AC 29-2C, Chg 1 2/12/03 application. This action becomes a part of the certification requirements and, as such, is required to be performed as long as that certification requirement is not changed by a subsequent re-certification. An example of a mitigating action is a pilot's comparison of airborne HUMS data with aircraft instrument data.
(8) Commercial Off-the-Shelf (COTS): This term defines equipment hardware and software that is not qualified to aircraft standards. An example of COTS equipment hardware and software is a personal computer (PC) and its operational software.
(9) Independent Verification Means: An independent process to verify the correct functionality of a HUMS application on a ground station that utilizes COTS. The intent of independent verification is to gain some degree of confidence in the COTS operational reliability.
NOTE: This process may be discontinued when sufficient confidence in the application has been achieved.
(10) Synthesis: The p rocess of evaluating service history and any other relevant data with the objective of validating and, if necessary, refining the performance of an approved credit.
e. Certification Approach.
(1) There are three basic aspects to Health Usage Monitoring Systems (HUMS) certification. Certification of HUMS must address all three. The three aspects are installation, credit validation, and Instructions for Continued Airworthiness (ICA). These aspects are not totally independent and do have varying interactions with each other. A method to address these aspects is provided by the approach herein. Installation includes all the equipment needed for the end-to-end application that is associated with acquiring, storing, processing, and displaying the HUMS application data, including airborne and ground based equipment. Credit validation includes evidence of effectiveness for the developed algorithms, acceptance limits, trend setting data, tests, etc., and the demonstration methods employed. A plan is needed to ensure continued airworthiness of those parts that could change with time or usage and includes the methods used to ensure continued airworthiness.
(2) The certification process should begin with the declared application intent, and determination of the resultant criticality. This declared intent should consider whether this application is for credit, that it adds to, replaces, or intervenes in maintenance practices or flight operations. When the declared intent is for credit, the end-to-end criticality for such an application should be determined and used as an input to establish the integrity criteria. If the declared intent is for non- credit, it may be certified as long as it can be shown that the installation of the equipment will not result in a hazard to the aircraft.
Page MG 15 - 4
(3) The end-to-end criticality can be determined by performing a Functional Hazard Assessment (FHA). The integrity level is required to be equivalent to the determined end-to-end criticality. Compliance with the criticality level established by the FHA must be demonstrated. This may be achieved by a combination of application qualification plus appropriate mitigating actions.
(4) Applications are often qualified to a low level of integrity due to the assessment of criticality; however, it may be desirable to transition to a higher qualification level for future uses. Transition from one level of integrity to another will require re-evaluation.
NOTE: A certification plan may be provided to assist in the certification process. At a minimum, this plan should address the proposed means of compliance to each applicable paragraph of this advisory circular for a given application. Early submittal of this plan to the regulatory Authority is recommended.
f. Installation. Installation approval must cover systems and equipment that acquire, store, process, and display HUMS data and includes the airframe installation, or any one of these functions for a particular application. AC 29 MG 15 will address the most complex/extensive HUMS; systems of less complexity may be covered by use of only the parts of this AC that are pertinent. Different systems exhibit varying capabilities and configurations. Additionally, there may be different functional distributions between airborne and ground based equipment. HUMS equipment requirements consist of common requirements plus the unique requirements of airborne and ground based equipment.
(1) Common Requirements. A common requirement is one that applies to airborne, ground based, and installation equipment. These common requirements are discussed below.
(i) Criticality Determination.
(A) Criticality determination is a primary decision point relating to the depth of requirements for certification. The intended application can range from systems that acquire data for proof of concept only, to a system that acquires and processes data to determine if a life-limited part should be replaced. This range of applications will have a corresponding range of criticality for the systems from No Effect to Hazardous/Severe-Major. Systems in the Catastrophic criticality category are not addressed in AC 29 MG 15.
(B) If any credit is to be gained, the general guidelines for determination of criticality levels will be either Minor, Major, or Hazardous/Severe-Major. They will be in agreement with the resulting effect of the end-to-end criticality assessment.
Page MG 15 - 5
AC 29-2C, Chg 1 2/12/03 (C) Typical examples of applications which may be classified as Catastrophic are as follows :
(1) Applications providing cockpit warning(s) which are the only means of detection with associated flight manual instructions to land immediately.
(2) System applications, for which constantly misleading information could be assessed as leading to a Catastrophic condition, must be designed to either detect these errors (e.g. Built-In-Test, system redundancy, etc.) and/or be tolerant to these errors (i.e., procedural, etc.).
(D) The Functional Hazard Assessment (FHA) may be a preliminary document to the Preliminary Safety Assessment (PSA) or a part of the PSA. The FHA is a top down analysis (which should involve pilots and flight analysts as well as engineers) that starts with the hazards to the rotorcraft and traces these hazards to the system, subsystem, and component level in the areas affected by HUMS. This type of analysis starts with the determination of what undesirable effects can occur as a direct or indirect result of using HUMS for maintenance or operational actions. The level of severity associated with this effect will result in assigning a criticality level that uses the definitions of criticality contained herein.
(E) The final level of equipment qualification may not only be the result of technical considerations, but also of other mitigating actions, of which there are many types. Many of these actions can result in a reduction of qualification levels for equipment.
(ii) Mitigating Actions.
(A) A mitigating action is an autonomous and continuing compensating factor which may modify the level of qualification associated with certification of a HUMS application. These actions are often performed as part of continued airworthiness considerations and are also an integral part of the certification. As such, the continuation of certification limitations, where appropriate, must be included in the Instructions for Continued Airworthiness (ICA). Mitigating actions are subjective in nature and are an intended method(s) of application where the pre-mitigated levels of integrity are defined.
(B) Applications that use COTS software and therefore may not be fully qualified applying RTCA/DO-178/ED-12 methodology may be accepted by alternative qualification methods as stated in paragraph f(3). Therefore, the subsequent use of mitigating actions that are of themselves of a subjective nature should be approached with caution. A mitigating action must be based upon the integrity level derived from the FHA.
Page MG 15 - 6
(C) If the mitigating action is an operational consideration, the same concerns apply for continuing the mitigating action. The mitigating action should be recorded in the certification limitations and in the approved flight manual.
(iii) Performance. There must be minimum end- to-end performance criteria consistent with the application's intended use. Performance criteria, as a minimum, should consider accuracy, timing/sampling, resolution, event recognition, and consistency. The HUMS signal source must be compatible with the determined qualification level. Tests should be conducted to demonstrate that these criteria are met.
(2) Airborne Equipment Installation. Airborne equipment and the associated installation qualification procedures are the same as for any other airborne equipment.
The installation qualification and the equipment qualification may be considered two separate activities although there is an obvious relationship between them. Signal independence, irrespective of method of implementation, should exist to the extent that acquisition of HUMS signals should not compromise the level of safety or reliability of functions provided by other equipment as a result of signal sharing.
(i) Equipment Installation. Equipment not approved by other methods must be approved as part of the installation and must consider overall system requirements.
(A) Equipment Qualified as Part of Installation. Equipment qualified all or in part as a part of the installation includes minor and major parts. Examples of minor parts are: connectors, common usage relays, diodes, etc. Examples of major parts are non-prequalified equipment (equipment not TSO’d or not qualified under the TSO to the required level for installation approval), consisting of significant system components and as transducers with their interfaces. Equipment qualification must consider environmental qualification (RTCA/DO-160/ED 14) including high intensity radiated fields (HIRF) and lightning.
(B) Software. RTCA/DO-178/ED-12 should be used for the software development standard. (See following figure for typical airborne application process for software not containing COTS.)
Page MG 15 - 7
AC 29-2C, Chg 1 2/12/03
HUMS APPLICATION FOR SOFTWARE WITHOUT COTS Criticality Category Determination through a Functional Hazard Assessment (FHA) 1309 Integrity Requirements Software – DO178B Level Determination YES NO Mitigating Action?
Final HUMS Mitigating Action
Mitigated Application DO178B DO178B Software Software Level (Reduced) Certification Level FIGURE AC 29 MG 15-1. Flow chart for use of Mitigating Actions applied for reduction of Software Level.
(ii) Installation Specific Considerations Supply of Electrical Power . The overall installation considerations should include, as a minimum, supply of electrical power, environmental conditions, system non-interference, and human factors if operations are affected.
(A) . An adequate source of electrical power for HUMS must be provided. The reliability of the power source must be commensurate with the required equipment qualification level. There should be no unacceptable reduction in the level of safety or reliability for other equipment as a result of acquiring power for HUMS.
(B) Electromagnetic Compatibility. Electromagnetic compatibility (EMC) must be addressed. Complex systems may require an EMC test plan, which includes a matrix of aggressors versus victims. The end result should be to assure that HUMS does not interfere with or is not affected by any other installed equipment.
Page MG 15 - 8
(3) Ground Based Equipment Installation.
(i) Ground based equipment is typically used to process and display the data collected by airborne means. This processed data will ultimately be used to make decisions pertaining to some intervention action or provide data to other processing means to make the intervention action determination. Since the ground based equipment may be an important part of the process for determination of intervention actions, its integrity and accuracy requirements must be the same as any other part of the HUMS process.
(ii) The determination of compliance to the integrity requirements for ground based equipment is difficult when it is recognized that this equipment may, for the most part, be commercial and not necessarily designed specifically for the HUMS application. This section is intended to allow for the possibil ity of systems that contain COTS hardware and software, where the hardware is likely to be a personal computer and the operational software is COTS. The determination of compliance to the integrity requirements for COTS is based on equivalence, which is subjective. COTS service history alone will not be sufficient to comply with the requirements herein. Any ground based processing equipment that consists of commercial hardware and software must have satisfactory service history and an independent means of verifying the results of the processing. This independent verification means may be discontinued with the certifying Authority's agreement to modify the original HUMS approval and remove this requirement after significant quantities of the processed data consistently agree with the verifying means.
NOTE: The suggested processes contained in this document for acceptance of a ground based system that possibly includes COTS hardware and software is limited to ground based equipment for HUMS applications only. The integrity determination methods for systems that do not contain COTS is the same as described for the airborne systems.
(A) Independent Verification Means. The required independent verification means may consist of any one of many methods. Independent verification means may parallel only the ground based system processing or parallel all or any portion of the process that includes the COTS equipment processing. Some acceptable methods may include the following:
(1) Physical inspection(s).
(2) Redundant processing by a second dissimilar PC with different COTS from the primary processor.
Page MG 15 - 9
AC 29-2C, Chg 1 2/12/03
(3) A combination of physical inspection(s) and independent dissimilar . processing
(4) Satisfactory comparison of processed directed action to actual maintenance performed as a result of inspection. This approach would require data collection on the system prior to actual credit application. The amount and duration of data collection should be agreed between the applicant and the certifying authority at the beginning of the project on a case-by-case basis.
(5) Any other independent means of verifying the accuracy/integrity of the equipment including software by a satisfactory comparison to the directed action of the HUMS processed data.
(B) Integrity Level Considerations. The methodology is the same for different integrity level requirements as they relate to COTS hardware/software, but the compliance requirement will vary. The processes described in the previous and subsequent paragraphs of f(3) should be applied to meet the initial integrity requirements for the criticality categories of Hazardous/Severe Major and Major. Minor criticality category level will also require qualification by this process, except that independent verification can be performed after certification, provided that an approved plan is submitted for this activity. Other applications that do not employ COTS will use standard engineering practices to satisfy the integrity level considerations.
Modification of Approved Systems. Changes to the equipment including software should be qualified on a case-by-case basis that is dependent on the effect on the integrity and functionality of the system. If mitigation had been successfully demonstrated for the original configuration, the mitigation must be shown to provide the same level of integrity for the changed configuration.
(C) Ground Based Equipment Hardware. This hardware may consist of data processing, display, and possibly printing equipment or other accessories. The hardware must be compatible with the intended application and software. The independent means of verification activity is required due to the use of COTS hardware.
(D) Software. Most systems will employ two types of software. One type is the operational software and the other is the HUMS specific software. The operational software may be COTS. (See following figure for typical ground based application process for HUMS specific software using COTS as an operational software.)
Page MG 15 - 10
HUMS GROUND APPLICATION FOR SOFTWARE WITH COTS Criticality Category Determination through a Functional Hazard Assessment (FHA)
1309 Integrity Requirements Independent Software – DO178B Level Determination Ground COTS Final HUMS Ground Software Application Ground COTS Hardware Verification Means DO178B Software Level for HUMS Application (If applicable) HUMS Results Data Out-Put Independent COMPARE Verification Means HUMS Results Data Out-Put FIGURE AC 29 MG 15-2. Flow chart for application of HUMS specific software with a ground base that uses COTS software for operational software.
(1) COTS. This type of software can only be accepted by subjective considerations, such as service history, independent verification means, and design of the system to limit access to the operational COTS software to make changes. The independent means of verification activity is required due to the use of COTS software.
(2) HUMS Specific Software. This software should be developed to the integrity level required by the system criticality assessment using RTCA/DO-178 as the standard. This system determined level should be a result of the end- to-end criticality Page MG 15 - 11
AC 29-2C, Chg 1 2/12/03 assessment and, in general, the same as the airborne software. Use of mitigating actions is dependent on constraints stated in paragraph f(1)(ii).
(E) Data Processing. Data processing equipment and software should have the capacity to process the amount of data required. It should not introduce errors or provide out of specification accuracy for any parameter. The speed of processing should not be limited, by the hardware or software, to an unacceptable rate. The acceptability of speed will depend on the amount of data to be processed and the specified performance for HUMS data processing. The speed should be reasonable to accomplish data processing in a reasonable time for the particular HUMS application.
Hazardous/Severe Major or Major criticality applications that contain COTS should be part of a dedicated system or demonstrate adequate protection for the higher level processing from anything else processed on the same equipment. Subject to a favorable comparison to the required independent verification means, Minor criticality applications need not be part of a dedicated system.
(F) Display and Peripheral Equipment. The display, for most cases, may be a part of the processing equipment or closely interface with it. It must be compatible with other parts of the system and provide a clear usable presentation.
(G) Data Communications. Network applications, modem interfaces, and other system sharing and transmission features may be utilized for integrity levels associated with Major and Minor criticality categories, provided that the independent verification means covers the use of these features. Integrity levels associated with Hazardous/Severe Major criticality categories may utilize these features only if sufficient protection can be shown to assure that this level of integrity is maintained throughout any foreseeable failure/malfunction or mistake in any associated application, in addition to required independent verification means.
g. Credit Validation. HUMS applications for which credits are sought must be validated. For each application, evidence shall be provided that the physics involved is understood and therefore that the monitoring technique/algorithm/parameter, rejection criteria, and associated intervention actions are well chosen. The designer of the component/equipment to be monitored is the most logical choice for this determination.
However, in some cases the source can be from any organization as long as the validation criteria herein can be satisfied. If changes are proposed to an approved system, re-evaluation is required to ensure existing credit(s) are not invalidated. The degree of effort will vary and depend on the application type, the credit sought, and the consequences of failure or any other malfunction. The validation process would generally need to include the following:
• Description of application and associated credit.
• Understanding of the physics involved.
• Validation methodology.
Page MG 15 - 12
• Introduction to service.
• Continued airworthiness (synthesis).
NOTE: Early notification to the regulatory Authority of the credit type and the proposed method for validation is recommended.
(1) Description of Application and Associated Credit.
(i) There are many types of HUMS credits with different levels of criticality. Some may be the introduction of new maintenance practices, in place of the established maintenance practices, and others may be the introduction of additional safeguards for safety where all standard practices are retained.
(ii) It is important to fully evaluate and describe the proposed credit and the worst effect on the rotorcraft should the application fail or malfunction. This evaluation is needed to determine the system criticality, the system installation integrity requirements, and the depth and scope of the credit validation effort.
(2) Understanding the Physics Involved.
(i) The mechanisms of failure and/or degradations associated with the requested credit should be understood. This includes how a failure occurs and/or at what rate the degradation progresses and a determination of the point where intervention action is necessary. For some complex applications, this may include supporting information from validated analytical tools such as finite element analysis and fracture mechanics.
(ii) These understandings should be used to determine the four important characteristics of a HUMS application.
(A) The technique to be used.
(B) The appropriate alert limits, including trending where appropriate.
(C) The appropriate intervention action.
(D) How often to monitor to give optimum opportunity for the intervention action to be effective.
(iii) This should also recognize the different characteristics of the failure/degradation and determine when trending or a step function is most appropriate.
(3) Validation Methodology. All HUMS applications should have their validation process based on suitably representative physical data. This process may use direct or Page MG 15 - 13
AC 29-2C, Chg 1 2/12/03 indirect evidence, or a combination of the two, depending upon the credit type and the criticality on the aircraft of any HUMS failure or malfunction.
(i) Direct Evidence.
(A) When the HUMS application is classified as Hazardous/Severe Major, then direct evidence must be gathered. Examples of where this might be the most appropriate method include maintenance tasks such as vibration checks for imbalance/misalignment of high energy rotating equipment, fatigue life counting, or going "on-condition" for flight critical assemblies.
(B) Direct evidence is required for establishing that the HUMS application is sensitive to and obeys predicted response rules for the damage type, giving consistent alerts. This evidence may be gathered from several sources as follows:
(1) Actual service experience on HUMS equipped aircraft,
(2) "Seeded tests" (where the wear, defect, or deterioration is introduced, allowed to develop, and the technique response verified), and
(3) On- aircraft trials, investigating cause and effect (for example, introducing degrees of imbalance and calibrating the techniques response).
(C) Tests should be representative of the aircraft for which the credit is being sought and of test conditions representing the flight regime that would prevail when data is normally gathered (e.g., cruise). It should be established that the evidence gathered from on-aircraft ground trials or rig based seeded tests is valid in flight.
(ii) Indirect Evidence.
(A) When the HUMS application is classified as "Major" or lower, indirect evidence may be gathered. Criteria for this approach includes a criticality determination of Major or lower and either or both; application to "on-condition" maintenance actions, and/or lowering the probability of undetected failures. Monitoring of a high number of potential failure modes can collectively determine the probability of undetected failures.
Here, it may not be practicable to generate direct evidence for each failure.
(B) Proven analytical methods may be combined with sound engineering judgment to provide calculated/derived criteria; tests can be performed to validate these criteria. Model based analytical methods for predicting damage progression (e.g., finite element analysis and fracture mechanics) may allow for a validation by claiming analogy with 'direct' evidence generated for other aircraft types or equipment. However, to more fully validate this analogous data set, a degree of direct evidence for the actual equipment being monitored is still likely to be necessary to prove similarity of Page MG 15 - 14
application. This might be achieved by performing an appropriate number of seeded defect tests and, in effect, "sampling" the range of failure types contained.
NOTE: For both direct and indirect evidence, the whole system must be validated endto-end.
(4) Controlled Introduction to Service.
(i) For some credit applications, full validation and implementation may be possible during the development period. However, for many HUMS techniques, a plan for a controlled introduction to service may be necessary to fully validate the credit.
(ii) There must be provisions in the certification process to instruct the continued airworthiness effort to ensure compliance with the aforementioned plan.
(iii) During the implementation of this plan, data is accumulated by operational aircraft, and from this data, refinements and adjustments to the original criteria can be made. This period may also allow a proposed credit to be operated in parallel with alternative or standard procedures when it is necessary to gain additional in-service validation by way of back-to-back comparison
(iv) The plan should include procedures and provisions for this controlled period and should include clear goals by which progress and ultimately termination of this phase can be measured. The plan may include a multi -credit HUMS that will require a phased introduction of credits.
(5) Continued Airworthiness and Synthesis of Credit. Normal and established procedures will prevail for HUMS as for all other continued airworthiness matters.
Arrangements should be made to validate the performance of an approved credit throughout its service use. Provisions should be made to allow for the synthesis of the service experience with relevant engineering evidence from rejected components, development testing, seeded testing, etc. Any necessary or desired modificati ons to the HUMS application or the component/equipment being monitored must be re-evaluated.
h. Instructions for Continued Airworthiness (ICA) and Other Requirements for Health and Usage Monitoring System (HUMS). This section addresses the ICA, operator's HUMS program, HUMS training, and Master Minimum Equipment List (MMEL) revision to incorporate HUMS.
(1) Instructions for Continued Airworthiness. The applicant for HUMS is required to provide ICA developed in accordance with FAR/JAR Part 29 and Appendix A. This section provides supplemental guidance with addressing aspects unique to HUMS. The applicant may be an airframe manufacturer, HUMS equipment manufacturer, or an operator. The ICA should address HUMS integration with the Page MG 15 - 15