Appendix A A-1 APPENDIX A. RVSM AIRWORTHINESS CERTIFICATION
CONTENTS Paragraph Page
A.1 IntroductionA-2
A.2 R VSM Flight EnvelopesA-4
A.3 G roup and Non- Group AircraftA-6
A.4 A ircraft Systems —Group and Non-Group AircraftA-6
A.5 A ltimetry System PerformanceA-9
A.6 A ircraft System Configurations: Older “Legacy” AirframesA-11
A.7 A ltimetry System Performance SubstantiationA-15
A.8 A ltimetry System Component Error BudgetA-16
A.9 Es tablishing and Monitoring SSEsA-25
A.10 Mai ntenanc e RequirementsA-29
A.11 R VSM Airworthiness ApprovalA-31
Appendix A A-2 A.1 Introduction.
A.1.1 General. This appendix provides guidance on the aircraft airworthiness certification process for RVSM compliance. Key elements necessary to substantiate the aircraft systems performance required for RVSM certification are summarized. Differences between a Group and Non-Group aircraft certification program are presented. A comprehensive discussion of altimetry system error (ASE) and ASE variation is also provided.
Note: For additional information on obtaining RVSM airworthiness certification, c ontact the appropriate FAA Aircraft Certification Office (ACO) for guidance.
Contact information for ACOs can be found on the FAA website at https://www.faa.gov.
A.1.2 Definitions.
1. Air Data Sensor. Line replaceable units (LRU) designed to detect air data characteristics (e.g., pressure and temperature) to support the air data system (ADS) of the aircraft.
2. Air Data System (ADS). Systems used to collect and process air data characteristics from various sensors to compute critical air data parameters
(e.g., altitude, airspeed, height deviation, and temperature) for use by the pilot and other systems in the aircraft.
3. Aircraft Group. A Group of aircraft of nominally identical design and build with respect to all details that could influence the accuracy of altitude-keeping performance.
4. Altimetry System Error (ASE). The difference between the pressure altitude displayed to the flightcrew when referenced to International System of Units (SI) standard ground pressure setting (29.92 inches of mercury (inHg)/1013.25 hectopascals (hPa)) and free stream pressure altitude.
5. Altitude-Keeping Capability. Aircraft altitude-keeping performance expected under nominal environmental operating conditions with proper aircraft operating practices and maintenance.
6. Altitude-Keeping Performance. The observed performance of an aircraft with respect to adherence to a flight level (FL).
7. Assigned Altitude Deviation (AAD). The difference between the altitude transmitted by an Altitude Reporting Mode of Secondary Radar (Mode C) transponder and the assigned altitude/FL.
8. Automatic Altitude Control System. Any system designed to automatically control the aircraft to a referenced pressure altitude.
9. Avionics Error. The error in the processes of converting the sensed pressure into an electrical output, of applying any static source error correction (SSEC) as appropriate, and of displaying the corresponding altitude.
Appendix A A-3
10. Basic Reduced Vertical Separation Minimum (RVSM) Envelope. The range of Mach numbers and gross weights within the altitude ranges FL 290 to FL 410 (or maximum available altitude) where an aircraft is expected to operate most frequently.
11. Derivative Aircraft. Aircraft of the same model type, certified under the same type certificate (TC). The aircraft may have different exterior dimensions, such as fuselage length and wingspan, but share the same altimetry system architecture. In addition, derivative aircraft share the same SSEC at RVSM FLs. In most cases, derivative aircraft will have differing flight envelopes, so the RVSM flight envelope defined for the Group must be carefully constructed such that the performance of all models within the Group is captured.
12. Full RVSM Envelope. The entire range of operational Mach numbers, W/δ, and altitude values over which the aircraft is operated within RVSM airspace.
13. Instructions for Continued Airworthiness (ICA). Documentation giving instructions and requirements for the maintenance essential to the continued airworthiness of an aircraft.
14. Non-Group Aircraft. An aircraft for which the operator applies for approval on the characteristics of the unique airframe rather than on a Group basis.
15. Reduced Vertical Separation Minimum (RVSM). Designated airspace, typically between FL 290 and FL 410, where 1,000 ft vertical separation between aircraft is applied. This airspace is considered special qualification airspace.
16. Residual Static Source Error (SSE). The amount by which SSE remains undercorrected or overcorrected after application of an SSEC.
17. Static Source Error (SSE). The difference between the pressure sensed by the aircraft static source and the undisturbed ambient pressure.
18. Static Source Error Correction (SSEC). A correction applied to the altimetry system to produce minimal residual SSE.
19. Total Vertical Error (TVE). Vertical geometric difference between the actual pressure altitude flown by an aircraft and its assigned pressure altitude (FL).
20. Worst-Case Avionics. The combination of tolerance values, specified by the manufacturer for the altimetry fit into the aircraft, which gives the largest combined absolute value of avionics errors.
21. W/δ. Aircraft weight, W, divided by the atmospheric pressure ratio, δ.
Appendix A A-4 A.1.3 An Explanation of W/δ . Throughout this appendix, there are multiple references to the performance parameter W/δ. The following discussion is provided for the benefit of readers who may not be familiar with the use of this parameter.
A.1.3.1 It wo uld be difficult to show all of the gross weight, altitude, and speed conditions constituting the RVSM envelope(s) on a single plot. This is because most of the speed boundaries of the envelopes are a function of both altitude and gross weight. As a result, a separate chart of altitude versus Mach would be required for each aircraft gross weight. Aircraft performance engineers commonly use the following technique to solve this problem.
A.1.3.2 For most aircraft with RVSM altitude capability, the required flight envelope can be collapsed to a single chart, with good approximation, by use of the parameter W/δ (weight divided by atmospheric pressure ratio). This fact is due to the relationship between W/δ and the fundamental aerodynamic variables M and lift coefficient as shown below:
W/δ =1481.4 CL M2 SREF where δ = ambient pressure at flight altitude divided by sea level standard pressure of 29.92126 inches Hg.
W/δ = Weight over Atmospheric Pressure Ratio.
CL = Lift Coefficient (CL = L/qSREF).
L = Lift (in cruise flight L is equal to W).
q = Dynamic Pressure, q = 1481.4M2 δ.
Dynamic pressure is in the form of lbs/ft2.
M = Mach number.
SREF = Reference Wing Area in square feet.
W is the weight in pounds.
A.1.3.3 As a result, the flight envelope may be collapsed into one chart by simply plotting W/δ, rather than altitude, versus Mach number. Since δ is a fixed value for a given altitude, weight can be obtained for a given condition by simply multiplying the W/δ value by δ.
A.1.3.4 Over the RVSM altitude range, it is an accurate approximation to assume that position error is uniquely related to Mach number and W/δ for a given aircraft.
A.2 RVSM Flight Envelopes.
A.2.1 General. F or the purposes of RVSM approval, the aircraft flight envelope is considered in two parts: 1) the full RVSM envelope, and 2) the basic RVSM envelope. The basic RVSM envelope is the part of the flight envelope where aircraft operate the majority
Appendix A A-5 of time. The full RVSM envelope is the entire range of operational Mach numbers, W/δ, and altitude values over which the aircraft is operated within RVSM airspace. In general, the full RVSM envelope comprises parts of the flight envelope where the aircraft operates less frequently and where a larger ASE tolerance is allowed.
A.2.2 Full RVSM Envelope. The full RVSM envelope will comprise the entire range of operational Mach numbers, W/δ, and altitude values over which the aircraft can operate within RVSM airspace. Table A-1 establishes the parameters to consider.
Table A-1. Full RVSM Envelope Boundaries Lower Boundary Is Defined By:
Upper Boundary Is Defined By:
Altitude Flight Level (FL) 290 The lower of the following:
• FL 410
• Airplane maximum certified altitude
• Altitude limited by: cruise thrust; buffet; other aircraft flight limitations Mach or Speed The lower of the following:
• Maximum endurance (holding) speed
• Maneuver speed The lower of the following:
• MMO/VMO (maximum operating limit speed (Mach/velocity))
• Speed limited by: cruise thrust; buffet; other aircraft flight limitations Gross Weight The lowest gross weight compatible with operation in RVSM airspace The highest gross weight compatible with operation in RVSM airspace A.2.3 Basic RVSM Envelope. The boundaries for the basic RVSM envelope are the same as those for the full RVSM envelope except in regard to the upper Mach boundary.
A.2.3.1 For the basic RVSM envelope, the upper Mach boundary may be limited to a range of airspeeds over which the aircraft Group can reasonably expect to operate most frequently. The manufacturer or design organization should define this boundary for each aircraft Group. It may be defined as equal to the upper Mach/airspeed boundary defined for the full RVSM envelope or a specified lower value. This lower value should not be less than the Long Range Cruise (LRC) Mach number plus 0.04 Mach unless limited by available cruise thrust, buffet, or other aircraft flight limitations.
Appendix A A-6 A.2.3.2 The LRC Mach number is the Mach for 99 percent of best fuel mileage at the particular W/δ under consideration.
A.3 Group and Non-Group Aircraft.
A.3.1 Group Aircraft. Aircraft comprising a Group must be of nominally identical design and build with respect to all details that could influence the accuracy of the altitude-keeping performance. The following conditions should be met:
1. Aircraft should be approved by the same TC, TC amendment, or Su pplemental Type Certificate (STC), as applicable.
2. For derivative aircraft, it may be possible to use the database from the parent configuration to minimize the amount of additional data required to show compliance. The extent of additional data required will depend on the nature of the changes between the parent aircraft and the derivative aircraft.
3. The static system of each aircraft should be installed in a nominally identical manner and position. The same SSEC should be incorporated in all aircraft of the Group.
4. The avionics units installed on each aircraft to meet the minimum RVSM equipment requirements (see paragraph A.4) should be manufactured to the manufacturer’s same specification, and have the same equipment part number and software part number (or version and revision).
Note: Aircraft which have avionics units which are of a different manufacturer or equipment part number, software part number (or version and revision) may be considered part of the Group if the applicant demonstrates to the appropriate FAA office this standard of avionic equipment provides identical or better system performance.
5. The airframe manufacturer or design organization produced or provided the RVSM data package.
A.3.2 Non-Gro up Aircraft. If an airframe does not meet the conditions of paragraph A.3.1 to qualify as a member of a Group or is presented as an individual airframe for approval, then it must be considered as a Non-Group aircraft for the purposes of RVSM approval.
A.4 Aircraft Systems—Gr oup and Non-Group Aircraft.
A.4.1 Equipment for RVSM Operations. The minimum equipment fit should be as presented below. Additional examples of aircraft systems found on older, “legacy” airframes are presented in paragraph A.6.
Appendix A A-7 A.4.1.1 Two Independent Altitude Measurement Systems. Each system should be comprised and configured with the following elements:
A.4.1.1.1 S tatic Sources. Cross-coupled static source/system, provided with ice protection if located in areas subject to ice accretion.
A.4.1.1.2 Altitu de Display. Equipment for measuring static pressure sensed by the static source, converting it to pressure altitude, and displaying the pressure altitude to the flightcrew.
A.4.1.1.3 Altitu de Reporting. Equipment for providing a digitally coded signal corresponding to the displayed pressure altitude, for automatic altitude reporting purposes. The pressure altitude from which the signal is derived must meet the requirements of paragraphs A.5.2.1 and A.5.2.2, or paragraph A.5.3.2, as appropriate.
A.4.1.1.4 Altimetry System Components. The altimetry system should comprise all those elements involved in the process of sampling free stream static pressure and converting it to a pressure altitude output. The elements of the altimetry system fall into two main groups:
• A irframe plus static sources (pitot- static probe/static port), including the area around the static sources in the system design that must be maintained.
• Avionics and/or instruments.
A.4.1.1.5 A ltimetry System Accuracy. The total altimetry system accuracy should satisfy the requirements of paragraphs A.5.2.1 and A.5.2.2, or paragraph A.5.3.2, as appropriate.
A.4.1.1.6 SSEC. If t he design and characteristics of the aircraft and altimetry system are such that the standards of paragraphs A.5.2.1 and A.5.2.2, or paragraph A.5.3.2, are not satisfied by the location and geometry of the static sources alone, then suitable SSEC should be applied automatically within the avionic part of the altimetry system. The design aim for SSEC, whether aerodynamic/geometric or avionic, should be to produce a minimum residual SSE, but in all cases it should lead to satisfaction of the standards of paragraphs A.5.2.1 and A.5.2.2, or paragraph A.5.3.2, as appropriate.
A.4.1.1.7 Ou tput to the Automatic Altitude Control and Altitude Alert Systems.
Thealtimetry system equipment fit should provide reference signals for automatic altitude control and alerting at selected altitude. These signals should be derived from an altitude measurement system meeting the full requirements of this appendix. The output may be used either directly or combined with other sensor signals. If SSEC is necessary to satisfy the
Appendix A A-8 requirements of paragraphs A.5.2.1 and A.5.2.2, or paragraph A.5.3.2, then an equivalent SSEC must be applied to the altitude control output. The output may be an altitude deviation signal, relative to the selected altitude, or a suitable absolute altitude output. Whatever the system architecture and SSEC system, the difference between the output to the altitude control system and the altitude displayed must be minimal.
A.4.1.1.8 Sy stem Safety Analysis. During the RVSM approval process, it must be verified analytically that the predicted rate of occurrence of undetected altimetry system failures does not exceed 1 x 10-5 per flight-hour. All failures and failure combinations whose occurrence would not be evident from cross-flight deck checks, and which would lead to altitude measurement/display errors outside the specified limits, need to be assessed against this budget. No other failures or failure combinations need to be considered.
A.4.1.1.9 ADSs a nd Configurations with Multiple Static Source Inputs. Many aircraft are produced with ADSs making use of three or more static source inputs, and/or three or more air-data computers (ADC). Such systems (often referred to as “triplex” systems or “voting” schemes) are designed with integrated algorithms that monitor and compare the pressures sensed at the static sources.
Sources providing “good” pressure values are used in the calculation of corrected altitude. Such configurations are acceptable provided at least two ADSs meet the requirements of paragraphs A.4.1.1.1 through A.4.1.1.8.
Upon failure of one ADS, a second system must remain fully functional in compliance with the requirements of paragraphs A.4.1.1.1 through A.4.1.1.8.
A.4.1.2 O ne Secondary Surveillance Radar (SSR) Altitude Reporting Transponder. Any transponder meeting or exceeding the requirements of Technical Standard Order (TSO)-C74, Air Traffic Control Radar Beacon System (ATCRBS) Airborne Equipment, or TSO- C112, Air Traffic Control Radar Beacon System/Mode Select (ATCRBS/Mode S) Airborne Equipment, as applicable, in accordance with the operational regulations under which the airplane is approved. An aircraft may be equipped with one or more transponders. If only one is fitted, it should have the capability for switching to obtain input from either altitude measurement system.
A.4.1.3 A n Altitude Alert System. The altitude alert system should be capable of operation from either of the two required independent altitude measurement systems. The altitude alert system may be comprised of one or more LRUs, or it may be an integral part of a flight management system (FMS) or flight management computer (FMC). The altitude deviation warning system should signal an alert when the altitude displayed to the flightcrew deviates from selected altitude by more than a nominal value.
Appendix A A-9
1. For aircraft for which application for TC or major change in type design is on or before April 9, 1997, the nominal value must not be greater than ±300 ft (±90 m).
2. For aircraft for which application for TC or major change in type design (e.g., STC) is made after April 9, 1997, the nominal value should not be greater than ±200 ft (±60 m). The overall equipment tolerance in implementing these nominal threshold values should not exceed ±50 ft (±15 m).
A.4.1.4 An Automatic Altitude Control System. The automatic altitude control system is generally comprised of an autopilot with altitude hold mode. The automatic altitude control system should be capable of operation from either of the two required independent altitude measurement systems. Paragraph A.6 presents additional options for automatic altitude control configurations found on older, “legacy” aircraft.
1. As a minimum, a single automatic altitude control system should b e installed which is capable of controlling aircraft height within a tolerance band of ±65 ft (±20 m) about the acquired altitude when the aircraft is operated in straight and level flight under nonturbulent, nongust conditions.
a. Aircraft types for which application for TC is on or before April 9, 1997, which are equipped with an automatic altitude control system with FMS/performance management system inputs allowing variations up to ±130 ft (±40 m) under nonturbulent, nongust conditions do not require retrofit or design alteration.
b. If specific tuning is needed for a “legacy” autopilot to meet performance standards in RVSM airspace, this gain scheduling or tuning must not negatively impact the way the autopilot performs in other phases of flight and at non-RVSM altitudes. For example, it is common for older systems to be tuned to meet RVSM tolerance, only to realize they no longer have acceptable vertical performance on a coupled approach.
2. Where an altitude select/acquire function is provided, the altitude select/acquire control panel must be configured such that an error of no more than ±25 ft (±8 m) exists between the display selected by the flightcrew and the corresponding output to the control system.
A.5 Altimetry System Performance.
A.5.1 General. The statistical performance statements of International Civil Aviation Organization (ICAO) Doc 9574, Manual on a 300 m (1,000 ft) Vertical Separation Minimum Between FL 290 and FL 410 Inclusive, for a population of aircraft are translated into airworthiness standards by assessment of the characteristics of ASE and
Appendix A A-10 altitude control. The following standards differ in some respects from that document, but they are consistent with the requirements of RVSM and in accordance with 14 CFR part 91 appendix G, se ction 2 .
A.5.2 Group Approval.
A.5.2.1 The requirements in the basic RVSM envelope are as follows:
1. At the point in the basic RVSM envelope where the mean for ASE (ASEmean) reaches its largest absolute value, the absolute value should not exceed 80 ft (25 m).
2. At the point in the basic RVSM envelope where ASEmean plus three standard deviations (ASE3 SD) reaches its largest absolute value, the absolute value should not exceed 200 ft (60 m).
A.5.2.2 The requirements in the full RVSM envelope are as follows:
1. At the point in the full RVSM envelope where ASEmean reaches its largest absolute value, the absolute value should not exceed 120 ft (37 m).
2. At the point in the full RVSM envelope where ASEmean plus ASE3 SD reaches its largest absolute value, the absolute value should not exceed 245 ft (75 m).
3. If necessary, for the purpose of achieving RVSM approval for an aircraft Group, an operating restriction may be established to restrict aircraft from conducting RVSM operations in areas of the full RVSM envelope where the absolute value of ASEmean exceeds 120 ft (37 m) and/or the absolute value of ASEmean plus ASE3 SD exceed 245 ft (75 m). When such a restriction is established, identify it in the data package and document it in appropriate aircraft operating manuals; however, visual or aural warning/indication systems should not be required to be installed on the aircraft.
A.5.2.3 Aircraft types for which application for TC or major change in type design is made after April 9, 1997, should meet the criteria established for the basic envelope in the full RVSM envelope. The FAA will consider factors providing an equivalent level of safety in the application of this criteria as stated in 14 CFR part 21, § 21.21(b)(1).
A.5.3 Non-Group Approval.
A.5.3.1 The standards of paragraphs A.5.2.1, A.5.2.2, and A.5.2.3 cannot be applied to Non-Group aircraft approval because there can be no Group data with which to develop airframe-to-airframe variability. Therefore, a single ASE value has been established that controls the simple sum of the ASEs. In order to control
Appendix A A-11 the overall population distribution, this limit has been set at a value less than that for Group approval.
A.5.3.2 The standard for aircraft submitted for approval as Non-Group aircraft, as defined in paragraph A.3.2, is as follows:
1. For all conditions in the basic RVSM envelope:
|Residual SSE + worst-case avionics| ≤ 160 ft (50 m)
2. For all conditions in the full RVSM envelope:
|Residual SSE + worst-case avionics| ≤ 200 ft (60 m)
3. “Worst-case avionics” means that combination of tolerance values, specified by the manufacturer for the altimetry fit into the aircraft, which gives the largest combined absolute value of avionics errors.
For most systems, this may not be a fixed value over time.
A.5.3.3 An operating restriction may be established to restrict the Non-Group aircraft from conducting RVSM operations in areas of the full RVSM envelope where the requirements of paragraph A.5.3.2 cannot be met.
A.5.3.4 The ASE airworthiness standards in paragraphs A.5.2 and A.5.3 should not be confused with the ASE values stated in the altitude-keeping paragraph 4.3.
Paragraphs A.5.2 and A.5.3 represent the ASE performance specification for RVSM airframe airworthiness certification, which is a key element of the RVSM airplane airworthiness certification process. Paragraph 4.3 presents performance criteria specified for the RVSM height-monitoring program, which is an element of the operational quality assurance process. The monitoring program is independent of the airworthiness certification program.
A.6 Aircraft System Configurations: Older “Legacy” Airframes.
A .6.1 Background. This paragraph provides additional guidance regarding configurations found on older model airplanes (also known as “legacy” airplanes (e.g., B707, DC-8, older business jets, and turboprop aircraft)) for which RVSM approval is sought.
A.6.2 Single Autopilot Installation. P aragraph A.4.1.1.7 states the ADS shoul d provide reference signals for automatic control and alerting at selected altitude. These signals should preferably be derived from an altitude measurement system meeting the full requirements of this appendix. In addition, paragraph A.4.1.1.7 states the altimetry system must provide an output which can be used by an automatic altitude control system to control the aircraft at a commanded altitude. The output may be used either directly or combined with other sensor signals. The altitude control output may be an altitude deviation signal, relative to the selected altitude, or a suitable absolute altitude output.
Appendix A A-12 A.6.2.1 A distinction can be made between signals derived from an ADC and signals derived from an altitude measurement system. Paragraph A.4.1.1.7 does not mandate the need for dual ADC inputs to the automatic altitude control system.
A.6.2.2 Se veral airplane model types are equipped with a single autopilot installation.
In many cases, the autopilot is only capable of receiving altitude hold inputs from a single source. It has been further noted retrofitting of these autopilot installations to receive altitude hold input from additional sources (e.g., another ADC) may yield one or more of the following problems:
1. The retrofit costs are a significant percentage of the total worth of the airframe.
2. The retrofit is not possible without replacement of the autopilot.
3. The retrofit increases ADS complexity, which in turn increases the scenarios and rates of failure.
4. Upgraded avionics (i.e., ADCs) are not available, or the vendors will not support retrofits.
A.6.2.3 There are two common avionics configurations that may meet RVSM requirements, but do not have dual ADC input to the autopilot. A general description and possible means of compliance are given below. They are:
1. Figure A-1, Example of Air Data System/Autopilot Configuration.
2. Figure A-2, Single Air-Data Computer Configuration for Autopilot Input.
A.6.2.4 Fi gure A-1 is a typical configuration for an aircraft using an independent source for altitude hold input to the autopilot.