D) System Separation. On mu ltiengine applications, each system should be separated from the other system to the maximum extent practical. Wiring should be routed separately. Power should be taken from independent busses and grounds, and system components should be independent of one another.
(E) Periodic Checks. Where peri odic checks are appropriate, they should be made at reasonable intervals. This woul d normally range from preflight checks for certain items of greater concern to a tie-in with normal aircraft maintenance intervals for other items. If a cr ew check is specified, it should be evaluated to ensure it is a reasonable check. If items to be checked are located in an area that can be covered by interior upholstery, for example, a crew check would not be considered reasonable, and further design considerations may be in order.
(iv) Powerplant Installation Considerations.
Page MG 4 - 2
(A) A demonstration of compliance with § 29.901(c) would generally include a failure mode and effects analysis (FMEA) of the powerplant systems as installed. When a FADEC is utilized, the analysis would consider the control’s failure modes, the installed engine reaction, the effect on the aircraft, and the crew response to the situation. Combinations of undetected failures should be considered. Engine failures which may be escalated in severity by the FADEC’s response to the initial failure should be analyzed. Potentially hazardous failures should be evaluated during flight testing. The requirements of §§ 29.903(b)(2) and §§ 29.1309(b)(2)(i) should be reviewed in determining acceptability of failures.
(B) Section 29.903(b)(2), Category A engine isolation, is intended to ensure that a failure will not prevent the continued safe operation of the remaining engine(s) or require immediate action of the crew to ensure continued safe operation. The FADEC’s of the individual engines should be independent. Where communication between FADEC’s is required (for example, for torque sharing), care should be exercised to ensure that failures which may occur will not result in a power loss to the extent that total power available is less than would be available under OEI conditions. The no- required immediate-crew-action provision would preclude credit for manually selected or operated backup systems in meeting the § 29.903(b) rule. These unrequired backup systems, which may offer the advantage of get-home multiengine capability rather than forced OEI operation, would be evaluated on a no hazard basis.
(C) Section 29.939, turbine engine operating characteristics, intends a flight investigation to ensure that no adverse characteristics are present to a hazardous degree during normal and emergency operation in the allowed flight envelope. The evaluation should include assessment of the minimum FADEC system certification configuration; i.e., the minimum proposed by the applicant to meet Part 29 requirements. Reduced capabilities (e.g., restrictions on normal collective movements, limited aircraft maneuvers, etc.) may be acceptable for degraded FADEC modes or backup systems not required to meet Part 29 requirements if those degraded capabilities are reasonable and not hazardous as determined by flight evaluation. The restrictions should be specified in the flight manual.
(D) The rotorcraft with FADEC engines must of course meet all of the Part 29 requirements, but the areas described herein are those which deserve special attention.
b. SINGLE CHANNEL FULL AUTHORITY DIGITAL ENGINE CONTROLS (FADEC) IN SINGLE ENGINE ROTORCRAFT APPLICATIONS.
(1) Background. The purpose of this appendix is to provide guidance for compliance to Part 27 and Part 29 Category B regulations when the powerplant installation is a single engine fitted with a single channel FADEC system. The Page MG 4 - 3
application of single channel FADECs in single engine helicopters requires special considerations because this combination can have a higher probability of FADEC-related malfunctions that could result in loss of ability to execute a controlled power-on landing or operate safely throughout the flight envelope, relative to dual channel FADEC systems or multiengine installations. The issues that should be addressed by the applicant are criticality level of failures as determined from the engine system safety analysis (SSA), the resulting integrity requirements, capability to detect and present failure/fault data to the crew, and the ability of the crew to manage any failures/faults. The term “must” in this policy is used in the sense of ensuring the applicability of these particular methods of compliance when the acceptable means of compliance described herein is used.
This policy establishes an acceptable means, but not the only means of certifying a single channel FADEC for single engine application.
(2) Definitions.
(i) Fault or Failure. An occurrence which affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
(ii) Integrity. The term “integrity” for the purpose of this policy includes the hardware reliability requirements as well as the software level requirements commensurate with the system criticality.
(iii) Single Channel FADEC. A single channel FADEC system is one which provides full authority control of the engine from below ground idle to 100 percent power and in some cases from engine start similar to more complex dual channel redundant FADEC systems, but without a fully capable second channel providing a dual redundant system. The backup for the single channel FADEC is provided by a less capable channel either by hydromechanical or electronic means, usually for “get-home” purposes rather than for dispatchability.
(3) References. FAR paragraphs 29.901, 29.903, 29.927, 29.939, 29.1143,
29.1309, 29.1581.
(4) Related Documents.
(i) Federal Aviation Regulations (FARs) paragraphs 21.21, 29.1301,
33.28, 33.75
(ii) FAA Advisory Circular AC 27-1B
(iii) Standards - Latest revision of RTCA/DO-178 and RTCA/DO-160;
SAE documents
(iv) ARP4754 and ARP4761 Page MG 4 - 4
(5) Design Requirements for Compliance with FAR 29.901. FAR paragraph 29.901(b)(2) requires that each component of the installation be constructed, arranged and installed to ensure its continued safe operation between normal inspections or overhauls. FAR paragraph 29.901(c) requires that no single failure or malfunction of the powerplant control system will jeopardize the safe operation of the rotorcraft. For an engine with a single channel FADEC some form of redundancy is needed to ensure the continued safe operation of the rotorcraft in the event of a random complete failure. This redundant system must be accessible and provide the pilot with the ability to perform a controlled power-on landing. In addition, FAR paragraph 29.939(a) requires that turbine engine operating characteristics be investigated in flight. Flight tests are required as noted below to demonstrate compliance with the FAR requirements. The following paragraphs provide guidance for meeting these general design requirements.
(i) Redundancy: Because of the random nature of electrical/electronic component failures, there is no assurance that the electronic systems will operate safely between established inspection periods. Therefore, some redundancy technique should be applied to the electrical/electronic part of the FADEC system to reduce the probability of losing the ability to land safely or continue safe flight. This redundancy is usually provided by some form of backup system or alternate method of control of the engine. The requirement for a backup system can be achieved with a number of approaches that include a simple mechanical/hydromechanical system, a simple electrical/electronic system that is not a completely redundant channel, or a completely redundant system.
(ii) Availability: A means must be provided either by system design or operational procedures to ensure that the primary and the backup or alternate system are available functionally to serve the intended purpose. The manufacturer’s required interval for testing the backup or alternate system should be based on the expected failure rate established during the failure analysis of the system. However, the pilot should have the capability to test the backup system at the pilot’s discretion. Additionally, failure of the primary system must not affect the safe operation of the backup or alternate system.
(iii) Capability of back-up system: Section 29.1143 requires that each power control provide a positive and immediately responsive means of controlling its engine. Additionally, § 29.903 requires that the powerplant systems associated with engine control systems are designed to give reasonable assurance that the engine operating limitations will not be exceeded in service. Although back -up control may be somewhat degraded, the system should allow for control of the engine and the aircraft within their operating limits. It should be demonstrated that upon failure of the primary control the aircraft can continue to be operated safely and execute a controlled power-on landing without creating an undue pilot workload. This includes demonstration of the ability to maintain rotor speed within Page MG 4 - 5
acceptable limits while transitioning to the backup mode and while using the backup control.
(iv) Ability of crew to switch to back-up: If crew action is required for switching to the back-up mode, this ability must be demonstrated during all phases of flight from any seat which may be occupied by the pilot in command or the copilot. The process to be used by the pilot to switch to the back -up mode should be clearly described in the Rotorcraft Flight Manual (RFM) as required by FAR paragraph 29.1581.
(v) : The transfer to the back-up mode from the primary control mo Transfer to backup de or an intermediate mode (fixed position) must occur without excessive time delay or variation in power. Time delays and power variations experienced during the transfer should be evaluated during flight test for acceptability. A means should be provided to alert the pilot that transfer to the back-up mode has occurred.
(vi) Annunciation: Adequate annunciations should be provided to cue the crew of faults/failures and/or transfer of engine controls. These annunciations are of visual and aural types and must be distinct as to purpose and should not be misleading, especially under any fault/failure. Flight evaluation of these annunciations is required before final acceptance can be made.
(vii) Automatic Transfer: If the system is designed to accomplish automatic transfer between control modes, the transfer should occur without excessive variation in power and a means should be provided to alert the pilot that transfer to the back-up mode has occurred. Multiple automatic transfers between control modes may cause aircraft instability. A method to lockout the primary control after its initial failure and automatic transfer to the backup should be provided. If pilot reset is to be allowed, the procedure should be described in the RFM.
(viii) Calculated failure rate (with unannunciated faults present): Before a calculation of the failure rate can be attempted, the failure should be defined. The determination of failure rate, using the definition of failure, can be the product of a Failure Mode Effects Analysis (FMEA) combined with a reliability analysis, using individual part reliability figures. The figures should come from some recognized data base. The failure rate calculations should consider the worst case application limitations such as flight operation, environmental considerations, and time of operation. The flight operations to be considered for the worst case scenario include all flight segments (take off, cruise, hover, landing, etc.) together and separately for the various missions the aircraft is expected to be used in. Another way to determine failure rate is to use service history. However, service history is applicable only if a high degree of similarity exists for the FADEC and its installed application. The calculated failure rate is the direct result of the FMEA, and should Page MG 4 - 6
meet the integrity level requirement determined by the Functional Hazard Assessment.
(6) Certification Approach:
(i) Analysis Requirements: Functional Hazard Assessment:
Compliance to the requirements of FAR paragraphs 29.1141 and 29.1309 for a single channel FADEC in a single engine application should be based on criticality of application for the system under consideration. This criticality of application may be determined by performing an aircraft level hazard assessment that starts with the type of possible failures and ends with the results of these failures. The results can be categorized into criticality levels and the required integrity levels can be obtained by matching the required integrity level to the criticality level. The main emphasis should be on determining the higher levels of criticality (Major and above) and their source. This process should include consideration of failures seen at the operational level and interaction of the failures with the airframe and crew as well as the system itself. The following subject areas are related to this assessment.
(A) Assumptions: Assumptions should be made about the airframe/crew interface in order to perform the aircraft level hazard assessment.
These assumptions are prerequisites to perform an aircraft level hazard assessment and must be listed in this hazard assessment and validated by airframe testing when the airframe is available. If the assumptions cannot be validated, the actual airframe test data must be substituted for the invalidated assumptions (assumed prerequisites) and the hazard assessment re-evaluated with the new data supported prerequisites. The results of this new assessment would be the deciding factor for acceptance of the FADEC system for the installation as designed or provide the necessity for design changes.
(B) Criteria: Acceptance of an engine fitted with a single channel FADEC system in a single engine rotorcraft application requires that the integrity levels of the FADEC system be compliant with the criticality levels determined by the aircraft level Functional Hazard Assessment (FHA). In addition, final acceptance of the system at the aircraft level for the application is based on the integrity level(s) that match the criticality level(s) determined by the hazard assessment that uses data that has been validated during the aircraft flight test program. These assumptions/prerequisites would include operational aspects associated with the possible FADEC failures and would include as a minimum the following:
(1) Crew/aerodynamic response to failure.
(2) Worst case flight operation for failure to occur. (Landing, IFR, etc.)
(3) Duration of flight operation (exposure time).
Page MG 4 - 7
(4) System interaction with shared Inputs/Outputs with other systems and/or with back-up systems.
(5) Adequate annunciation of failure.
(ii) Validation Criteria:
(A) General:
(1) Validation of the assumptions/prerequisites made by the engine manufacturer in developing the SSA, using aircraft level FHA requirements, must be validated by conducting flight testing during the certification of the installation. The possibility exists that if the assumptions cannot be validated during flight testing, then engine and/or FADEC redesign may be required.
(2) Failure management methods that are related to operational characteristics should be addressed. It should be determined that the FADEC/engine manufacturer's envisioned failure management is desirable and compatible with the operational requirements. Therefore, the following basic FADEC related information should be identified:
(i) The detected failures.
(ii) The failures that are not detected.
(iii) The action that the FADEC takes when failures are detected.
(iv) The failures that are annunciated to the crew and in what manner.
(v) The anticipated operational action required as a result of detected failures.
(vi) Possible operational results of the undetected failures.
(vii) Verification that the assumed worst case flight operation is the worst case.
(B) Manual Backup: Additional aircraft operational testing is required to specifically evaluate the manual backup system for compliance with the FAR requirements. The acceptability of the manual backup system depends substantially on its installation and interface with the airframe. The following items need to be demonstrated in accordance with § 29.927 and § 29.939 or accomplished on each application prior to the acceptance of the manual backup system:
Page MG 4 - 8
(1) It should be demonstrated by flight test with the failure of the primary engine control, that the aircraft can be flown and a safe and controlled power-on landing executed without creating an undue pilot workload.
(2) It should be demonstrated by flight test that switching between control modes will not create an unsafe condition during any phase of operation within the aircraft operating envelope.
(3) The pilot action required as a result of a failure of the primary control and used as an assumption in the FHA and FMEA should be validated during flight tests and listed in the emergency procedures section of the flight manual.
c. FADEC RELIABILITY REVIEW DUE TO INCREASED ROTORCRAFT
ENDURANCE
(1) Background. This advisory material is to provide guidance for reevaluation of the FADEC control system reliability due to extension of the aircraft mission endurance. During the initial type certification of an aircraft, an analysis is normally conducted on systems to determine their criticality category (e.g.
catastrophic, hazardous, major, etc.) and reliability requirements. To establish a system’s reliability, an exposure time is determined by making certain assumptions.
In most cases, the exposure time is the average endurance based on the various flight scenarios in which the aircraft is to be used. When an aircraft’s expected mission endurance is increased by adding fuel capacity, a new analysis for system reliability should be conducted taking into account the new increased mission endurance.
(2) Requirements.
(i) If the applicant has access to the initial analysis used for the type certification, one method to accomplish the new reliability analysis is by multiplying the exposure time used in the original reliability analysis by the ratio of the increased maximum endurance to the original maximum endurance. That is, if the aircraft endurance increases by 50 percent due to additional fuel capacity, the assumed exposure time should also increase by 50 percent. The applicant should then rework the analysis using this new exposure time.
(ii) If the applicant does not have access to the initial analysis it will be incumbent upon them to provide the rationale used for determining the new exposure time and to provide a complete analysis for the systems determined to be critical. The FAA engineer should compare this new analysis to the original.
Page MG 4 - 9
d. CERTIFICATION GUIDELINES FOR COMPLIANCE TO THE
REQUIREMENTS FOR ELECTROMAGNETIC COMPATIBILITY (EMC) TESTING FOR
NON-QUALIFIED EQUIPMENT AND EQUIPMENT KNOWN TO HAVE A HIGH
POTENTIAL FOR INTERFERENCE WHEN INSTALLED ON ROTORCRAFT WITH ELECTRONIC CONTROLS THAT PROVIDE CRITICAL FUNCTIONS.
(1) Background.
(i) Rotorcraft operations are varied and use a wide assortment of equipment. While some of this equipment is qualified to aircraft standards, particularly environmental standards, some of the equipment not qualified to such standards may be the source of harmful electromagnetic interference. Rotorcraft typically have not had electronic controls that perform critical functions, such as engine controls and flight controls; therefore, there was no real concern about requiring equipment to be qualified to aircraft standards. Typically, this equipment was installed with only a cross-matrix operational check for EMC. These tests consisted of operating the equipment in question and checking visually for an indication of interference. The equipment was, for the most part, non-required equipment and the primary concern was that interference might be emitted from the equipment.
(ii) Many more recent rotorcraft designs are using electronic engine controls, and fly-by-wire may be implemented in the near future, thus unqualified
equipment and their effects on critical aircraft systems are a particular concern.
(ii) Unqualified equipment and their effects on critical systems is of particular concern due to the recent increase in the number of rotorcraft with electronic engine controls and the implementation of fly-by-wire technology. Additionally, the physical close proximity of installed equipment to electronic controls that provide critical functions is inherent due to the smaller size of most rotorcraft and represents a greater potential for interference than for larger fixed wing aircraft.
(2) Requirements.
(i) The rules to assure that required functions are not subject to interference are provided in the certification basis for the rotorcraft. Although the certification basis may differ between aircraft, the requirements that address electromagnetic interference are similar and result in the same methods for compliance. A note has been added to the type certificate data sheets for rotorcraft that employ FADECs. This note was added to remind all modifiers that the requirement for addressing interference exists and that special EMI test considerations must be addressed to show compliance. Most EMC considerations can be addressed by the operational interference checks addressed in the background discussion. However, when a critical control function is provided by some electronic means, special EMI test considerations must also be addressed, in addition to the previously described EMC tests. The determination of when these other, more rigorous tests are required is a simple concept, but complex in practice. More rigorous testing is required to satisfy the concern for the installation of equipment that would Page MG 4 - 10
interfere with the critical control (e.g., FADEC, Fly-By-Wire, etc.) or failure management of the critical control. This class of equipment is “equipment known to have a potential for interference,” which may or may not be qualified to an aircraft high frequency (HF) radios, high powered radars, hoists, transmitting antennas located near the controls systems, etc. The concern associated with this class of equipment is the possible interference with the critical electronic controls.
(ii) Accomplishment. In addition to the following special testing considerations addressed in paragraph (2)(iii), “EMI Installation Testing for Critical Controls” and “Installation Test Conditions,” all installed equipment should undergo a cross-matrix operational check for EMC considerations by operating all equipment under consideration and determining if an interference hazard is created.
(A) Class of Equipment - Equipment Known to Have a High Potential for Interference: This class of equipment should be tested in the installation as described in the “EMI Installation Testing for Critical Controls/Installation Test Conditions,” paragraph (2)(iii). Since the concern of this class of equipment is its high potential for interference, its EMI laboratory qualification does not preclude the EMI installation testing.
Equipment that meets any one of the following criteria is considered to be “equipment known to have a high potential for interference.”
• Equipment that requires 25 amps or more to operate,
• Equipment that transmits 30 watts or more,
• Equipment with an antenna located 0.5 meters or less from the FADEC, or
• High Frequency (HF) Transmitters of any power.
The types of equipment in this class include HF radios, high-powered radars, hoists, high-powered radios, installations where radio transmission antennas are in close proximity to the controls, and equipment that require large currents to operate or radiate strong electromagnetic fields. Examples of this type of equipment are some Emergency Medical Service (EMS) equipment, night sun lights, some air conditioners, video and sound systems that require large currents (25 amps – up) to operate, Forward Looking Infrared System (FLIRS), some forward looking radars, some weather radars, some communication systems that transmit 30 watts or more, some data link transmission systems, etc.
NOTE: Equipment that does not meet this criteria is considered to be “equipment not known to have a high potential for interference.”
(B) Class of Equipment – Equipment Not Known to Have a High Potential for Interference: Once it has been established that the equipment being Page MG 4 - 11