29-2C, Chg 1 2/12/03 (A) This method depends on replacement rather than inspection to ensure the continued airworthiness of a PSE. The replacement time is established based on consideration of crack growth characteristics.
(B) To substantiate a structure in the no/benign crack growth category requires demonstration either by analysis, testing, or both, that the rogue crack (aR), which is the most severe crack consistent with manufacturing, maintenance and service environment, will not grow or will not grow to critical size (aCRIT) under the service loading and environment before the structure is replaced. The crack should be assumed at the critical location, as defined by the largest stress intensity factor range under the expected service loading range including the ground–air–ground cycle.
(C) To determine the replacement time, the rogue cracks should be assumed at the critical location and the crack growth characteristics should be determined for the expected load/environment spectrum. There are three different scenarios that could result from a crack growth assessment and be used for establishing a replacement time. These scenarios are illustrated in Figures AC 29.MG 11-3, -4 and –5.
(D) The no crack growth scenario is illustrated in Figure AC.29.MG 11-3.
In this figure, the rogue flaw does not grow or growth is insignificant. In this case the replacement time should not exceed the design service life (LDES).
Page MG 11 - 16
a
CRA CK S IZ E R
LDES TIME
(E) Figure AC 29.M G 11-4 illustrates the scenario where the rogue crack grows relatively slowly but becomes critical prior to becoming detectable (aDET). In this case the replacement time should be set equal to the total crack growth life (LT) divided by a factor N.
CRA CK S IZ E a DE T L T a CRI T a R TIME Page MG 11 - 17
29-2C, Chg 1 2/12/03 (F) Figure AC 29.MG 11-5 illustrates the scenario where the rogue crack grows to a detectable size (at L1) before becoming critical (at L1+L2). In this case the replacement time should be set equal to the total crack growth life (L1+L2) divided by a factor N.
CRA CK S IZ E a R a DE T a CRI T L 1 L 2 TIME Page MG 11 - 18
(G) In determining the factor of N to be used for determining the replacement time, consideration should be given to the crack growth data used (e.g., top of scatter data versus average data, number of specimens used to generate data, etc.).
(H) The minimum suggested N value should be (1) N=2 in the case where the conservative top-of-scatter crack growth data are used in the crack growth analysis, or (2) N=4 when the average crack growth data are used in the crack growth analysis, or when the crack growth life is obtained from the crack growth test of one specimen (for two or more full scale specimens, N=3 of the shortest crack growth life can be used).
(I) It should also be noted that, in the no/benign crack growth category, the validity of the crack growth threshold, ∆KITH, is especially important since there is no element of inspection to ensure continued airworthiness. Consistent with this, additional attention may be required relative to validating the crack growth threshold value(s) used in the analyses. Consideration should be given to the influence of the test procedure used to develop values, microstructure, heat treatment, crack size, loading conditions, environment, grain size and orientation, etc. In general a coupon testing program may be necessary to develop a consistent ∆KITH data base and the use of bibliographic data might require additional conservatism.
(viii) Testing of Principal Structural Elements.
(A) The nature and extent of tests on complete structures or on portions of the primary structure will depend upon applicable previous design, construction, tests, and service experience in connection with similar structures. For fail -safe testing considering crack propagation, simulated cracks should be as representative as possible of actual fatigue damage. Where it is not practical to produce actual fatigue cracks, flaws can be simulated by cuts made with a fine saw, sharp blade, guillotine, Electrical Discharge Machine, or other suitable means. The validity of saw cuts, etc., should be verified by comparison to coupon tests of a cracked specimen of the same material. In those cases where bolt failure, or its equivalent, is to be simulated as part of a possible flaw configuration in joints or fittings, bolts can be removed to provide that part of the simulation.
(B) Other test and inspection programs may be used if shown to have comparable or better probability of assuring that a catastrophic fatigue failure will not occur.
(ix) Analytical Evaluation The fail safe characteristics can also be shown analytically, by reliable and conservative methods, by demonstrating that the repeated loads and limit load stresses do not exceed those of previously verified fail safe designs of similar configuration, materials, and inspectability. Analytical models should be properly validated to assure that:
Page MG 11 - 19
29-2C, Chg 1 2/12/03 (A) Stress analysis is sufficiently accurate. This can be achieved by similarity with full scale strain surveys, thermography, or other suitable testing approaches.
(B) Fracture mechanics is properly applied.
(C) Load interaction models are verified for the specific load histories.
(D) Consistent material data base is used.
(x) Inspection plan. Detection of flaws before they become dangerous is the ultimate control in ensuring the flaw tolerance characteristics of the structure.
Therefore, the applicant should provide sufficient guidance information to assist operators in establishing the frequency, extent, and methods of inspection of the critical structure, and this kind of information should, under § 29.571(a)(2), be included in the maintenance manual required by § 29.1529. Due to the inherent, complex interactions of the many parameters affecting flaw tolerance, such as operating practices, environmental effects, load sequence on flaw growth, and variations in inspection methods, related operational experience should be taken into account in establishing inspection procedures. Comparative analysis can be used to guide the changes from successful past practice, when necessary. Therefore, maintenance and inspection requirements should recognize the dependence on experience and should be specified in a document that provides for revision as a result of operational experience, such as the one containing the operator’s FAA/AUTHORITY-approved structural inspection program developed through the Maintenance Review Board (MRB) procedures for FAR Part 121 operators.
(4) Safe-Life Demonstration
(i) Information to guide fatigue evaluation based on the safe-life approach is described in details in AC 27-1B MG 11. The safe- life approach is used when both the fail-safe and flaw-tolerant safe-life methods are verified to be impractical due to considerations of inspectability, geometry, or good design practice as described above in paragraph d(2).
(ii) The safe-life approach may not account for flaws and imperfections due to manufacturing and in service conditions as compared to the flaw tolerant approaches. Therefore, conservative factors that adjust for variations in both load and strength are generally utilized when substantiating by the safe-life method.
(5) Combining Methods.
(i) Components may be managed by a retirement time based on the Flaw Tolerant Safe-Life method, paragraph g(2); by an inspection program based on the Fail-Safe method, paragraph g(3); or, if approved, a retirement time based on conventional Safe Life, paragraph g(4). In some cases it may be appropriate to Page MG 11 - 20
establish a retirement time based on the lowest from several methods, and in some cases it may be appropriate to establish both a retirement time and an inspection program for a given structure.
(ii) Retirement Times. The conventional Safe- Life retirement time determined from as-manufactured parts and conventional working curves may be lower than that determined from a Flaw Tolerant Safe-Life evaluation. In this event, the lower of the two retirement times should be used. Additionally, inspection intervals resulting from a Fail-Safe evaluation may be used as retirement times if practical, which removes the need to conduct that specific inspection. In this event, the conventional safe life retirement time should be used if lower.
Page MG 11 - 21
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 12. § 29.865 (Amendment 29-43) EXTERNAL LOADS.
This AC MG paragraph material is now contained in AC 29.865B, in Subpart D.
AC Page MG 12 - 1
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 13. SYSTEMS CERTIF ICATION CONSIDERATIONS.
a. Supporting Systems.
(1) Purpose Definitions.
. The purpose of this AC paragraph is to provide guidance on how to show compliance to Part 29 regulations as they apply to supporting systems for other systems that provide required functions. The applicability of this material to “systems” is defined by AC 29.1309.a.(1). The system s that require support from supporting systems are defined as dependent systems in the following guidance. Application of recent technology is one of the predominant causes of more dependent/supporting systems relationships. More systems are employing technology that is dependent on supporting systems such as electrical, hydraulic, and/or other power sources or signal inputs. Certification of systems that are dependent on supporting systems to provide required functionality must consider the issues associated with this interdependent relationship.
(2)
(i) Integrity. The term “integrit y” for the purpose of this AC paragraph includes the hardware quality requirements, including reliability (availability); as well as the software level requirements, as defined in RTCA/DO-178B.
(ii) Criticality. The term “criticality” refers to the five levels of criticality addressed in this document in paragraph AC 29.1309.b.(1).
(iii) Supporting System(s). The term “supporting system(s)” as used in this paragraph means any system(s) that provides an input to another “dependent” system, such that these dependent system(s) cannot function correctly without that input being present/correct.
(iv) Dependent System(s). The term “dependent system(s)” as used in this paragraph means any system/s that receives an input from another system or sensor.
(3) Related Documents.
(i) Federal Aviation Regulations (FARs) Paragraphs 29.1301, 29.1309,
29.1351, and 29.1435.
(ii) Standards - Latest revision of RTCA/DO178 and RTCA/DO 160; Parts of SAE documents ARP4754 and ARP4761.
Page MG 13 - 1
AC 29-2C, Chg 1 2/12/03
(4) History: Applications of recent technology for systems have, in many cases, resulted in systems that are dependent on one or more supporting system(s) for inputs such as power or signal sources of any type. This relationship creates concerns for recognition that the criticality of the supporting system may be higher because of its role of supporting a dependent system of high criticality. The example of Liquid Crystal Displays (LCD) for engine instruments, in particular, has caused concern about the integrity of the supporting electrical power system. Pa st designs for engine instruments did not require electrical power for operation, but present designs with LCDs do require electrical power. Additionally, engine inst ruments of those older helicopter designs were driven from a mixture of sources such as independent wet line, pneumatic, and electrical drive (Tach Generator) inputs, and thus had independent failure modes from the sensor/power input aspect(s). This means that the integrity of the electrical power supplied to the dependent system must be commensurate withthe level of integrity as required for the highest criticality engine instrument application(s). This also stimulates the concern that the electrical power system can become a common point for failure of all engine instruments simultaneously, as well as anything else powered by the electrical system. For this example, t hese considerations represent an increase of integrity requirements for the electrical power system over previous designs of electrical systems for VFR helicopters. In the past, these electrical systems did not support required functions of higher criticality and were allowed to be simple in design with low design integrity and susceptible to single point faults. Application of recent technologies for systems resulting in dependent systems that require supporting systems must address the concerns for higher integrity and single point faults.
(5) : Integrity of supporti ng systems must be sufficient to support the required integ Discussion rity of their associated dependent systems. The relationship of supporting systems to dependent systems is similar to an analogy of them being links in a chain, where the weakest link must be able to support the required integrity level that is consistent with the associated criticality category assessment. This principle is not new, but there may not be recognition that systems previously accepted at low integrity levels may not be acceptable because of their new role as supporting system(s). New emphasis must be applied to determine acceptability of previous designs that have become supporting systems through application of new technology or changes of system architecture. This is particularl y true for derivative designs, or changes to existing design by either supplemental type certificate (STC) or field approval, where new technology system applications, or system architecture changes have been applied, that created a dependent/supporting system relationship. The main concerns are for systems such as electronic displays that are installed and supported by nonupgraded systems, such as single source and/or low reliability power generation and distribution systems. However the concerns related to supporting systems are not limited to displays for dependent systems, since control systems could also be affected.
Integrity for fault considerations must be addressed for supporting systems in relation to dependent systems when the dependent system’s provided functions are assessed at criticality levels of Major, Hazardous/Severe-Major, or Catastrophic. These integrity and fault considerations must address not only a particular dependent system, but also the Page MG 13 - 2
accumulative effect on other systems that the same supporting system’s malfunction may affect. This may, in turn, affect the aircraft level functional hazard assessment (FHA) as the supporting system could act as a common point for simultaneous failures of more than one system. Additionally, the design of the supporting systems should preclude single point failures/faults for systems that support dependent systems functions assessed to have a criticality of Catastrophic.
(6) Certification Approach. There are three basic parts to the supporting systems concerns addressed herein and they are the inclusion of supporting systems in the integrity determination process, the design considerations for supporting systems relating to more than one system, and single point faults for the supporting systems themselves.
(i) A two-step procedure should be used to determine the adequate integrity level for supporting systems. The first step is to determine the level of criticality associated with loss/malfunction of all or any combination of the dependent system’s functions and all combinations of other dependent system’s functions that require support from the same supporting system. This can be achieved through the use of an FHA and associated FTA’s. The criticality category level determined from this assessment must be a product of failure/malfunction possibilities for all of the involved dependent/supporting systems combinations and the worst case operational consideration for the function(s) provided by the dependent systems. The second step is to determine whether the supporting system’s design integrity is sufficient to address the determined criticality category. The design integrity should address failures/malfunctions results of the dependent system(s), any combination of failures/malfunctions due to effects on more than one dependent system, and single point failures of the supporting system itself.
(ii) Analyses may be used to meet the criteria outlined in the second step above, for systems that support one or more dependent system functions whose loss or malfunction is assessed to be Hazardous/Severe-Major or Catastrophic. Analyses, such as a fault tree analysis, in combination with a common cause analysis to validate assumptions regarding the independence of faults, should be performed to show compliance. Testing may be required to validate the analysis, if the system is complex or dynamic in nature.
NOTE: Showing high reliability for a single thread system is not sufficient to meet the requirements for a Catastrophic failure condition category, thus reliability cannot be used to substitute for the preclusion of single point failures/faults.
(7) Summary: Supporting systems should be considered an integral part of the dependent system(s) that provides the required functions, for the purpose of addressing design integrity requirements.
b. Complex System Integration.
Page MG 13 - 3
AC 29-2C, Chg 1 2/12/03
(1) Explanation. Complex integrated systems addressed by this paragraph are those systems that provide more than one function from a single electronic device or from more than one inter-related electronic devices/components. The inter -relationship is based on common aspect(s) of providing the functions. The definition of complexity as it applies to integrated systems, is a design condition that exhibits the characteristic of possible combinations of simultaneous failures/faults, as opposed to simple systems where there exists only failures/faults that can be considered individually. Integration that results in providing several functions from one design source inherently increases complexity, thus the two describing terms of “complex” and “integrated” are not independent from one another. Computers have become more powerful with recent increases in technology. Also, related sensors and servomechanisms have greatly improved. This has created an atmosphere from which complex integrated systems have spawned. Integrated systems can have the effects of reduced weight, economic advantages, and system enhancements. However, with these advantages there are some concerns that must be addressed, as this concept inherently creates problems with showing compliance to system independence requirements.
(2) Procedure.
(i) Integrated Systems typically compromise the concept of independence for failures/malfunctions and system/function separation. Using this as a given, the approach for showing compliance for systems that have a requirement for independence is to provide elevated system integrity to make up for the loss of independence. The requirements for independence are both direct and inferred. The direct requirements are defined by requirements for system separation and for specific systems. The inferred requirements for independence are those that inherently have independence by their method of implementation until integration of dissimilar functions by recent technology. They are inferred since past methods of implementation provided independence and therefore no direct requirement was defined.
(ii) The elevated integrity typically consists of high software levels and high system reliability that addresses the failure condition categories determined by a Functional Hazard Assessment (FHA). This approach basically states that the independence for failures and function separation is absent, but the probability is small for loss or malfunction, and the software level will match the threat level identified by the FHA. Provided the integrity is a reality, this approach works pretty well for the loss and malfunction aspects. However, system separation requirements may not be satisfied as easily, as they are mostly concerned with common mode failures from external sources.
Some common mode concerns are temperature, fire, water, EMI, and physical mechanical threats.
(iii) The combinations of systems/functions that comprise a single integrated system are important. If any of the systems or combinations of systems that make up the composite integrated system are assessed to have a high criticality level, then the design integrity of the composite integrated system should match the highest of those assessments. In infrequent cases, partitioning and unique hardware/software Page MG 13 - 4
architecture may be exceptions to this determination. In cases where the FHA has determined low criticality for all combinations of systems/functions, many of the concerns associated with complex integration may be minimized.
(A) Concerns to be addressed for complex integrated systems that address failures and malfunctions:
(1 2 3 4 5 6 ) An FHA must be performed that considers each function individually and all combinations of functions for loss and malfunction. Additionally, all supporting systems, all combinations of supporting systems, and all combinations of supporting systems and dependent systems must be considered for loss and malfunction ( ) After the criticality has been determined for all functions and combinations of functions, the design integrity can be defined in terms of reliability and software level. The reliability must match or exceed the requirements derived from the FHA and associated FTA results. This includes any supporting system as well as the primary system.
( ) The software integrity level must match or exceed the requirements derived from the FHA and associated FTA results. This is true generally, for all of the software, if a single computer is utilized and no software or architecture scheme is implemented to provide partitioning/protection.
( ) If redundancy is required to meet the reliability requirements, adequate redundancy failure management must be provided. Redundancy failure/malfunction management is required to eliminate latent failures or undetected malfunctions. Redundancy management must address latent failures. Without the detection and management of latent and unannounced failures and malfunctions, duplication of subsystem components may not be creditable redundancy. If the first failure can result in unknown loss of one of the system’s functionally duplicated parts, then the second failure in combination with the first failure must be treated as a single failure and no design credit can be given for redundancy.
( ) Redundancy design must consider similarity of software between redundant system components.
( ) Electronic Devices (EDs) such as the Central Processing Unit (CPU), Programmable Logic Device (PLD), Application Specific Integrated Circuits (ASIC), or other types of data storage or computing devices must be considered to have common mode failure potential, especially for control systems. This concern may be addressed in a variety of ways. One way would be to use dissimilar EDs between redundant implementations. Some other approaches may involve architectures with monitors that are dissimilar to the systems supplying the redundant functionality. Other hardware potential common mode failures must also be considered, such as power supplies, signal sources, and common Input/Output (I/Os) chips.
Page MG 13 - 5