Appendix A A-7 A.4.1.1 Two Independent Altitude Measurement Systems. Each system should be comprised and configured with the following elements:
A.4.1.1.1 Static Sources. Cross-coupled static source/system, provided with ice protection if located in areas subject to ice accretion.
A.4.1.1.2 Altitude Display. Equipment for measuring static pressure sensed by the static source, converting it to pressure altitude and displaying the pressure altitude to the flightcrew.
A.4.1.1.3 Altitude Reporting. Equipment for providing a digitally coded signal corresponding to the displayed pressure altitude, for automatic altitude reporting purposes. The pressure altitude from which the signal is derived must meet the requirements of paragraphs A5.2.1 and A5.2.2, or A5.3.2, as appropriate.
A.4.1.1.4 Altimetry System Components. The altimetry system should comprise all those elements involved in the process of sampling free stream static pressure and converting it to a pressure altitude output. The elements of the altimetry system fall into two main groups:
• Airframe plus static sources (pitot-static probe/static port), including the area around the static sources in the system design that must be maintained.
• Avionics and/or instruments.
A.4.1.1.5 Altimetry System Accuracy. The total altimetry system accuracy should satisfy the requirements of paragraphs A.5.2.1 and A.5.2.2, or A.5.3.2, as appropriate.
A.4.1.1.6 Static Source Error Correction (SSEC). If the design and characteristics of the aircraft and altimetry system are such that the standards of paragraphs A.5.2.1 and A.5.2.2, or A.5.3.2, are not satisfied by the location and geometry of the static sources alone, then suitable SSEC should be applied automatically within the avionic part of the altimetry system. The design aim for SSEC, whether aerodynamic/geometric or avionic, should be to produce a minimum residual SSE, but in all cases it should lead to satisfaction of the standards of paragraphs A.5.2.1 and A.5.2.2, or A.5.3.2, as appropriate.
A.4.1.1.7 Output to the Automatic Altitude Control and Altitude Alert Systems. The altimetry system equipment fit should provide reference signals for automatic altitude control and alerting at selected altitude. These signals should be derived from an altitude measurement system meeting the full requirements of Appendix A. The output may be used either directly or combined with other sensor signals. If SSEC is necessary in order to satisfy the requirements of paragraphs A.5.2.1 and A.5.2.2, or A.5.3.2, then an
Appendix A A-8 equivalent SSEC must be applied to the altitude control output. The output may be an altitude deviation signal, relative to the selected altitude, or a suitable absolute altitude output. Whatever the system architecture and SSEC system, the difference between the output to the altitude control system and the altitude displayed must be minimal.
A.4.1.1.8 System Safety Analysis. During the RVSM approval process, it must be verified analytically that the predicted rate of occurrence of undetected altimetry system failures does not exceed 1 x 10-5 per flight hour. All failures and failure combinations whose occurrence would not be evident from cross-flight deck checks, and which would lead to altitude measurement/display errors outside the specified limits, need to be assessed against this budget. No other failures or failure combinations need to be considered.
A.4.1.1.9 Air Data Systems and Configurations with Multiple Static Source Inputs.
Many aircraft are produced with air data systems making use of three or more static source inputs, and/or three or more air data computers (ADC).
Such systems (often referred to as “triplex” systems or “voting” schemes) are designed with integrated algorithms that monitor and compare the pressures sensed at the static sources. Sources providing “good” pressure values are used in the calculation of corrected altitude. Such configurations are acceptable provided at least two air data systems meet the requirements of paragraphs A4.1.1.1 through A4.1.1.8. Upon failure of one air data system, a second system must remain fully functional in compliance with the requirements of paragraphs A4.1.1.1 through A4.1.1.8.
A.4.1.2 One Secondary Surveillance Radar (SSR) Altitude Reporting Transponder. Any transponder meeting or exceeding the requirements of Technical Standard Order (TSO) C74( ) or TSO C112( ), as applicable, in accordance with the operational regulations under which the airplane is approved.
• An aircraft may be equipped with one or more transponders. If only one is fitted, it should have the capability for switching to obtain input from either altitude measurement system.
A.4.1.3 An Altitude Alert System. The altitude alert system should be capable of operation from either of the two required independent altitude measurement systems. The altitude alert system may be comprised of one or more line replaceable units (LRU), or it may be an integral part of a flight management system or flight management computer.
Appendix A A-9
1. The altitude deviation warning system should signal an alert when the altitude displayed to the flightcrew deviates from selected altitude by more than a nominal value.
• For aircraft for which application for type certification or major change in type design is on or before April 9, 1997, the nominal value must not be greater than ±300 ft (±90 m).
• For aircraft for which application for type certification or major change in type design (e.g., STC) is made after April 9, 1997, the nominal value should not be greater than ±200 ft (±60 m). The overall equipment tolerance in implementing these nominal threshold values should not exceed ±50 ft (±15 m).
A.4.1.4 An Automatic Altitude Control System. The automatic altitude control system is generally comprised of an autopilot with altitude hold mode. The automatic altitude control system should be capable of operation from either of the two required independent altitude measurement systems. Paragraph 6 presents additional options for automatic altitude control configurations found on older, “legacy” aircraft.
A.4.1.4.1 As a minimum, a single automatic altitude control system should be installed which is capable of controlling aircraft height within a tolerance band of ±65 ft (±20 m) about the acquired altitude when the aircraft is operated in straight and level flight under nonturbulent, nongust conditions.
• Aircraft types for which application for type certification is on or before April 9, 1997, which are equipped with an automatic altitude control system with flight management system(FMS)/performance management system inputs allowing variations up to ±130 ft (±40 m) under nonturbulent, nongust conditions do not require retrofit or design alteration.
• If specific tuning is needed for a “legacy” autopilot to meet performance standards in RVSM airspace, this gain scheduling or tuning must not negatively impact the way the autopilot performs in other phases of flight and at non-RVSM altitudes. For example, it is common for older systems to be tuned to meet RVSM tolerance, only to realize they no longer have acceptable vertical performance on a coupled approach.
A.4.1.4.2 Where an altitude select/acquire function is provided, the altitude select/acquire control panel must be configured such that an error of no more than ±25 ft (±8 m) exists between the display selected by the flightcrew and the corresponding output to the control system.
Appendix A A-10 A.5 Altimetry System Performance.
A.5.1 General. The statistical performance statements of ICAO Doc. 9574, Manual on the Implementation of a 300 m (1,000 ft) Vertical Separation Minimum Between FL 290-FL 410 Inclusive, for a population of aircraft (see Appendix D) are translated into airworthiness standards by assessment of the characteristics of ASE and altitude control.
The following standards differ in some respects from that document, but they are consistent with the requirements of RVSM and in accordance with 14 CFR part 91 appendix G, section 2.
A.5.2 Group Approval.
A.5.2.1 The requirements in the basic RVSM envelope are as follows:
1. At the point in the basic RVSM envelope where ASEmean reaches its largest absolute value, the absolute value should not exceed 80 ft (25 m).
2. At the point in the basic RVSM envelope where ASEmean plus ASE3 SD reaches its largest absolute value, the absolute value should not exceed 200 ft (60 m).
A.5.2.2 The requirements in the full RVSM envelope are as follows:
1. At the point in the full RVSM envelope where ASEmean reaches its largest absolute value, the absolute value should not exceed 120 ft (37 m).
2. At the point in the full RVSM envelope where ASEmean plus ASE3 SD reaches its largest absolute value, the absolute value should not exceed 245 ft (75 m).
3. If necessary, for the purpose of achieving RVSM approval for an aircraft Group, an operating restriction may be established to restrict aircraft from conducting RVSM operations in areas of the full RVSM envelope where the absolute value of ASEmean exceeds 120 ft (37 m) and/or the absolute value of ASEmean plus ASE3 SD exceed 245 ft (75 m). When such a restriction is established, identify it in the data package and document it in appropriate aircraft operating manuals; however, visual or aural warning/indication systems should not be required to be installed on the aircraft.
A.5.2.3 Aircraft types for which application for type certification or major change in type design is made after April 9, 1997, should meet the criteria established for the basic envelope in the full RVSM envelope. The FAA will consider factors providing an equivalent level of safety in the application of this criteria as stated in part 21, § 21.21b(1).
Appendix A A-11 A.5.3 Non-Group Approval.
A.5.3.1 The standards of paragraphs A.5.2.1, A.5.2.2 and A.5.2.3, cannot be applied to Non-Group aircraft approval because there can be no Group data with which to develop airframe-to-airframe variability. Therefore, a single ASE value has been established that controls the simple sum of the ASEs. In order to control the overall population distribution, this limit has been set at a value less than that for Group approval.
A.5.3.2 The standard for aircraft submitted for approval as Non-Group aircraft, as defined in paragraph A.3.2 of this Appendix, is as follows:
1. For all conditions in the basic RVSM envelope:
( )m50ft160avionicscaseworstSSEsidualRe ≤+
2. For all conditions in the full RVSM envelope:
( )m60ft200avionicscaseworstSSEsidualRe ≤+
3. Worst-case avionics means that combination of tolerance values, specified by the manufacturer for the altimetry fit into the aircraft, which gives the largest combined absolute value of avionics errors.
For most systems, this may not be a fixed value over time.
A.5.3.3 An operating restriction may be established to restrict the Non-Group aircraft from conducting RVSM operations in areas of the full RVSM envelope where the requirements of paragraph A.5.3.2 cannot be met.
A.5.3.4 The ASE airworthiness standards in Appendix A, sections A.5.2 and A.5.3 should not be confused with the ASE values stated in the height keeping section 5.3. Appendix A sections A.5.2 and A.5.3 represent the ASE performance specification for RVSM airframe airworthiness certification, and is a key element of the RVSM airplane airworthiness certification process.
Section 5.3 presents performance criteria specified for the RVSM height monitoring program, which is an element of the operational quality assurance process. The monitoring program is independent of the airworthiness certification program.
A.6 Aircraft System Configurations: Older “Legacy” Airframes.
A.6.1 Background. This paragraph provides additional guidance regarding configurations found on older model airplanes (also known as “legacy” airplanes, e.g., B707, DC-8, older business jet, and turboprop aircraft, etc.) for which RVSM approval is sought.
A.6.2 Single Autopilot Installation. Paragraph A.4.1.1.7 states the air data system should provide reference signals for automatic control and alerting at selected altitude. These signals should preferably be derived from an altitude measurement system meeting the
Appendix A A-12 full requirements of this Appendix. In addition, paragraph A.4.1.1.7 states the altimetry system must provide an output which can be used by an automatic altitude control system to control the aircraft at a commanded altitude. The output may be used either directly or combined with other sensor signals. The altitude control output may be an altitude deviation signal, relative to the selected altitude, or a suitable absolute altitude output.
A.6.2.1 A distinction can be made between signals derived from an ADC and signals derived from an altitude measurement system. Paragraph A.4.1.1.7 does not mandate the need for dual ADC inputs to the automatic altitude control system.
A.6.2.2 Several airplane model types are equipped with a single autopilot installation.
In many cases, the autopilot is only capable of receiving altitude hold inputs from a single source. It has been further noted retrofitting of these autopilot installations to receive altitude hold input from additional sources
(e.g., another ADC) may yield one or more of the following problems:
1. The retrofit costs are a significant percentage of the total worth of the airframe.
2. The retrofit is not possible without replacement of the autopilot.
3. The retrofit increases air data system complexity, which in turn increases the scenarios and rates of failure.
4. Upgraded avionics (i.e., ADCs) are not available, or the vendors will not support retrofits.
A.6.2.3 There are two common avionics configurations that may meet RVSM requirements, but do not have dual ADC input to the autopilot. A general description and possible means of compliance are given below. They are:
1. Figure A.6-1, Example of Air Data System/Autopilot Configuration.
2. Figure A.6-2, Single Air Data Computer Configuration for Autopilot Input.
A.6.2.4 Independent Source for Altitude Hold Input to the autopilot.
Appendix A A-13 Figure A.6-1. Example of Air Data System/Autopilot Configuration
1. The air data sensor (ADS) is a single LRU activated in altitude hold mode when the pilot presses an ALT HOLD button, after reaching the desired cruise FL. It is not tied to either ADC or other component comprising the air data system. The ADS provides ∆H information to the autopilot so the airplane can maintain the desired altitude. In some configurations, the pilot further provides FL information to the autopilot by manually selecting the displayed altitude (either pilot’s or copilot’s).
2. Airplanes equipped with the avionics configuration shown in Figure A.6-1 may show compliance as follows:
• The airplane must maintain altitude to within ±65 ft of the acquired altitude as required by paragraph A.4.1.4.1. For RVSM compliance, the ∆H signal must be accurate enough such that the airplane maintains the required ±65 ft altitude deviation specification. This may be substantiated with flight test data and/or manufacturer’s specification data.
• The altitude alerter should function if the ADS/ADC fails. If the altitude alert function is not operational, altitude hold performance must be monitored manually.
• The ADS should be compensated such that an airspeed change at a cruise FL is not interpreted by the system as change in altitude, causing altitude hold deviation in excess of ±65 ft.
• The altimetry systems meet the RVSM accuracy requirements specified in paragraphs A.5.2.1 and A.5.2.2, or A.5.3.2, as appropriate.
• All other requirements set forth in this advisory circular (AC), as appropriate, are satisfied.
A.6.2.5 Single ADC Input to the Autopilot. On a large number of older airplane models, the avionics configuration is such that one ADC provides altitude hold information to the autopilot (Figure A.6-2). In most models, a second ADC is also present, or provisions exist so a second can be installed.
autopilot Cross-coupled static sources Cross-coupled static sources Alt Alt ADS 18001800 ADC 2 ADC 1
Appendix A A-14 Figure A.6-2. Single Air Data Computer Configuration for Autopilot Input
1. Airplanes equipped with the avionics configuration shown in Figure A.6-2 may show compliance as follows:
• The airplane must maintain altitude to within ±65 ft of the acquired altitude required by paragraph A.4.1.4.1. This may be substantiated with flight test data or manufacturer’s specification data.
• The altitude alerter should function if either air data system or ADC fails. If the altitude alert function is not operational, altitude hold performance must be monitored manually.
• If ADC1 fails, the airplane must be controlled manually until ATC contingency procedures are executed. Annunciation should be provided if the pilot deviates ±300 ft from desired altitude. This annunciation must be provided automatically by the altitude alert system. If the altitude alert system is not functioning, altitude hold performance must be monitored manually.
• The altimetry systems meet the RVSM accuracy requirements specified in paragraphs A.5.2.1 and A.5.2.2, or A.5.3.2, as appropriate.
• All other requirements in this AC, as appropriate, are satisfied.
A.6.3 Operational Restrictions. Applicants should be aware operational restrictions and/or changes may also be required for aircraft with avionics configurations shown in Figures A.6-1 and A.6-2, to meet all RVSM requirements.
A.7 Altimetry System Performance Substantiation.
A.7.1 Flight Testing: Group and Non-Group Aircraft.
A.7.1.1 Where precision flight calibrations are used to quantify or verify altimetry system performance they may be accomplished by any of the following methods. Flight calibrations should only be performed once appropriate ground checks have been completed, and the certifying authority should agree to the number of flight test conditions. Uncertainties in application of the method must be assessed and taken into account in the data package.
autopilot Cross-coupled static sources Cross-coupled static sources Alt 1 Alt 2 ADC 2 1800 1800 ADC 1
Appendix A A-15
1. Precision tracking radar in conjunction with pressure calibration of the atmosphere at test altitude.
2. Trailing cone.
3. Pacer aircraft. The pacer aircraft must have been directly calibrated to a known standard. It is not acceptable to calibrate a pacer aircraft by another pacer aircraft.
4. Any other method acceptable to the FAA or approving authority.
Note: Data acquired using elements from the RVSM monitoring program, such as a ground-based height monitoring unit (HMU) or Aircraft Geometric Height Measurement Element (AGHME), or a portable Global Positioning System (GPS)-based monitoring unit (GMU), is not acceptable for substantiating the ASE performance specified in paragraphs A.5.2 and A.5.3.
A.7.1.2 ASE will generally vary with flight condition. The data package should provide coverage of the RVSM envelope sufficient to define the largest errors in the basic and full RVSM envelopes. Note in the case of Group approval the worst flight condition may be different for each of the requirements of paragraphs A.5.2.1 and A.5.2.2, and each should be evaluated. Similarly, for Non-Group approval, the worst flight condition may be different for each of the requirements of paragraph A.5.3.2 and each should be evaluated.
A.7.2 Altimetry System Error (ASE) Variability.
A.7.2.1 In order to evaluate a system against the ASE performance statements established by the Review of the General Concept of Separation Panel (RGCSP) (see Appendix D), it is necessary to quantify the mean and three standard deviation (SD) values for ASE, expressed as ASEmean and ASE3 SD. In order to do this, it is necessary to account for the different ways in which variations in ASE can arise. The factors affecting ASE are as follows and should be considered in the ASE evaluation:
A.7.2.1.1 Unit to unit variability of avionics.
A.7.2.1.2 Effect of environmental operating conditions on avionics.
A.7.2.1.3 Effect of transducer and/or avionics component error drift over time.
A.7.2.1.4 Effect of flight operating condition on SSE.
Appendix A A-16 A.7.2.1.5 Airframe to airframe variability of SSE, including the following:
• Skin waviness, skin splices/joints, access panels, radome fit/fair.
• Pitot-static probe variation. This includes manufacturing variation, installation variation, and probe degradation (erosion/corrosion) over time.
• Static port variation (for aircraft configured with static sources flush to the skin surface). Sources of variation include port step-height, degradation, and static port condition.
• SmartProbes© (integrated ADC/pitot-static probe). Smart probes are sensitive to installation variation. They are also capable of complex SSEC algorithms that are a function of several variables, all of which may be affected by probe condition and installation.
A.7.2.2 Assessment of ASE, whether based on measured or predicted data, must include the factors listed above in paragraphs A.7.2.1.1 through A.7.2.1.5. The effect of item A.7.2.1.4 as a variable can be eliminated by evaluating ASE at the most adverse flight condition in an RVSM flight envelope.
A.7.2.3 This document does not specify separate limits for the various error sources contributing to the mean and variable components of ASE as long as the overall ASE accuracy requirements of paragraphs A.5.2 or A.5.3 are met. For example, in the case of Group approval, the smaller the mean of the Group and the more stringent the avionics standard, the larger the available allowance for SSE variations. In all cases, present the trade-off adopted in the data package in the form of an error budget including all significant error sources.
A.8 Altimetry System Component Error Budget.
A.8.1 General. The ASE budget demonstrates the allocation of tolerances among the various parts of the altimetry system is, for the particular data package, consistent with the overall statistical ASE requirements. These individual tolerances within the ASE budget represent the maximum error levels for each of the air data system components contributing to ASE. These error levels form the basis of the maintenance procedures used to substantiate the RVSM airworthiness compliance status of Group or Non-Group aircraft. The component error evaluation should be assessed at the worst flight condition in the basic and full envelope.
A.8.2 Altimetry System Error (ASE) Components.
A.8.2.1 General. Figure A.8-1, Altimetry System Error and its Components, shows the breakdown of total ASE into its main components, with each error block representing the error associated with one of the functions needed to generate a display of pressure altitude. This breakdown encompasses all ASEs that can
Appendix A A-17 occur, although different system architectures may combine the components in slightly different ways.
A.8.2.1.1 The “Actual Altitude” is the pressure altitude corresponding to the undisturbed ambient pressure.
A.8.2.1.2 “SSE” is the difference between the undisturbed ambient pressure and the pressure within the static port at the input end of the static pressure line.
A.8.2.1.3 “Static Line Error” is any difference in pressure along the length of the line.
A.8.2.1.4 “Pressure Measurement and Conversion Error” is the error associated with the processes of transducing the pneumatic input seen by the avionics and converting the resulting pressure signal into altitude. As drawn, Figure A.8-1 represents a self-sensing altimeter system in which the pressure measurement and altitude conversion functions would not normally be separable. In an ADC system, the two functions would be separate and SSEC would probably then be applied before pressure altitude (Hp) was calculated.
A.8.2.1.5 “Perfect SSEC” would be that correction which compensated exactly for the SSE actually present at any time. If such a correction could be applied, then the resulting value of Hp calculated by the system would differ from the actual altitude only by the static line error plus the pressure measurement and conversion error. In general, this cannot be achieved, so although the “Actual SSEC” can be expected to reduce the effect of SSE, it will do so imperfectly.
Appendix A A-18 Figure A.8-1. Altimetry System Error and Its Components
A.8.2.1.6 “Residual SSE” is applicable only in systems applying an avionic SSEC. It is the difference between the SSE and the correction actually applied. The corrected value of Hp will therefore differ from actual pressure altitude by the sum of static line error, pressure measurement and conversion error, and residual SSE.
A.8.2.1.7 Between Hp and displayed altitude occur the baro-correction error and the display error. Figure A.8-1 represents their sequence for a self-sensing altimeter system. ADC systems can implement baro-correction in a number of ways that would modify slightly this part of the block diagram, but the errors would still be associated with either the baro-correction function or the display function. The only exception is those systems that can be switched to operate the display directly from the Hp signal. These systems can eliminate baro-correction error where standard ground pressure setting is used, as in RVSM operations.