often utilized to obtain this data, which is subsequently utilized in an analysis. In more complex structures or electrical and electronic system installations, it is sometimes difficult or impossible to define the problem in terms that can be analyzed. In these cases, development or verification testing is often relied upon. The purpose of the certification plan is to show how developmental tests, analyses, and verification tests are combined to demonstrate protection design adequacy. In certain cases, previously verified designs can be incorporated and their adequacy confirmed by reference to previous verifications. Such reference should also be incorporated in the certification plan.
1. The verification testing should be conducted on a system that simulates as closely as possible the installed configuration. As few items as possible of actual hardware should be simulated.
2. Unless the applicant has opted to follow the guidance in AC 20-136B as a means of showing compliance with § 29.1309(d), then the following or other acceptable guidance should be followed. The use of various analytical processes usually requires that the system component tolerance is established. The SAE AE4L Committee Report No. AE4L-81-2 is one example of an acceptable reference to the testing that will determine these tolerances. The testing performed to determine the tolerance level of the control computer should include a consideration for the occurrence of a non-recoverable digital upset. One method to provide this consideration is to have the unit powered and the processor operating normally under software control (usually this should be the exact software for which approval is sought) when the test is performed. If strike testing is used, then several shots should be made to develop enough data to provide a reasonable confidence level. It is acceptable for the engine manufacturer, while it is obtaining the engine type certificate, to accomplish this bench testing to determine the level of tolerance of the FADEC system components to lightning encounter indirect effects. This approach has the advantages that the bench tests are not necessarily required to be repeated when the engine is installed in a different airframe. This recommendation is not meant to add a requirement to the engine manufacturer but to propose a more efficient method of certification. If this tolerance was not determined by the engine manufacturer, the applicant installing the FADEC in a rotorcraft would be expected to furnish this data.
3. As with any analytical method, it is prudent to include a margin of safety to account for the uncertainties involved in the analytical and testing processes. Margins account for uncertainty in the compliance method. As confidence in the compliance method increases, the margin can decrease. A factor of two is an acceptable margin for systems with catastrophic Failure Conditions, if this margin is verified by aircraft test or by analysis supported by aircraft tests. For other verification methods, the margin should be agreed upon with the cognizant certification office.
4. When an analysis has no associated full-scale vehicle testing to confirm the analysis, the analysis should be very rigorous. Additionally, it Page F - 40.24
should be expected in this situation that this analysis indicates a very large margin of protection. Many factors need to be considered in determining what constitutes an acceptably large margin. The specific additional margin required should be based on an assessment of the inherent uncertainty of a given analysis.
(E) Pass or Fail Criteria. The certification plan should address pass or fail criteria for the testing and analysis to be performed. The following items should be satisfied to assure acceptable system performance:
1. No immediate crew action must be needed.
2. Automatic control of the engine cannot be lost for any appreciable period of time. The engine should not be allowed to be out of control for a period of time that will result in a hazard in a worst-case flight condition. Any rapid, uncontrolled divergence would not be acceptable.
3. No crew action should be required to reset the system. This is not to imply that the system cannot be designed with a manual reset, but the manual reset cannot be used to show compliance to recover from a digital upset.
4. The resumption of engine control after an upset should be reasonably within the range that existed before the upset.
5. No critical data can be lost.
6. After the system recovers, if the performance of the system has been degraded in a noncritical manner that would reduce the capability of the rotorcraft or the ability of the pilot to cope with adverse operating conditions, then an alert to the crew about this system degradation is needed.
(F) System Installation Considerations. In most cases, the installation of the system components is a constituent part of the lightning protection. This is particularly true in the use of shielding techniques. If these installation features are required for adequate lightning protection, consideration should be given to ensure that their effectiveness is not derogated in service. ICAs must be furnished to the aircraft owner on initial delivery, and thereafter made available to parties who service and operate the rotorcraft, to allow them to take actions necessary to ensure the continued effectiveness of the system lightning protection. See § 21.50(b).
Page F - 40.25
AC 29.1316. § 29.1316 (Amendment 29- 53) ELECTRICAL AND ELECTRONIC SYSTEM LIGHTNING PROTECTION.
a. Explanation.
(1) During the original design and development of rotorcraft and the development of regulations concerning these aircraft, little attention was given to protection from the meteorological phenomenon of lightning. This was, in part, because the early aircraft were constructed mostly of metal and had little, if any, dependence on advanced technology systems. Contemporary design of rotorcraft utilizes the same advanced technology systems and materials as airplanes. Because of this, a specific requirement was added by Amendment 29-53 establishing standards for lightning strike protection of required systems, equipment, and installations. Section 29.1316 replaces paragraph (d) of § 29.1309, which previously defined the consideration required for the foreseeable operating condition of a lightning strike encounter on the rotorcraft and systems.
Note: Aviation authorities in other countries may not have issued regulations or standards similar to § 29.1316 for lightning protection. As a result, authorities in other countries may use other means, such as special conditions, to establish requirements for lightning protection.
b. Procedures.
(1) Guidance for you to show compliance with the applicable sections of § 29.1316 is available in a dedicated AC 20-136B. AC 20-136B is available for download from the FAA Regulatory Guidance Library website at http://rgl.faa.gov/.
(2) EASA Interpretative Material is introduced by a CRI referring to EUROCAE documents (ED) ED-113, ED-81, and FAA AC 20-136B.
Page F - 41
AC 29-2C, Chg 4 5/1/2014 AC 29.1317. § 29.1317 (Amendment 29- 49) HIGH INTENSITY RADIATED FIELDS (HIRF) PROTECTION.
a. Explanation.
(1) Regulation amendments in 2007 added requirements for the protection of aircraft electrical and electronic systems from the effects of High Intensity Radio Frequency (HIRF) environment. This effort was due to technological advances in airframe and electronic systems design and a concurrent increase in the levels of radiated power in the aircraft environment. These changes have raised vulnerability to the electromagnetic environment of the electrical and electronic systems, which perform critical and essential functions. Prior to this regulatory requirement, the issuance of special conditions for products involving advanced electrical and electronic systems provided an adequate level of safety. The new regulation included a five- year period of relief from the new testing requirements by allowing an applicant to show that the system continues to comply with previously issued HIRF special conditions. Beginning December 1, 2012, data used to show compliance as part of a previously issued special condition is no longer accepted as a means of showing compliance with paragraph (a) of § 29.1317. All systems will be required to show compliance data to the appropriate paragraphs and sections of the regulation, based on the HIRF safety analysis.
(2) EASA has not yet adopted regulatory requirements for HIRF protection.
EASA is using special conditions invoking the JAA INT POL 27/29-1 Issue 3, dated January 10, 2003. The requirements addressed in the JAA INT POL are similar to those of § 29.1317(a)(b)(c).
b. Procedures.
(1) Guidance for you to show compliance with the applicable sections of § 29.1317 is available in AC 20-158. This AC is available for download from the FAA Regulatory Guidance Library website: http://rgl.faa.gov/
(2) EASA Interpretative Material provided in EURO .
CAE ED-107 and AMJ
20.1317 is considered by the FAA to be technically equivalent to the guidance material in AC 20-158 and may be used as a means of compliance with § 29.1317.
Page F - 42
LT Horizontal Vertical AC 29.1321. § 29.1321 (Amendment 29-21) ARRANGEMENT AND VISIBILITY.
a. Background. This section is the first in a series that concerns the installation of instruments. Other sections address specific requirements for individual instruments.
The instruments should be arranged so that pilots can see critical information without moving their heads, and without undue distraction. Additionally, for instrument flight, 14 CFR 29.1321(b) requires grouping of the attitude, altitude, airspeed, and compass indicators in the standard “T.” The design for the instrument location and arrangement, with respect to the pilot’s seat, should accommodate pilots from 5’2” to 6’0” in height.
Alternatively, a methodology to accommodate the 5th to the 95th percentile of male and female pilots may be used. Pilots within th is height range should be able to see and, where necessary, reach and operate all of the displays.
b. Procedures.
(1) Flight, navigation, and powerplant instruments should be placed such that the pilot and copilot, if a required crewmember, can easily see and read these instruments when seated normally. Additionally, the instruments’ location should minimize unnecessary pilot head turning. The instruments necessary for safe operation (airspeed indicator, gyroscopic direction indicator, gyroscopic bank-and-pitch indicator, slip-skid indicator, altimeter, rate-of-climb indicator, master caution or warning (if installed), rotor tachometers, and the indicator most representative of engine power) should be installed immediately in front of pilots in their primary field of view (FOV).
(i) Primary FOV: Figure AC 29.1321-1 depicts the primary FOV for rotorcraft.
Display high priority information and the primary flight information in the primary FOV.
Figure AC 29.1321-1 PRIMARY FIELDS OF VIEW
(ii) Secondary FOV: Figure AC 29.1321-2 depicts the secondary fields of view. Signals and information pilots scan as part of monitoring the aircraft and its performance are located in the secondary FOV. The priority of the information and signals when locating information in the secondary field of view should be considered.
Page F - 43
LT UP Horizontal Vertical 30° C/L 30° RT NOM ON AC 29-2C, Chg 7 2/4/2016 The farther away from the primary field of view a signal is located, the greater the chance a pilot will not notice it without a prompt. Additionally, the pilot’s scan workload to see information increases the farther away from the pilot’s primary field of view it is located. The secondary FOV is bound laterally to minimize the need for pilots to turn their heads to view the information. Examples of information typically located in the secondary FOV are:
(A) Ancillary navigation information (moving maps, weather displays, etc).
(B) Secondary powerplant information, such as engine oil pressures and temperatures.
(C) Caution advisory and warning system (CAWS) panel (unless a master caution or warning indicator is not located in the primary FOV, in which case the CAWS panel should be as close to the pilots primary FOV as possible).
(D) Autopilot controls (E) Navigation controls.
Figure AC 29.1321-2 SECONDARY FIELDS OF VIEW
(2) The other powerplant instruments should be grouped together and visible to any appropriate crewmember. On multiengine rotorcraft, there should be no confusion regarding which engine an individual gauge represents. This is usually accomplished by mounting the engine gauges vertically in the center of the instrument panel. Identical gauges are placed next to each other and positioned from left to right in the same position and sequence as the corresponding engine location in the airframe.
Page F - 44
(3) An evaluation should determine that vibration of the instrument panel does not exceed the tolerances of the instruments. The instrument manufacturer will usually provide data that indicate the level of vibration for which the instrument has been qualified. The flight test evaluation of the rotorcraft should explore and determine that the vibration of the instrument panel does not affect the readability of the instruments.
To meet these two criteria, it has been necessary in some installations to “shock mount” or otherwise isolate the instrument panel.
(4) The flight test evaluation should also determine that the flags or malfunction indicators of the instruments should be readily visible in all combinations of lighting for approved kinds of operations.
(5) For IFR-certified rotorcraft, there is an additional requirement that the airspeed, altimeter, attitude, and compass instrument be located in a standard “T” configuration in front of the pilot. This configuration is:
airspeed - attitude - altitude | compass (AC 29-2, section AC 29 Appendix B further addresses IFR panel arrangement.)
(6) Geometric variation from a perfect “T” has been permitted. Each installation should be evaluated for suitability based on criteria such as panel size, ease of scan, and readability of the individual elements in the overall presentation. AC 25-11, Transport Category Airplane Electronic Display Systems, provides additional guidance for “glass cockpit” installation.
Page F – 44.1
AC 29-2C, Chg 7 2/4/2016 AC 29.1322. § 29.1322 (Amendment 29-12) WARNING, CAUTION, AND ADVISORY LIGHTS.
a. Explanation.
(1) Cockpit devices are color coded to symbolically represent various functions and varying levels of importance for flight crew operation. From early times, an attempt has been made to take full advantage of associations developed early in life as a result of continuous exposure to our daily environment.
(2) Military design specifications were the first to reference color-coding in cockpit design requirements. In the mid-1940s, the CAA initiated the first color-coding requirements for civil cockpit design. Color-coding standards for cockpit visual signals soon followed. MIL-STD-411, May 31, 1957, identified three separate categories of light signals:
(i) Warning Light - indicates the existence of a hazardous condition which may require immediate corrective action.
(ii) Caution Light - serves to alert the operator to an impending dangerous condition requiring attention but not essential equipment, or attracts attention for routine purposes.
(iii) Advisory Light - indicates safe or normal configuration, condition of performance, or operation of essential equipment, or attracts attention for routine purposes.
(3) Examples of warning and caution signals were included in later versions of the military standard, and a few of those are shown below:
[Section AC 29.1322 continued on next page.} Page F – 44.2
Warning Signals Caution Signals Cabin Pressure Failure Trim Failure Fire Fuel Low Fuel System Failure Generator Inoperative Landing Gear Unsafe Defrosting Failure
(4) Specific color designation for civil advisory lights was first addressed in Amendment 3 to the Rotorcraft Certification Rules (Parts 27 and 29) on January 19, 1968, with adoption of new §§ 27.1322 and 29.1322.
(5) In subsequent revision (Amendment 29-12), green lights were redesignated and additional colors introduced for flexibility in the requirement.
(6) Green signifies a safe operating condition and more specifically has come to signify landing gear extended and locked. Extensive use of green annunciators throughout the cockpit should generally be avoided due to possible confusion with the special use of green for landing gear. If green annunciators are physically and functionally removed from the landing gear operation, they may be found acceptable for a variety of “safe operating” applications. One such application is “all green for approach,” used in autopilot, flight director, and other navigation system displays.
(7) Other colors may be utilized as advisory lights in accordance with § 29.1322(d). Red and amber must not be used as advisory lights due to the possibility of introducing confusion into the cockpit. Obviously, yellow and pink annunciators should be avoided due to their similarity to amber and red. White and blue have been successfully utilized as advisory segments in past civil designs.
(8) The primary test for designation of color is:
(i) Red - Is immediate action required:
(ii) Amber - Is pilot action (other than immediate) required?
(iii) Green - Is safe operation indicated, and is the indication sufficiently distinct to prevent confusion with the landing gear down indication?
(iv) Other advisory lights - Is the meaning clear and distinct enough to prevent confusion with other annunciators? Do the colors which are utilized differ sufficiently from the colors specified in paragraphs (b)(1), (2), and (3) above?
(9) Annunciator lights should be visible during bright daylight conditions. This should include visibility in direct sunlight unless lights are located in such a manner that direct sunlight cannot impinge on them.
Page F - 45
(10) If dimming capability is provided, all annunciators, including master warning and caution, may be dimmable so long as the annunciation is clearly discernible for night operation at the lower lighting level. Undimmed annunciations have been found unacceptable for night operation due to disruption of cockpit vision at the high intensity. The dimming circuit should automatically revert to the high intensity setting when power is removed. Automatic dimming/brightening through the use of a photo cell is also acceptable, as are circuits which enable a dimming switch through a position light or other cockpit lighting controls.
(11) The use of flashing lights should be minimized. If a flashing feature is used, it should be controllable through pilot action so that flashing annunciation does not persist indefinitely. The indicator should be so designed that if it is energized and the flasher device fails, the light will illuminate and burn steadily.
(12) The activation of caution and warning lights should readily attract the attention of the appropriate crewmember while performing duties under both normal and high workload conditions.
b. Procedures.
(1) Red shall be reserved for annunciation of emergency conditions requiring immediate corrective action. Typical examples include fire, transmission oil pressure, engine failure, and battery overheat. The use of red for annunciators which do not require immediate action must be avoided. Use of red when it is not needed tends to lessen the impact of a red annunciator and the needed pilot association for immediate action. In evaluating cockpit annunciators for acceptability, the FAA/AUTHORITY should assure all annunciators which require immediate action are red and that only those requiring such action are red. If a master warning light is provided, it should be red, and should be powered by the same signal that powers any of the individual red warning signals. An aural warning may accompany visual warning signals to enhance pilot response. Care should be taken that any aural signal is sufficiently distinct from other aural warnings, such as low rotor RPM, to prevent confusion and to assure proper crew response. A means to deactivate and reset the master warning (visual and aural) is required. Resetting the master warning must not deactivate any individual warning signal.
(2) Amber shall be reserved for indicating malfunction or failure conditions which do not require immediate crew action to assure safe flight. Typical examples include door unlatched, inverter failure, generator failure, fuel filter clogged, and parking brake engaged. Amber should generally be utilized for malfunction and failure conditions which do not require immediate action. The key word here is “require.”
Obviously, a pilot should perform corrective action for malfunction or failure conditions in a timely manner as soon as other cockpit priorities allow. The time increment associated with “immediate action” may vary with the system involved, the flight regime, and the aircraft; however, 15 seconds is a representative value in evaluating this term.
This by no means indicates that any red annunciator can be ignored for 15 seconds.
Page F - 46
For red annunciators, some type of immediate pilot response is expected. If immediate pilot action is not required, the FAA/AUTHORITY should recommend the use of an amber designation. If a master caution light is provided in addition to a master warning light, the master caution annunciator should be amber, and should be powered by the same signal that powers any of the individual amber caution signals. Reset considerations for the master caution are the same as those detailed above for the master warning.
c. Annunciator Panel Design
(1) Explanation.
(i) The annunciator panel design should be reviewed for the presence of failure modes that can cause illumination of multiple panel segments.
(ii) Many test circuits that are diode isolated are vulnerable to this condition. A typical sequence begins with the shorting of a test circuit diode. This failure is undetectable and goes unnoticed until an actual failure condition occurs which causes the associated panel segment to illuminate. At this time all panel segments connected to the test circuit will illuminate.
(iii) This configuration becomes a special problem when one or more of the panel segments are red. A red light calls for immediate action by the crew, and the crew does not have adequate information for immediate action when many false panel segments are illuminated.
(iv) If the design review indicates a problem, a redesign of the panel to eliminate the condition is considered to be the best solution and is highly encouraged.
(2) Procedures.
(i) An alternative to panel redesign might be the following:
(A) Review the annunciator panel design and note which segments are red.
(B) Determine if cross reference information is available in the cockpit to allow elimination from consideration of any the red segments. (Example: Red low fuel pressure light and low fuel pressure gauge. Normal operation of the gauge would be a reason to assume the light did not cause the problem.)
(C) Where a cross reference is available, further design review of that function is not necessary; however, it may be appropriate to include procedural information in the emergency procedures section of the rotorcraft flight manual.
Page F - 47
(D) If cross references are not available for red segments, additional isolation should be incorporated into the annunciator design for those functions.
(ii) If cross referencing is not practical the following approach is encouraged.
(A) Review the annunciator panel design and note which segments are red.
(B) Determine if isolation diodes are checked during the application of battery or external power before starting the engines. (Example: Red low oil pressure light. If isolation diode is shorted, all panel segments will light as soon as battery or external power is applied.)
(C) When the isolation diode can be checked before starting engines, further design review is not necessary.
(D) If diodes are not automatically checked before starting, then additional isolation, should be considered.
(3) Annunciator Panel Arrangement. The annunciator panels should be arranged in a logical manner to reduce the crew’s time required to locate faults and to increase their efficiency in following Aircraft Flight Manual procedures. For example, engine annunciators on multiengine rotorcraft should be physically located on the panel to coincide with engine location (left or right) so that properly operating engines are not inadvertently shut down due to crew confusion over which engine has malfunctioned.
AC 29.1323. § 29.1323 (Amendment 29-3) AIRSPEED INDICATING SYSTEM.
a. Explanation.
(1) The accuracy of all flight test data concerned with the velocity of the rotorcraft is dependent on the calibration of the airspeed indicating system. For this reason, the airspeed system position error should be determined very early in the program.
(2) Since air density varies with altitude, the speed reading will only be correct under standard sea level conditions. However, in an actual installation, the indicator reading, even under standard sea level conditions, may differ from the calibrated airspeed because the static system does not sense true static pressure. This error in detection of static pressure is called position error. It is caused by the pressure field built up around the rotorcraft in flight. This pressure field will vary in intensity with dynamic pressure making the position error a function of calibrated airspeed. Since airspeed information is presented to the crew in terms of indicated airspeed, it is necessary to determine the position error for the rotorcraft to be flown safely.
Page F - 48