AC 29-2C, Chg 1 2/12/03
HUMS APPLICATION FOR SOFTWARE WITHOUT COTS Criticality Category Determination through a Functional Hazard Assessment (FHA) 1309 Integrity Requirements Software – DO178B Level Determination YES NO Mitigating Action?
Final HUMS Mitigating Action
Mitigated Application DO178B DO178B Software Software Level (Reduced) Certification Level FIGURE AC 29 MG 15-1. Flow chart for use of Mitigating Actions applied for reduction of Software Level.
(ii) Installation Specific Considerations Supply of Electrical Power . The overall installation considerations should include, as a minimum, supply of electrical power, environmental conditions, system non-interference, and human factors if operations are affected.
(A) . An adequate source of electrical power for HUMS must be provided. The reliability of the power source must be commensurate with the required equipment qualification level. There should be no unacceptable reduction in the level of safety or reliability for other equipment as a result of acquiring power for HUMS.
(B) Electromagnetic Compatibility. Electromagnetic compatibility (EMC) must be addressed. Complex systems may require an EMC test plan, which includes a matrix of aggressors versus victims. The end result should be to assure that HUMS does not interfere with or is not affected by any other installed equipment.
Page MG 15 - 8
(3) Ground Based Equipment Installation.
(i) Ground based equipment is typically used to process and display the data collected by airborne means. This processed data will ultimately be used to make decisions pertaining to some intervention action or provide data to other processing means to make the intervention action determination. Since the ground based equipment may be an important part of the process for determination of intervention actions, its integrity and accuracy requirements must be the same as any other part of the HUMS process.
(ii) The determination of compliance to the integrity requirements for ground based equipment is difficult when it is recognized that this equipment may, for the most part, be commercial and not necessarily designed specifically for the HUMS application. This section is intended to allow for the possibil ity of systems that contain COTS hardware and software, where the hardware is likely to be a personal computer and the operational software is COTS. The determination of compliance to the integrity requirements for COTS is based on equivalence, which is subjective. COTS service history alone will not be sufficient to comply with the requirements herein. Any ground based processing equipment that consists of commercial hardware and software must have satisfactory service history and an independent means of verifying the results of the processing. This independent verification means may be discontinued with the certifying Authority's agreement to modify the original HUMS approval and remove this requirement after significant quantities of the processed data consistently agree with the verifying means.
NOTE: The suggested processes contained in this document for acceptance of a ground based system that possibly includes COTS hardware and software is limited to ground based equipment for HUMS applications only. The integrity determination methods for systems that do not contain COTS is the same as described for the airborne systems.
(A) Independent Verification Means. The required independent verification means may consist of any one of many methods. Independent verification means may parallel only the ground based system processing or parallel all or any portion of the process that includes the COTS equipment processing. Some acceptable methods may include the following:
(1) Physical inspection(s).
(2) Redundant processing by a second dissimilar PC with different COTS from the primary processor.
Page MG 15 - 9
AC 29-2C, Chg 1 2/12/03
(3) A combination of physical inspection(s) and independent dissimilar . processing
(4) Satisfactory comparison of processed directed action to actual maintenance performed as a result of inspection. This approach would require data collection on the system prior to actual credit application. The amount and duration of data collection should be agreed between the applicant and the certifying authority at the beginning of the project on a case-by-case basis.
(5) Any other independent means of verifying the accuracy/integrity of the equipment including software by a satisfactory comparison to the directed action of the HUMS processed data.
(B) Integrity Level Considerations. The methodology is the same for different integrity level requirements as they relate to COTS hardware/software, but the compliance requirement will vary. The processes described in the previous and subsequent paragraphs of f(3) should be applied to meet the initial integrity requirements for the criticality categories of Hazardous/Severe Major and Major. Minor criticality category level will also require qualification by this process, except that independent verification can be performed after certification, provided that an approved plan is submitted for this activity. Other applications that do not employ COTS will use standard engineering practices to satisfy the integrity level considerations.
Modification of Approved Systems. Changes to the equipment including software should be qualified on a case-by-case basis that is dependent on the effect on the integrity and functionality of the system. If mitigation had been successfully demonstrated for the original configuration, the mitigation must be shown to provide the same level of integrity for the changed configuration.
(C) Ground Based Equipment Hardware. This hardware may consist of data processing, display, and possibly printing equipment or other accessories. The hardware must be compatible with the intended application and software. The independent means of verification activity is required due to the use of COTS hardware.
(D) Software. Most systems will employ two types of software. One type is the operational software and the other is the HUMS specific software. The operational software may be COTS. (See following figure for typical ground based application process for HUMS specific software using COTS as an operational software.)
Page MG 15 - 10
HUMS GROUND APPLICATION FOR SOFTWARE WITH COTS Criticality Category Determination through a Functional Hazard Assessment (FHA)
1309 Integrity Requirements Independent Software – DO178B Level Determination Ground COTS Final HUMS Ground Software Application Ground COTS Hardware Verification Means DO178B Software Level for HUMS Application (If applicable) HUMS Results Data Out-Put Independent COMPARE Verification Means HUMS Results Data Out-Put FIGURE AC 29 MG 15-2. Flow chart for application of HUMS specific software with a ground base that uses COTS software for operational software.
(1) COTS. This type of software can only be accepted by subjective considerations, such as service history, independent verification means, and design of the system to limit access to the operational COTS software to make changes. The independent means of verification activity is required due to the use of COTS software.
(2) HUMS Specific Software. This software should be developed to the integrity level required by the system criticality assessment using RTCA/DO-178 as the standard. This system determined level should be a result of the end- to-end criticality Page MG 15 - 11
AC 29-2C, Chg 1 2/12/03 assessment and, in general, the same as the airborne software. Use of mitigating actions is dependent on constraints stated in paragraph f(1)(ii).
(E) Data Processing. Data processing equipment and software should have the capacity to process the amount of data required. It should not introduce errors or provide out of specification accuracy for any parameter. The speed of processing should not be limited, by the hardware or software, to an unacceptable rate. The acceptability of speed will depend on the amount of data to be processed and the specified performance for HUMS data processing. The speed should be reasonable to accomplish data processing in a reasonable time for the particular HUMS application.
Hazardous/Severe Major or Major criticality applications that contain COTS should be part of a dedicated system or demonstrate adequate protection for the higher level processing from anything else processed on the same equipment. Subject to a favorable comparison to the required independent verification means, Minor criticality applications need not be part of a dedicated system.
(F) Display and Peripheral Equipment. The display, for most cases, may be a part of the processing equipment or closely interface with it. It must be compatible with other parts of the system and provide a clear usable presentation.
(G) Data Communications. Network applications, modem interfaces, and other system sharing and transmission features may be utilized for integrity levels associated with Major and Minor criticality categories, provided that the independent verification means covers the use of these features. Integrity levels associated with Hazardous/Severe Major criticality categories may utilize these features only if sufficient protection can be shown to assure that this level of integrity is maintained throughout any foreseeable failure/malfunction or mistake in any associated application, in addition to required independent verification means.
g. Credit Validation. HUMS applications for which credits are sought must be validated. For each application, evidence shall be provided that the physics involved is understood and therefore that the monitoring technique/algorithm/parameter, rejection criteria, and associated intervention actions are well chosen. The designer of the component/equipment to be monitored is the most logical choice for this determination.
However, in some cases the source can be from any organization as long as the validation criteria herein can be satisfied. If changes are proposed to an approved system, re-evaluation is required to ensure existing credit(s) are not invalidated. The degree of effort will vary and depend on the application type, the credit sought, and the consequences of failure or any other malfunction. The validation process would generally need to include the following:
• Description of application and associated credit.
• Understanding of the physics involved.
• Validation methodology.
Page MG 15 - 12
• Introduction to service.
• Continued airworthiness (synthesis).
NOTE: Early notification to the regulatory Authority of the credit type and the proposed method for validation is recommended.
(1) Description of Application and Associated Credit.
(i) There are many types of HUMS credits with different levels of criticality. Some may be the introduction of new maintenance practices, in place of the established maintenance practices, and others may be the introduction of additional safeguards for safety where all standard practices are retained.
(ii) It is important to fully evaluate and describe the proposed credit and the worst effect on the rotorcraft should the application fail or malfunction. This evaluation is needed to determine the system criticality, the system installation integrity requirements, and the depth and scope of the credit validation effort.
(2) Understanding the Physics Involved.
(i) The mechanisms of failure and/or degradations associated with the requested credit should be understood. This includes how a failure occurs and/or at what rate the degradation progresses and a determination of the point where intervention action is necessary. For some complex applications, this may include supporting information from validated analytical tools such as finite element analysis and fracture mechanics.
(ii) These understandings should be used to determine the four important characteristics of a HUMS application.
(A) The technique to be used.
(B) The appropriate alert limits, including trending where appropriate.
(C) The appropriate intervention action.
(D) How often to monitor to give optimum opportunity for the intervention action to be effective.
(iii) This should also recognize the different characteristics of the failure/degradation and determine when trending or a step function is most appropriate.
(3) Validation Methodology. All HUMS applications should have their validation process based on suitably representative physical data. This process may use direct or Page MG 15 - 13
AC 29-2C, Chg 1 2/12/03 indirect evidence, or a combination of the two, depending upon the credit type and the criticality on the aircraft of any HUMS failure or malfunction.
(i) Direct Evidence.
(A) When the HUMS application is classified as Hazardous/Severe Major, then direct evidence must be gathered. Examples of where this might be the most appropriate method include maintenance tasks such as vibration checks for imbalance/misalignment of high energy rotating equipment, fatigue life counting, or going "on-condition" for flight critical assemblies.
(B) Direct evidence is required for establishing that the HUMS application is sensitive to and obeys predicted response rules for the damage type, giving consistent alerts. This evidence may be gathered from several sources as follows:
(1) Actual service experience on HUMS equipped aircraft,
(2) "Seeded tests" (where the wear, defect, or deterioration is introduced, allowed to develop, and the technique response verified), and
(3) On- aircraft trials, investigating cause and effect (for example, introducing degrees of imbalance and calibrating the techniques response).
(C) Tests should be representative of the aircraft for which the credit is being sought and of test conditions representing the flight regime that would prevail when data is normally gathered (e.g., cruise). It should be established that the evidence gathered from on-aircraft ground trials or rig based seeded tests is valid in flight.
(ii) Indirect Evidence.
(A) When the HUMS application is classified as "Major" or lower, indirect evidence may be gathered. Criteria for this approach includes a criticality determination of Major or lower and either or both; application to "on-condition" maintenance actions, and/or lowering the probability of undetected failures. Monitoring of a high number of potential failure modes can collectively determine the probability of undetected failures.
Here, it may not be practicable to generate direct evidence for each failure.
(B) Proven analytical methods may be combined with sound engineering judgment to provide calculated/derived criteria; tests can be performed to validate these criteria. Model based analytical methods for predicting damage progression (e.g., finite element analysis and fracture mechanics) may allow for a validation by claiming analogy with 'direct' evidence generated for other aircraft types or equipment. However, to more fully validate this analogous data set, a degree of direct evidence for the actual equipment being monitored is still likely to be necessary to prove similarity of Page MG 15 - 14
application. This might be achieved by performing an appropriate number of seeded defect tests and, in effect, "sampling" the range of failure types contained.
NOTE: For both direct and indirect evidence, the whole system must be validated endto-end.
(4) Controlled Introduction to Service.
(i) For some credit applications, full validation and implementation may be possible during the development period. However, for many HUMS techniques, a plan for a controlled introduction to service may be necessary to fully validate the credit.
(ii) There must be provisions in the certification process to instruct the continued airworthiness effort to ensure compliance with the aforementioned plan.
(iii) During the implementation of this plan, data is accumulated by operational aircraft, and from this data, refinements and adjustments to the original criteria can be made. This period may also allow a proposed credit to be operated in parallel with alternative or standard procedures when it is necessary to gain additional in-service validation by way of back-to-back comparison
(iv) The plan should include procedures and provisions for this controlled period and should include clear goals by which progress and ultimately termination of this phase can be measured. The plan may include a multi -credit HUMS that will require a phased introduction of credits.
(5) Continued Airworthiness and Synthesis of Credit. Normal and established procedures will prevail for HUMS as for all other continued airworthiness matters.
Arrangements should be made to validate the performance of an approved credit throughout its service use. Provisions should be made to allow for the synthesis of the service experience with relevant engineering evidence from rejected components, development testing, seeded testing, etc. Any necessary or desired modificati ons to the HUMS application or the component/equipment being monitored must be re-evaluated.
h. Instructions for Continued Airworthiness (ICA) and Other Requirements for Health and Usage Monitoring System (HUMS). This section addresses the ICA, operator's HUMS program, HUMS training, and Master Minimum Equipment List (MMEL) revision to incorporate HUMS.
(1) Instructions for Continued Airworthiness. The applicant for HUMS is required to provide ICA developed in accordance with FAR/JAR Part 29 and Appendix A. This section provides supplemental guidance with addressing aspects unique to HUMS. The applicant may be an airframe manufacturer, HUMS equipment manufacturer, or an operator. The ICA should address HUMS integration with the Page MG 15 - 15
AC 29-2C, Chg 1 2/12/03 aircraft. This section addresses both airborne and ground based systems and equipment.
(i) HUMS ICA Items. The applicant must address the following subjects in addition to FAR/JAR Part 29. These subjects should address both airborne and ground based systems and equipment unless specifically indicated otherwise.
(A) Control and operating instructions must be provided for each element of HUMS, and where applicable, include data acquisition, transfer processing, display, configuration management, and resulting actions.
(B) Acceptance and rejection criteria and associated actions must be defined.
(C) A procedure is required when the system becomes inoperative because data is missing.
(D) When required, there must be a procedure for collecting and transferring HUMS data when the aircraft is away from the main HUMS data processing base.
(E) Provide a procedure for independent verification as defined in paragraph f(3), if applicable.
(F) Provide a procedure for implementing mitigating actions, when mitigating actions are applied.
(G) Provide a procedure for implementing controlled introduction to service instructions as defined in paragraph g(4), if applicable.
(H) Provide a training program on HUMS airborne and ground based systems and equipment.
(I) The airworthiness limitation section must be amended to address the following, if required:
(1) Requirements for independent verification and associated procedures.
(2) Requirements for mitigation actions and associated procedures.
(3) Requirements for controlled introduction to service and associated procedures.
Page MG 15 - 16
(ii) Ground Based System and Equipment. A procedure must be defined to ensure the security of the ground-based system and equipment and the integrity of the HUMS data.
(2) Owner/Operator's HUMS Program.
(i) General. An owner/operator that installs and utilizes health and usage monitoring equipment on aircraft and intends to request maintenance credit will need a program. This program and revision to existing maintenance and/or inspection programs must be submitted to the aviation Authority for approval. This is due to the fact that maintenance credit may change existing maintenance inspection, overhaul requirements, and/or life limits.
(ii) HUMS Program Items. Regardless of the size and complexity of the health and usage monitoring equipment, the HUMS program must contain the following:
(A) A system must be provided for tracking the HUMS monitored component/system, including identification of component/system, recording requirement, tracking procedure, and other related activities.
(B) A system to assure that a maintenance credit must be maintained.
The historical HUMS data must be traceable when such components/assemblies are transferred between aircraft.
(C) A procedure for new or overhauled HUMS monitored components.
(D) A procedure to address inoperative HUMS in accordance with paragraph j(1)(i)(C).
(E) A means for implementing procedures specified in paragraph j(1)(ii).
(F) A procedure for adjusting maintenance credits.
(G) An organization with clearly defined responsibilities to collect, analyze, and act upon the HUMS data.
(H) A procedure for implementing the training program specified in paragraph j(1)(i)(H).
(I) Where appropriate, a procedure for implementing the controlled introduction to service plan. See section g(4), Controlled Introduction to Service.
(iii) Ground Based System and Equipment.
Page MG 15 - 17
AC 29-2C, Chg 1 2/12/03 (A) A procedure for troubleshooting and testing of the HUMS.
(B) A procedure for revising and using the operator’s Minimum Equipment List (MEL) for HUMS.
(iv) Master Minimum Equipment List (MMEL)/Minimum Equipment List.
(A) The MMEL may need to be revised to include the HUMS equipment.
Once the MMEL contains the HUMS equipment, the operator can revise their MEL to include HUMS and submit the MEL to the aviation Authority for approval.
(B) The aviation Authority should coordinate with engineering in evaluating the revised MEL.
NOTE: Any MMEL allowance should be determined considering the criticality of the 'credit' effect resulting from the HUMS application(s). MMEL allowances should be substantiated based on a Functional Hazard Assessment (FHA).
Page MG 15 - 18
-CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 16. CERTIFICATION GUIDANCE FOR ROTORCRAFT NIGHT VISION IMAGING SYSTEM (NVIS) AIRCRAFT LIGHTING SYSTEMS.
a. Purpose. The guidance in this MG is one method to show compliance with 14 CFR part 29 regarding aircraft lighting modification for NVIS compatibility Additional guidance is found in RTCA Document DO-275, Minimum Operational Performance Standards for Integrated Night Vision Imaging System Equipment, issued October 12, 2001. The applicant should also be familiar with RTCA Document DO-268, Concept of Operations: Night Vision Imaging System for Civil Operators, issued March 27, 2001. For operations within Europe, applicants should also be familiar with Joint Aviation Authorities Temporary Guidance Leaflet No. 34, Night Vision Imaging System (NVIS) Operations. For NVIS operations outside the United States, other similar documents may also apply.
b. Revisions.
(1) This revision focuses the guidance on NVIS lighting and night vision goggles (NVG) and NVIS lighting cockpit compatibility.
(2) NVIS and NVG cockpit evaluation guides and checklists are located at http://www.faa.gov/aircraft/air_cert/design_approvals/rotorcraft/nvis/.
c. Definitions.
(1) Cultural lighting. Light emitted from cities, towns, residences, streetlights, or other artificial sources. Cultural lighting may help or hinder the pilot’s external view through NVGs depending on intensity, reflection off cloud cover, landing zone, and topography.
(2) Night vision imaging system (NVIS). A system that integrates all elements (including the NVG, windshield, and lighting system) required to operate an aircraft successfully and safely with the aid of NVGs.
(3) NVIS lighting component. Any component intended for use with NVGs that emits or transmits light within the flight deck or other crew compartments, or attached to the aircraft exterior, and does not degrade NVG performance.
(4) NVIS lighting system. An aircraft lighting system modified or designed to incorporate NVIS lighting components. It provides adequate illumination, under day and night conditions, of instruments, displays, and controls for the unaided eye without degrading NVG performance. NVIS lighting systems must meet part 29 lighting requirements.
(5) NVIS-friendly (as applicable to external lights). NVIS-friendly exterior lights can be viewed by the unaided eye, meet the position light requirements of 14 CFR 29, and do not significantly interfere with NVG performance. An NVIS-friendly exterior light will emit more NVG detectable, usually infrared (IR), wavelengths of energy compared to lights that are completely NVIS -compatible. NVIS-friendly exterior lights will be detected when viewed through the NVGs and not overwhelm the aircraft outline or cause shadowing or objectionable reflections off the aircraft. When viewed through NVGs, the light does not cause excessive “blooming”
(6) NVG-compatible. Aircraft internal and external lighting is NVG -compatible when it does not adversely affect the NVG image.
(7) Aided flight. A flight in which the flight crew references NVG imagery to assist visual flight.
Page MG 16-1