AC 29-2C, Chg 5 6/13/2014
(i) 4040.26, Aircraft Certification Service Flight Test Risk Management Program.
(ii) 8110.4, Type Certification.
(4) Applicable guidance:
(i) Policy Statement PS-ASW-27,29-09, Rotorcraft Advanced Flight Controls (AdFC) Handbook.
(ii) SAE, International ARP 4754A, Guidelines for Development of Civil Aircraft and Systems.
(iii) SAE, International ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
c. Background. The FAA recognizes that technology utilized in commercial rotorcraft consistently lags behind state-of-the-art air transport aircraft and military technologies. AdFC technology has been in use for many years, but guidance material on the safety aspects of certification, continued operational safety, and especially the use of that technology has been limited within the FAA.
d. Application. Applicants seeking approval for the installation of an AdFC system in rotorcraft should apply this guidance as a means, but not the only means, for showing compliance with the applicable rules.
(1) Since part 29 regulations are inadequate for addressing the new and novel features of AdFC systems, special conditions, equivalent means of compliance, and methods of compliance issue papers may be required to establish safety standards in the following areas:
(i) Interaction of Systems and Structures. Since rotorcraft with AdFC systems may contain control functions that affect the structural integrity of the rotorcraft, additional safety considerations are necessary to address the effects of these systems on structural integrity, either directly or because of AdFC failures.
(ii) Pilot and Co-Pilot Dual Controls. Since the current regulations address mechanically linked controls only, additional safety considerations are necessary to address potentially confusing aspects of pilot and co-pilot dual, non-linked controls. As an example, a non-responsive control input could prevent compliance with § 29.779.
(iii) Lateral-Directional and Longitudinal Stability and Low Energy Awareness.
An AdFC allows for many possibilities in developing laws for novel flight control. In the simplest form, an AdFC could replace the function of a direct link between the flight controls and the swashplate. The current requirements were written with the conventional systems of the rotorcraft handling qualities in mind. A more likely situation Page MG 17 - 2
is the use of an AdFC to modify the relationship between control input and rotorcraft response.
(iv) Control Margin Awareness. Additional safety considerations are required to address pilot awareness when employing AdFC systems since certain provisions of § 29.143 are not adequate for AdFC systems.
(v) Flight Characteristics Compliance via the Handling Quantities Rating Method (HQRM). Additional safety considerations are required to address a methodology for compliance with § 29.1309 by using the HQRM to show an HQ rating of “satisfactory” for flying qualities in degraded modes.
(vi) Flightcrew Alerting. Additional safety considerations are required to address the unique alerting characteristics of AdFC systems. The current regulations may be inadequate to handle the display of possible degraded modes where a pilot needs to be aware of the state of the primary flight controls.
(vii) Data Integrity. Additional safety considerations are required to ensure that the primary signals from the flight control system cannot be altered unintentionally, that the altered signal characteristics will maintain stable gain and phase margins with sufficient power to each axis, and that un-commanded signals are extremely improbable.
(viii) Flight Envelope Protection (FEP). Additional safety considerations ar e required to ensure that an FEP system, if implemented, prevents the pilot or autopilot from making control commands that would force the aircraft to exceed its structural or aerodynamic operating limits.
(2) Evaluation Methodology. There should be an evaluation of the AdFC system’s performance, the same as with conventional flight control systems, to demonstrate adherence to the safety requirements under all failure conditions. In each case, the software and hardware used must be under configuration control to comply with the regulations. We recognize the following evaluation methods; however, there may be other acceptable methods:
- Computer Analysis.
- Pilot-in-the-Loop Simulator Test.
- Bench Test.
- Ground Test.
- Flight Test.
(i) There may be a relationship between the levels of integrity provided to satisfy a determined failure condition category and the methodology used to validate the adequacy of the provided integrity. The below table, Figure AC 29 MG 17- 1, addresses this relationship:
Page MG 17 - 3
AC 29-2C, Chg 5 6/13/2014 Failure Condition Categories Suggested Verification Method Possible Additional Methods Minor Analysis Flight Testing *3 Major Analysis Ground Test Simulation Flight Test Hazardous/Sever e-Major Analysis Ground Test Limited Flight Tests *1 , *2 Simulation Catastrophic Analysis Simulation Ground Test Limited Flight Tests *1 , *2 * - Notes:
1 - This should be determined on a case-to-case basis.
2 - Minimize flight testing as a verification methodology, for this combination of provided integrity and failure condition category, due to safety in testing considerations. However, desirable flight testing may be feasible for some aspects if observing proper identification of flight test risk and assessments, and risk mitigations, in accordance with FAA Order 4040.26.
3 - For analysis or verification, those probable failures evaluated as having minor effects, flight testing is an option if the effects are not obvious or if there can only be evaluation of closed loop effects in flight.
Figure AC 29 MG 17-1 Verification Methodology
(ii) Due to AdFC inherent complexity, AdFC systems that typically have a large number of test cases of single and multiple failures should be investigated to verify the safety functions under all failure conditions.
(A) Non-Real Time Computer Analysis. At the beginning of the development process, when system components are not yet available in hardware, non-real time computer simulation is a useful tool for supporting the preliminary system safety assessment. This allows, at an early stage of the development, a prediction of the effects and an assessment of the criticality of failure modes of the flight control system.
Page MG 17 - 4
(B) Pilot-in-the-Loop Simulator Test. It may be practical to use a flight simulator (FS) to qualitatively verify safety assessments for certain AdFC failure conditions that would be high risk or unsafe to perform in flight. These assessments may be part of the SA process used to show compliance with specific regulations. For example, use the FS to gather data on aircraft transients caused by a failure, crew recognition of the abnormal event, recoverability after the failure transient, and the ability to continue safe flight and landing after recovery. There can be accomplishment of these assessments for critical, selected conditions using the FS without presenting a safety risk to the flight test crew.
(1) Test Environment. The test environment for pilot -in-the-loop simulator tests includes:
- Cockpit, equipped with AdFC representative displays and controls.
- Computer Generated Imagining (CGI).
- Simulated AdFC system.
- Simulated rotorcraft visuals and behavior.
(2) Verification of Simulation Tools.
(i) Before final evaluation of failure mode effects using a FS, validate the FS for the specific test conditions identified in the test plan. This validation may be done quantitatively, qualitatively, or both and must be in a manner suitable to the FAA..
(ii) There should be control of the FS configuration, including hardware and software, to ensure there is no corruption of the functional performance, as validated, during the certification process. The FS should be assessed to identify and preclude opportunities for misleading simulator results that could affect the certification process and ultimately the design of the AdFC systems.
(3) Test Procedure and Expected Results. The test procedure for pilot -inthe-loop simulator tests includes real-time simulation of performance with simulated failures. The expected test results are:
(i) Evaluation of pilot intervention time (recognition and reaction time) for the occurrence of failures under various flight conditions.
(ii) Assessment of handling qualities during recovery maneuvers.
(iii) Assessment of man-machine interface (controls and displays, warnings, cautions, and advisories).
(iv) Evaluation of rotorcraft transients.
Page MG 17 - 5
AC 29-2C, Chg 5 6/13/2014 (C) Bench Test. The installation of an AdFC system should include the actual hardware and appropriate software version under configuration control. Any tests performed should be documented and also maintained under configuration management for repeatability.
(1) Test Environment. The environment for bench tests includes:
(i) AdFC system should be realistic to the aircraft environment, including, but not limited to, the mechanical equipment, wiring, cooling, electrical and hydraulic power supplies, cockpit controls and displays, trim system, actuation system, and actuator loads.
(ii) If simulation is used, the model must be validated by a means acceptable to the FAA.
(2) Test Procedure and Expected Results. The test procedures for bench tests and rig tests should include open loop and closed-loop tests with simulated failures. The expected results are:
(i) Verification of failure logic, failure management, and resultant degraded modes.
(ii) Evaluation of transients during and after failure modes.
Note: Compared to validation of failure management in the simulator, the use of hardware-in-the-loop simulation provides more realistic results with respect to signal accuracy and resolution, phase delay, and other hardware or software related effects.
(G) Rotorcraft Test.
(1) Ground Test. Verification of some aspects of the AdFC functionality should be possible on the ground, such as determination of stuck or jammed controls or actuators. Ground testing should be performed to check the safety functions with the equipment installed in the aircraft. Operation tests should demonstrate that the flight control system is free from jamming. Limit load static tests should demonstrate compliance with limit load requirements.
(2) Flight Test. The objective of flight tests is to show compliance with applicable rules and safety requirements and to verify assumptions for those objectives that are not possible during ground testing. Certain effects can only be addressed in flight, such as aircraft stability and control, aircrew human factors and ergonomics, pilotinduced oscillations, air resonance, and structural coupling. Rotorcraft performance and handling qualities under normal and failure operating conditions should be assessed. If necessary, testing conditions should provide for resetting of failures at any time to return to the faultless system configuration. Flight tests at various flight conditions with and Page MG 17 - 6
without simulated failures should be performed considering event risk assessments and risk mitigations.
(3) Type Inspection Authorization (TIA) requirements. In addition to the requirements of Order 8110.4 (current version) and prior to performing a TIA flight, the applicant should provide the following documentation to the FAA:
(i) A failure condition analysis, preferably an approved FHA, with all disagreements resolved.
(ii) Evidence of completion of software Stage of Involvement (SOI) #3 including all SOI #3 findings and observations, along with their disposition.
(iii) Adequate disposition of all open problem reports.
Page MG 17 - 7
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 18. HELICOPTER TERRAI N AWARENESS AND WARNING SYSTEM (HTAWS).
a. Background.
(1) HTAWS is a computer-based system that provides the flight crew with alerts (both aural and visual) of pending collision of the rotorcraft with the terrain, considering such items as crew recognition and reaction times. HTAWS evolved from earlier rotorcraft alerting systems to support specific helicopter operational requirements.
(2) HTAWS takes inputs from a horizontal position source, vertical position source, terrain database, and an obstacle database to provide enhanced terrain and obstacle awareness. The intended functi on of HTAWS is an alerting system, which presents terrain and obstacle aural and visual alerts within a chosen flight/alert envelope. Guidance for rotorcraft specif ic requirements and system performance is found in Technical Standard Order (TSO)-C194, Helicopter Terrain Awareness and Warning System (HTAWS). TSO-C194 was developed to support rotorcraft specific operational requirements and prescribes the minimum performance standards that a HTAWS must meet for approval and identification with the applicable TSO label.
Note: The issuance of a technical st andard order authorization (TSOA) against TSO-C194 (or further amendments) does not constitute an installation approval.
(3) HTAWS is required for operations under 14 CFR part 135 subpart L, Helicopter Air Ambulance Equipment, Operation, and Training Requirements;
§ 135.605, Helicopter Terrain Awareness and Warning System (HTAWS).
b. Purpose.
(1) This guidance sets forth a method of compliance with the requirements of 14 CFR part 29 pertaining to installations of HTAWS equipment. It is for guidance purposes and provides an acceptable method of compliance. This guidance covers the safety assessment, types of environmental testing that should be considered for such installations, and identifies other installation considerations. The guidance does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. The applicant may elect to follow an alternate method provided the FAA also finds the alternate method acceptable. It describes the airworthiness considerations for such installations as they apply to the unique features of the HTAWS and the interfaces with other systems on the helicopter. The HTAWS certification should address the complete certification process. There are five basic Page MG 18 - 1
AC 29-2C, Chg 4 2/27/2014 aspects for certification of HTAWS installations that are discussed throughout this document: equipment qualification, installation, system performance validation, testing considerations, and Instructions for Continued Airworthiness (ICA).
(2) AC 29-2 provides general guidance for certification and compliance of systems and equipment installation on part 29 rotorcraft. TSO-C194 specifies HTAWS equipment requirements and prescribes, by reference to RTCA specification DO-309, the minimum performance standards that a HTAWS must meet for approval. RTCA DO-309 defines specific Minimum Operational Performance Standards (MOPS) for HTAWS equipment. Compliance with RTCA DO-309 provides a method of compliance for qualification of HTAWS equipment. A met hod of compliance other than described in this AC may be used provided it is determined to be acceptable to the Administrator.
(3) HTAWS required by operational regulation must comply with TSO-C194 and should be installed in accordance with this AC or other methods acceptable to the Administrator. Terrain and obstacle warn ing systems that do not comply with TSO- C194 and are not installed according to this AC or other method acceptable to the Administrator may be installed as non-required equipment but may not be identified as HTAWS. The certification data, including the rotorcraft flight manual supplement (RFMS) and ICA, must state that the installed system does not comply with any operational regulation that requires HTAWS, and may require a placard.
c. Related Regulations and Documents
(1) Regulation Sections:
Section Title § 29.1301 Function and installation.
§ 29.1303 Flight and navigation instruments.
§ 29.1309 Equipment, systems, and installations.
§ 29.1316 Electrical and electronic system lightning protection.
§ 29.1317 High-intensity Radiated Field (HIRF) Protection.
§ 29.1321 Arrangement and visibility.
§ 29.1322 Warning, caution, and advisory lights.
§ 29.1351 General. [Electrical Systems and Equipment] § 29.1357 Circuit protective devices.
§ 29.1381 Instrument lights.
§ 29.1431 Electronic Equipment.
§ 29.1459 Flight data recorders.
§ 29.1529 Instructions for Continued Airworthiness.
§ 29.1541 General. [Markings and Placards] § 29.1581 General. [Rotorcraft Flight Manual] § 29.1585 Operating procedures.
Part 91 General Operating and Flight Rules.
Page MG 18 - 2
Section Title Part 135 Operating Requirements: Commuter and On Demand Operations and Rules Governing Persons on Board Such Aircraft.
(2) ACs, Orders, and TSOs:
Publication Title AC 20-115 Airborne Software Assurance AC 20-136 Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning.
AC 20-152 RTCA, Inc. Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware.
AC 20-153 Acceptance of Aeronautical Data Processes and Associated Databases.
AC 20-158 The Certification of aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment.
AC 20-174 Development of Civil Aircraft and Systems.
AC 21-16 RTCA Document DO-160 versions D, E, F, and G, Environmental Conditions and Test Procedures for Airborne Equipment.
AC 21-40 Guide for Obtaining a Supplemental Type Certificate.
AC 29-2 Certification of Transport Category Rotorcraft.
Order 8110.4 Type Certification.
Order 8110.49 Software Approval Guidelines.
Order 8110.54 Instructions for Continued Airworthiness Responsibilities, Requirements, and Contents.
Order 8110.105 Simple and Complex Electronic Hardware Approval Guidance.
TSO-C92c Ground Proximity Warning/Glide slope Deviation Alerting Equipment.
TSO-C194 Helicopter Terrain Awareness and Warning System.
(3) Industry documents.
(i) RTCA documents listed below are available from RTCA, Inc., 1140 Connecticut Avenue N.W., Suite 1020, Washington, D.C. 20036-4001.
Page MG 18 - 3
AC 29-2C, Chg 4 2/27/2014 Publication Title DO-160 Environmental Conditions and Test Procedures for Airborne Equipment.
DO-161A Minimum Performance Standards - Airborne Ground Proximity Warning Equipment.
DO-178 Software Considerations in Airborne System and Equipment Certification.
DO-254 Design Assurance Guidance for Airborne Electronic Hardware.
DO-200A Standards for Processing Aeronautical Data.
DO-309 Minimum Operational Performance Standard (MOPS) for Helicopter Terrain Awareness and Warning System (HTAWS) Airborne Equipment.
(ii) The Society of Automotive Engineers (SAE) Aerospace Recommended Practices documents listed below are available from SAE Customer Service, 400 Commonwealth Drive, Warrendale, PA 15096-001.
Publication Title
SAE ARP 4754A Certification Considerations for Highly Integrated or Complex Aircraft Systems.
SAE ARP 4761 Guidelines and Methods for Conducting the System Safety Assessment Process on Civil Airborne Systems and Equipment.
d. Definitions.
(1) Alert: A visual or aural stimulus presented either to attract attention or to convey information regarding system status or condition, or both.
(2) Aural Alert: A verbal statement used to annunciate a condition, situation, or event.
(3) Caution Alert: An alert requiri ng flight crew awareness. Subsequent corrective action will normally be necessary.
(4) Failure: The inability of the equipm ent or any subpart of that equipment to perform its intended function within previously specified limits.
(5) False Alert: A warning or caution that occurs when the designed terrain or obstacle warning or caution threshold of the system is not exceeded.
(6) Hazard: A state or set of conditions that, together with other conditions in the environment, could result in an adverse safety impact.
Page MG 18 - 4
(7) Hazardously Misleading Information (HMI): An incorrect depiction of the terrain or obstacle threat relative to the rotorcraft during an alert condition (excluding source data). This means that the HTAWS al ert information presented in the cockpit is in error relative to information contained in the terrain or obstacle database.
(8) HTAWS: A generic term used to de scribe an alerting system that provides the flight crew with sufficient information and time to detect potentially hazardous terrain or obstacle.
(9) Integrity: Attribute or reliability of a system or a component that can be relied upon to function at a level that is commensurate with the criticality determined by the functional hazard assessment (FHA).
(10) Maneuver: A change in the flight path of the rotorcraft initiated by the flight crew in response to an HTAWS alert to include climbs, descents (inappropriate for most situations), and turning procedures.
(11) Nuisance Alert: An alert that occurs when there is no threat or is unnecessary for the intended operation.
(12) Obstacle: A human-made structure that is in the flight path of the rotorcraft.
(13) Reduced Protection Mode: A reduced warning algorithm state that allows operation closer to terrain and obstacles with minimal alerts.
(14) Terrain and Obstacle Database: Terrain and obstacle information stored within an HTAWS.
(15) Unannunciated Failure: A form of hazardous misleading information that is particular to warning systems, such as HTAWS.
(16) Visual Alert: The use of projec ted or displayed information to present a condition, situation, or event to the flight crew.
(17) Warning Alert: An alert for a detect ed terrain or obstacle threat that requires immediate flight crew attention and decision.
e. System Description.
(1) The HTAWS will assist rotorcraft pilots in maintaining awareness of their proximity to terrain and obstacle hazards. HTAWS takes inputs from a horizontal position source, vertical position source, terrain database, and an obstacle database.
The HTAWS is typically designed to provide the following high level functions:
Page MG 18 - 5
AC 29-2C, Chg 4 2/27/2014
(i) visual information depicting terrain, relative location of terrain, and terrain avoidance alerts;
(ii) visual information depicting obstacles, relative location of obstacles, and obstacle avoidance alerts; and
(iii) aural terrain and obstacle avoidance alerts.
(2) Although TSO-C194 and RTCA DO-309 do not require a reduced protection mode, TSO applicants should consider providing a mode that will account for off-airfield operations that will still provide the pilot with essential alerts regarding terrain while minimizing nuisance alerts. Without a r educed protection or similar mode, nuisance alerts may lead to pilots ignoring or inhibiting the HTAWS at inappropriate times.
(i) Reduced protection mode performance should be evaluated during the initial airworthiness certification.
(ii) Reduced protection mode should always provide an alert with sufficient time to avoid terrain or obstacles.
(3) Flight evaluations of systems have revealed that reduced protection or similar modes for terrain alerting functions are important in rotorcraft operations.
Operations into off-airfield and unimproved landing zones usually trigger nuisance alerts if a reduced mode is not provided. These modes usually decrease the vertical and horizontal alerting envelope over terrain and obstacles thereby reducing time to collision alerts. TSO-C194 and RTCA DO-309 do not require a reduced protection mode.
Applicants with systems that have a reduced protection mode with terrain and obstacle alerting envelopes different from those in the normal mode, should provide for sufficient alerting and clearance from terrain and obstacles when conducting visual meteorological conditions operations.
f. Airworthiness Considerations.
(1) The scope of the applicant’s program should be directed toward airworthiness approval through the type certification (TC), amended TC, or supplemental type certificate (STC) processes. Installation of the HTAWS when integrated with other systems and equipment may result in a significant change under the changed product rule, 14 CFR 21.101. Installation of HTAWS in legacy aircraft may require meeting the current regulations that address installation of these newer technologies.
(2) The remainder of this document provides airworthiness considerations that applicants should consider as part of the certification process.
Page MG 18 - 6