AC 29-2C, Chg 5 6/13/2014 (C) Bench Test. The installation of an AdFC system should include the actual hardware and appropriate software version under configuration control. Any tests performed should be documented and also maintained under configuration management for repeatability.
(1) Test Environment. The environment for bench tests includes:
(i) AdFC system should be realistic to the aircraft environment, including, but not limited to, the mechanical equipment, wiring, cooling, electrical and hydraulic power supplies, cockpit controls and displays, trim system, actuation system, and actuator loads.
(ii) If simulation is used, the model must be validated by a means acceptable to the FAA.
(2) Test Procedure and Expected Results. The test procedures for bench tests and rig tests should include open loop and closed-loop tests with simulated failures. The expected results are:
(i) Verification of failure logic, failure management, and resultant degraded modes.
(ii) Evaluation of transients during and after failure modes.
Note: Compared to validation of failure management in the simulator, the use of hardware-in-the-loop simulation provides more realistic results with respect to signal accuracy and resolution, phase delay, and other hardware or software related effects.
(G) Rotorcraft Test.
(1) Ground Test. Verification of some aspects of the AdFC functionality should be possible on the ground, such as determination of stuck or jammed controls or actuators. Ground testing should be performed to check the safety functions with the equipment installed in the aircraft. Operation tests should demonstrate that the flight control system is free from jamming. Limit load static tests should demonstrate compliance with limit load requirements.
(2) Flight Test. The objective of flight tests is to show compliance with applicable rules and safety requirements and to verify assumptions for those objectives that are not possible during ground testing. Certain effects can only be addressed in flight, such as aircraft stability and control, aircrew human factors and ergonomics, pilotinduced oscillations, air resonance, and structural coupling. Rotorcraft performance and handling qualities under normal and failure operating conditions should be assessed. If necessary, testing conditions should provide for resetting of failures at any time to return to the faultless system configuration. Flight tests at various flight conditions with and Page MG 17 - 6
without simulated failures should be performed considering event risk assessments and risk mitigations.
(3) Type Inspection Authorization (TIA) requirements. In addition to the requirements of Order 8110.4 (current version) and prior to performing a TIA flight, the applicant should provide the following documentation to the FAA:
(i) A failure condition analysis, preferably an approved FHA, with all disagreements resolved.
(ii) Evidence of completion of software Stage of Involvement (SOI) #3 including all SOI #3 findings and observations, along with their disposition.
(iii) Adequate disposition of all open problem reports.
Page MG 17 - 7
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 18. HELICOPTER TERRAI N AWARENESS AND WARNING SYSTEM (HTAWS).
a. Background.
(1) HTAWS is a computer-based system that provides the flight crew with alerts (both aural and visual) of pending collision of the rotorcraft with the terrain, considering such items as crew recognition and reaction times. HTAWS evolved from earlier rotorcraft alerting systems to support specific helicopter operational requirements.
(2) HTAWS takes inputs from a horizontal position source, vertical position source, terrain database, and an obstacle database to provide enhanced terrain and obstacle awareness. The intended functi on of HTAWS is an alerting system, which presents terrain and obstacle aural and visual alerts within a chosen flight/alert envelope. Guidance for rotorcraft specif ic requirements and system performance is found in Technical Standard Order (TSO)-C194, Helicopter Terrain Awareness and Warning System (HTAWS). TSO-C194 was developed to support rotorcraft specific operational requirements and prescribes the minimum performance standards that a HTAWS must meet for approval and identification with the applicable TSO label.
Note: The issuance of a technical st andard order authorization (TSOA) against TSO-C194 (or further amendments) does not constitute an installation approval.
(3) HTAWS is required for operations under 14 CFR part 135 subpart L, Helicopter Air Ambulance Equipment, Operation, and Training Requirements;
§ 135.605, Helicopter Terrain Awareness and Warning System (HTAWS).
b. Purpose.
(1) This guidance sets forth a method of compliance with the requirements of 14 CFR part 29 pertaining to installations of HTAWS equipment. It is for guidance purposes and provides an acceptable method of compliance. This guidance covers the safety assessment, types of environmental testing that should be considered for such installations, and identifies other installation considerations. The guidance does not change regulatory requirements and does not authorize changes in, or deviations from, regulatory requirements. The applicant may elect to follow an alternate method provided the FAA also finds the alternate method acceptable. It describes the airworthiness considerations for such installations as they apply to the unique features of the HTAWS and the interfaces with other systems on the helicopter. The HTAWS certification should address the complete certification process. There are five basic Page MG 18 - 1
AC 29-2C, Chg 4 2/27/2014 aspects for certification of HTAWS installations that are discussed throughout this document: equipment qualification, installation, system performance validation, testing considerations, and Instructions for Continued Airworthiness (ICA).
(2) AC 29-2 provides general guidance for certification and compliance of systems and equipment installation on part 29 rotorcraft. TSO-C194 specifies HTAWS equipment requirements and prescribes, by reference to RTCA specification DO-309, the minimum performance standards that a HTAWS must meet for approval. RTCA DO-309 defines specific Minimum Operational Performance Standards (MOPS) for HTAWS equipment. Compliance with RTCA DO-309 provides a method of compliance for qualification of HTAWS equipment. A met hod of compliance other than described in this AC may be used provided it is determined to be acceptable to the Administrator.
(3) HTAWS required by operational regulation must comply with TSO-C194 and should be installed in accordance with this AC or other methods acceptable to the Administrator. Terrain and obstacle warn ing systems that do not comply with TSO- C194 and are not installed according to this AC or other method acceptable to the Administrator may be installed as non-required equipment but may not be identified as HTAWS. The certification data, including the rotorcraft flight manual supplement (RFMS) and ICA, must state that the installed system does not comply with any operational regulation that requires HTAWS, and may require a placard.
c. Related Regulations and Documents
(1) Regulation Sections:
Section Title § 29.1301 Function and installation.
§ 29.1303 Flight and navigation instruments.
§ 29.1309 Equipment, systems, and installations.
§ 29.1316 Electrical and electronic system lightning protection.
§ 29.1317 High-intensity Radiated Field (HIRF) Protection.
§ 29.1321 Arrangement and visibility.
§ 29.1322 Warning, caution, and advisory lights.
§ 29.1351 General. [Electrical Systems and Equipment] § 29.1357 Circuit protective devices.
§ 29.1381 Instrument lights.
§ 29.1431 Electronic Equipment.
§ 29.1459 Flight data recorders.
§ 29.1529 Instructions for Continued Airworthiness.
§ 29.1541 General. [Markings and Placards] § 29.1581 General. [Rotorcraft Flight Manual] § 29.1585 Operating procedures.
Part 91 General Operating and Flight Rules.
Page MG 18 - 2
Section Title Part 135 Operating Requirements: Commuter and On Demand Operations and Rules Governing Persons on Board Such Aircraft.
(2) ACs, Orders, and TSOs:
Publication Title AC 20-115 Airborne Software Assurance AC 20-136 Protection of Aircraft Electrical/Electronic Systems against the Indirect Effects of Lightning.
AC 20-152 RTCA, Inc. Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware.
AC 20-153 Acceptance of Aeronautical Data Processes and Associated Databases.
AC 20-158 The Certification of aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment.
AC 20-174 Development of Civil Aircraft and Systems.
AC 21-16 RTCA Document DO-160 versions D, E, F, and G, Environmental Conditions and Test Procedures for Airborne Equipment.
AC 21-40 Guide for Obtaining a Supplemental Type Certificate.
AC 29-2 Certification of Transport Category Rotorcraft.
Order 8110.4 Type Certification.
Order 8110.49 Software Approval Guidelines.
Order 8110.54 Instructions for Continued Airworthiness Responsibilities, Requirements, and Contents.
Order 8110.105 Simple and Complex Electronic Hardware Approval Guidance.
TSO-C92c Ground Proximity Warning/Glide slope Deviation Alerting Equipment.
TSO-C194 Helicopter Terrain Awareness and Warning System.
(3) Industry documents.
(i) RTCA documents listed below are available from RTCA, Inc., 1140 Connecticut Avenue N.W., Suite 1020, Washington, D.C. 20036-4001.
Page MG 18 - 3
AC 29-2C, Chg 4 2/27/2014 Publication Title DO-160 Environmental Conditions and Test Procedures for Airborne Equipment.
DO-161A Minimum Performance Standards - Airborne Ground Proximity Warning Equipment.
DO-178 Software Considerations in Airborne System and Equipment Certification.
DO-254 Design Assurance Guidance for Airborne Electronic Hardware.
DO-200A Standards for Processing Aeronautical Data.
DO-309 Minimum Operational Performance Standard (MOPS) for Helicopter Terrain Awareness and Warning System (HTAWS) Airborne Equipment.
(ii) The Society of Automotive Engineers (SAE) Aerospace Recommended Practices documents listed below are available from SAE Customer Service, 400 Commonwealth Drive, Warrendale, PA 15096-001.
Publication Title
SAE ARP 4754A Certification Considerations for Highly Integrated or Complex Aircraft Systems.
SAE ARP 4761 Guidelines and Methods for Conducting the System Safety Assessment Process on Civil Airborne Systems and Equipment.
d. Definitions.
(1) Alert: A visual or aural stimulus presented either to attract attention or to convey information regarding system status or condition, or both.
(2) Aural Alert: A verbal statement used to annunciate a condition, situation, or event.
(3) Caution Alert: An alert requiri ng flight crew awareness. Subsequent corrective action will normally be necessary.
(4) Failure: The inability of the equipm ent or any subpart of that equipment to perform its intended function within previously specified limits.
(5) False Alert: A warning or caution that occurs when the designed terrain or obstacle warning or caution threshold of the system is not exceeded.
(6) Hazard: A state or set of conditions that, together with other conditions in the environment, could result in an adverse safety impact.
Page MG 18 - 4
(7) Hazardously Misleading Information (HMI): An incorrect depiction of the terrain or obstacle threat relative to the rotorcraft during an alert condition (excluding source data). This means that the HTAWS al ert information presented in the cockpit is in error relative to information contained in the terrain or obstacle database.
(8) HTAWS: A generic term used to de scribe an alerting system that provides the flight crew with sufficient information and time to detect potentially hazardous terrain or obstacle.
(9) Integrity: Attribute or reliability of a system or a component that can be relied upon to function at a level that is commensurate with the criticality determined by the functional hazard assessment (FHA).
(10) Maneuver: A change in the flight path of the rotorcraft initiated by the flight crew in response to an HTAWS alert to include climbs, descents (inappropriate for most situations), and turning procedures.
(11) Nuisance Alert: An alert that occurs when there is no threat or is unnecessary for the intended operation.
(12) Obstacle: A human-made structure that is in the flight path of the rotorcraft.
(13) Reduced Protection Mode: A reduced warning algorithm state that allows operation closer to terrain and obstacles with minimal alerts.
(14) Terrain and Obstacle Database: Terrain and obstacle information stored within an HTAWS.
(15) Unannunciated Failure: A form of hazardous misleading information that is particular to warning systems, such as HTAWS.
(16) Visual Alert: The use of projec ted or displayed information to present a condition, situation, or event to the flight crew.
(17) Warning Alert: An alert for a detect ed terrain or obstacle threat that requires immediate flight crew attention and decision.
e. System Description.
(1) The HTAWS will assist rotorcraft pilots in maintaining awareness of their proximity to terrain and obstacle hazards. HTAWS takes inputs from a horizontal position source, vertical position source, terrain database, and an obstacle database.
The HTAWS is typically designed to provide the following high level functions:
Page MG 18 - 5
AC 29-2C, Chg 4 2/27/2014
(i) visual information depicting terrain, relative location of terrain, and terrain avoidance alerts;
(ii) visual information depicting obstacles, relative location of obstacles, and obstacle avoidance alerts; and
(iii) aural terrain and obstacle avoidance alerts.
(2) Although TSO-C194 and RTCA DO-309 do not require a reduced protection mode, TSO applicants should consider providing a mode that will account for off-airfield operations that will still provide the pilot with essential alerts regarding terrain while minimizing nuisance alerts. Without a r educed protection or similar mode, nuisance alerts may lead to pilots ignoring or inhibiting the HTAWS at inappropriate times.
(i) Reduced protection mode performance should be evaluated during the initial airworthiness certification.
(ii) Reduced protection mode should always provide an alert with sufficient time to avoid terrain or obstacles.
(3) Flight evaluations of systems have revealed that reduced protection or similar modes for terrain alerting functions are important in rotorcraft operations.
Operations into off-airfield and unimproved landing zones usually trigger nuisance alerts if a reduced mode is not provided. These modes usually decrease the vertical and horizontal alerting envelope over terrain and obstacles thereby reducing time to collision alerts. TSO-C194 and RTCA DO-309 do not require a reduced protection mode.
Applicants with systems that have a reduced protection mode with terrain and obstacle alerting envelopes different from those in the normal mode, should provide for sufficient alerting and clearance from terrain and obstacles when conducting visual meteorological conditions operations.
f. Airworthiness Considerations.
(1) The scope of the applicant’s program should be directed toward airworthiness approval through the type certification (TC), amended TC, or supplemental type certificate (STC) processes. Installation of the HTAWS when integrated with other systems and equipment may result in a significant change under the changed product rule, 14 CFR 21.101. Installation of HTAWS in legacy aircraft may require meeting the current regulations that address installation of these newer technologies.
(2) The remainder of this document provides airworthiness considerations that applicants should consider as part of the certification process.
Page MG 18 - 6
g. Certification Requirements. Compliance with RTCA DO-309, along with the following certification guidance material and clarifications, is an acceptable means, but not the only means, to secure FAA approval of HTAWS equipment qualification and installation.
(1) General. For initial approvals, the applicant should provide a detailed systems description and design features that can be verified by certification engineers and flight test pilots. Flight-testing should concentrate on the adequacy of the interface, basic functionality of the system, location and visibility of the display, adequacy of the visual and aural alerts, day and night lighting, ease of use, understanding of the terrain and obstacle display, and potential interference with other installed equipment. In general, each mode of operation of the system should be evaluated in flight. Obstacles are frequently treated as a single point object, but in reality, obstacles (particularly tall obstacles) may have significant length and width due to guy wires. Obstacle alerting functions need to ensure that alerts are provided at sufficient distances and times to prevent flight into guy wires.
(2) System Safety Assessment. The applicant should perform an FHA and system safety assessment to establish t he HTAWS criticality and hazards associated with the proposed installation. The reliability level of the system must be commensurate with the assessed criticality, and compliance with this criticality level must be demonstrated during certification. These assessments should consider the probability of such failures as: unannunciated failures, false caution or warning alerts due to undetected (or latent) failures, failure of the system to provide the required alerting functions due to undetected (or latent) failures, effects of HTAWS failures on other aircraft systems, nuisance alerts, etc.
(3) Installations of Required HTAWS. Rotorcraft that operate under regulations requiring HTAWS must conform to minimum design assurance levels (DAL) to meet operational reliability and functional requirements. The annunciated loss of all HTAWS functions is classified as a failure condition “minor.” Failure of the HTAWS to provide accurate terrain and obstacle aural and visual alerts, on rotorcraft that operate under rules that require HTAWS, is classified as a failure condition “major” by the TSO-C194.
The HTAWS installation must satisfy the following requirements:
(i) The probability of an annunciated failure that would lead to the loss of all HTAWS functions that are described in paragraph e. above must be less than or equal to 10-3 per flight hour.
(ii) The probability of the system to provide HMI to the HTAWS display due to undetected or latent failures must be less than or equal to 10-5 per flight hour.
(A) This may be a false caution or warning alert due to undetected or latent failures.
Page MG 18 - 7
AC 29-2C, Chg 4 2/27/2014 (B) This may be an unannunciated failure of the system to provide the required alerting functions due to undetected or latent failures.
(ii) Failure of the installed HTAWS must not degrade the integrity of any essential or critical system installed in the rotorcraft with which the HTAWS interfaces.
(iv) Installed equipment must meet all requirements of TSO-C194.
(4) Software and Airborne Electronic Hardware (AEH) Qualification. The software for the HTAWS should be developed in accordance with RTCA DO-178, Software Considerations in Airborne Systems and Equipment Certification, or equivalent. Applicants from the European Un ion (EU) applying for FAA letter of design approval (LODA) through European Aviation Safety Agency (EASA) may use the European Organization for Civil Aviation Equipment (EUROCAE) document EUROCAE ED-12, Software Considerations in Airborne Systems and Equipment Certification, in lieu of RTCA DO-178. AEH should be developed in accordance with RTCA DO-254, Design Assurance Guidance for Airborne Electronic Hardware. Applicants from the EU applying for FAA LODA through EASA may use EUROCAE ED-80, Design Assurance Guidance for Airborne Electronic Hardware, in lieu of RTCA DO-254. The software and AEH DAL for HTAWS installed in helicopters should be commensurate with the following assigned failure condition classifications:
(i) All rotorcraft using HTAWS, whether or not required by regulation, must conform to the minimum DAL prescribed below to meet operational reliability and functional requirements. The loss of all HTAWS functions is classified as a failure condition “minor” by the TSO-C194. Failure of the HTAWS to provide correct terrain and obstacle aural and visual alerts is classified as a failure condition “major” by the TSO-C194. The minimum DAL are:
(A) The system software and AEH DAL for failures that lead to the loss of all HTAWS functions, described in paragraph e. above, must be level D.
(B) The system software and AEH DAL for failures that lead to HMI to the HTAWS display due to undetected or latent failures must be level C.
(i) This may be a false caution or warning alert due to undetected or latent failures.
(ii) This may be an unannunciated failure of the system to provide the required alerting functions due to undetected or latent failures.
(5) Environmental Qualification. Since a TSO is not an installation approval, the HTAWS installation should be shown to be capable of operating in its expected airborne environment. One method to s how environmental qualification of equipment is set forth in RTCA DO-160. RTCA DO-160 provides a suite of tests from which tests appropriate for the expected environment are chosen. For ex ample, the vibration test should be for Page MG 18 - 8
the rotorcraft environment and anticipated installation location, such as cockpit or avionics bay. Similar decisions must be m ade for other tests, such as temperature and electromagnetic interference (EMI) susceptibility. If the TSO environmental considerations do not adequately represent the actual installation environment, the differences must be considered and evaluated, and a course of action must be taken to correct deficiencies. Procedures provided by AC 29-2, section 29.1309, associated with temperature testing, should be followed to determine whether the equipment design is appropriate for the specific installation environment.
(6) System Performance Validation. The applicant s hould demonstrate that the performance of the HTAWS, with regard to the position of the rotorcraft relative to the terrain or obstacle, is adequate to prevent hazardously misleading information. The integrity of the navigation source has a significant effect on acceptable performance of the system. The applicant should demonstrate that the performance of the HTAWS is suitable for each phase of flight (en route, terminal, approach, and low altitude mode) for which approval is sought. Flight evaluations are normally required to assess reduced protection modes, operation in the vicinity of airfields, operations into and out of unimproved landing zones and off-airfield operations (helipads or other destinations not coded into the HTAWS database as aerodrome or helipad). HTAWS status and mode configuration should be easily seen. Mode selection (e.g., inhibit, reduced protection) should be easily accomplished without undue concentration on the pilot’s part. All visual indications should be readable in all lighting conditions. Refer to RTCA DO-309, paragraph 3.4, Test Procedures for Installed Equipment Performance, for more information.
h. Installation Considerations.
(1) Selecting a display where multiple functions are presented. In these cases, a means to select or de-select the display of terrain and obstacle information should be provided. However, the means to select or deselect the display should not void or alter terrain and obstacle aural alerts. Care shoul d be exercised in selecting a multifunction implementation to ensure that the display sharing is appropriate for the specific functions. The use of the HTAWS display should not unacceptably detract from the usability of required functions that share the display with HTAWS. Since the HTAWS display is not to be used for navigation, the use of the display should not impair the ability of the pilot to perform required navigation functions. An example of such impairment would be an installation that forces the pilot to choose between the HTAWS display and the needed navigation information in situations where both could be effectively used simultaneously and continuously (e.g., instrument approach in the vicinity of hazardous terrain and obstacles). If the timesharing of the display between HTAWS and other functions is deemed acceptable, the design should facilitate simple switching between the functions, with minimal time delays, so both functions are sufficiently accessible in realistic flight scenarios.
(2) Locate visual alerts in the pilot’s primary field of view. HTAWS status and mode selection annunciation (i.e., inhibit, reduced protection mode, or other pilot Page MG 18 - 9
AC 29-2C, Chg 4 2/27/2014 selectable mode) should be as close to the pilot’s primary field of view as possible to enable rapid assessment of HTAWS status and configuration. The terrain and obstacle display should be installed in a location that provides monitoring by the pilot(s) for identification of potential flight path conflicts. The terra in and obstacle display should be in a location similar to other multifunction displays, such as electronic maps and weather radar.
(3) The installation should ensure that aural alerts are distinct and audible in all flight conditions.
(4) The certification plan should include tests and analyses to assure that the visual and aural alerts are consistent with the alerting configuration of the rotorcraft flight deck in which the HTAWS equipment is installed. This is particularly important with retrofit installations, which may use previously installed alerting annunciations. The plan should consider that visual alerts are:
(i) located in pilots’ primary field of view, and
(ii) consistent with their associated voice or aural call out.
i. Ground Test Considerations.
(1) A ground test should be conducted for each HTAWS installation. The level of testing required will be determined by the scope of the installation (i.e., initial installation of a HTAWS model vs. a follow-on installation of a previously installed HTAWS model that was modified). Some items to c onsider for ground test should include:
(i) location of HTAWS controls, displays, and annunciators;
(ii) readability of HTAWS controls, displays, annunciators, and alerts in all lighting conditions;
(iii) evaluation of identified failure modes;
(iv) evaluation of all HTAWS interfaces;
(v) compatibility evaluation of HTAWS equipment lighting with previous night vision imaging system (NVIS) lighting modifications and night vision goggle (NVG) compatibility. Ensure the NVIS STC-approved data for the rotorc raft is updated to reflect the installation of any annunciators or displays related to the HTAWS; and
(vi) EMI and electromagnetic compatibility (EMC) testing, and very high frequency (VHF) harmonic tests for HTAWS with internal or external GPS receivers.
(2) Evaluate on the ground all in-flight display characteristics and interfaces that are available during flight and that can be evaluated on the ground.
Page MG 18 - 10