CS 29.1431 Electronic equipment
ED Decision 2003/16/RM
(a) Radio communication and navigation installations must be free from hazards in themselves, in their method of operation, and in their effects on other components, under any critical environmental conditions.
(b) Radio communication and navigation equipment, controls, and wiring must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of any other radio or electronic unit, or system of units, required by any applicable CS or operating rule.
ED Decision 2003/16/RM
(a) There must be means, in addition to the normal pressure relief, to automatically relieve the pressure in the discharge lines from the vacuum air pump when the delivery temperature of the air becomes unsafe.
(b) Each vacuum air system line and fitting on the discharge side of the pump that might contain flammable vapours or fluids must meet the requirements of CS 29.1183 if they are in a designated fire zone.
(c) Other vacuum air system components in designated fire zones must be at least fire resistant.
ED Decision 2003/16/RM
(a) Design. Each hydraulic system must be designed as follows:
(1) Each element of the hydraulic system must be designed to withstand, without detrimental, permanent deformation, any structural loads that may be imposed simultaneously with the maximum operating hydraulic loads.
(2) Each element of the hydraulic system must be designed to withstand pressures sufficiently greater than those prescribed in sub-paragraph (b) to show that the system will not rupture under service conditions.
(3) There must be means to indicate the pressure in each main hydraulic power system.
(4) There must be means to ensure that no pressure in any part of the system will exceed a safe limit above the maximum operating pressure of the system, and to prevent excessive pressures resulting from any fluid volumetric change in lines likely to remain closed long enough for such a change to take place. The possibility of detrimental transient (surge) pressures during operation must be considered.
(5) Each hydraulic line, fitting, and component must be installed and supported to prevent excessive vibration and to withstand inertia loads. Each element of the installation must be protected from abrasion, corrosion, and mechanical damage.
(6) Means for providing flexibility must be used to connect points, in a hydraulic fluid line, between which relative motion or differential vibration exists.
(b) Tests. Each element of the system must be tested to a proof pressure of 1.5 times the maximum pressure to which that element will be subjected in normal operation, without failure, malfunction, or detrimental deformation of any part of the system.
(c) Fire protection. Each hydraulic system using flammable hydraulic fluid must meet the applicable requirements of CS 29.861, 29.1183, 29.1185, and 29.1189.
CS 29.1439 Protective breathing equipment
ED Decision 2003/16/RM
(a) If one or more cargo or baggage compartments are to be accessible in flight, protective breathing equipment must be available for an appropriate crew member.
(b) For protective breathing equipment required by sub-paragraph (a) or by any applicable operating rule:
(1) That equipment must be designed to protect the crew from smoke, carbon dioxide, and other harmful gases while on flight deck duty;
(2) That equipment must include:
(i) Masks covering the eyes, nose, and mouth; or
(ii) Masks covering the nose and mouth, plus accessory equipment to protect the eyes; and
(3) That equipment must supply protective oxygen of 10 minutes duration per crew member at a pressure altitude of 2438 m (8000 ft) with a respiratory minute volume of 30 litres per minute BTPD.
CS 29.1457 Cockpit voice recorders
ED Decision 2021/010/R
(See AMC 29.1457)
(a) Each cockpit voice recorder required by the applicable operating rules must be approved, and must be installed so that it will record the following:
(1) Voice communications transmitted from or received in the rotorcraft by radio.
(2) Voice communications of flight-crew members on the flight deck.
(3) Voice communications of flight-crew members on the flight deck, using the rotorcraft’s inter-phone system.
(4) Voice or audio signals identifying navigation or approach aids introduced into a headset or speaker.
(5) Voice communications of flight-crew members using the passenger loudspeaker system, if there is such a system, and if the fourth channel is available in accordance with the requirements of sub-paragraph (c)(4)(ii).
(b) The recording requirements of sub-paragraph (a)(2) may be met:
(1) By installing a cockpit-mounted area microphone, located in the best position for recording voice communications originating at the first and second pilot stations and voice communications of other crew members on the flight deck when directed to those stations; or
(2) By installing a continually energised or voice-actuated lip microphone at the first and second pilot stations.
The microphone specified in this paragraph must be so located and, if necessary, the preamplifiers and filters of the recorder must be so adjusted or supplemented, that the recorded communications are intelligible when recorded under flight cockpit noise conditions and played back. The level of intelligibility must be approved by the Agency. Repeated aural or visual playback of the record may be used in evaluating intelligibility.
(c) Each cockpit voice recorder must be installed so that the part of the communication or audio signals specified in sub-paragraph (a) obtained from the following sources is recorded on at least four separate channels:
(1) From each microphone, headset, or speaker used at the first pilot station.
(2) From each microphone, headset, or speaker used at the second pilot station.
(3) From the cockpit-mounted area microphone, or the continually energised or voice-actuated lip microphones at the first and second pilot stations.
(4) From:
(i) each microphone, headset, or speaker used at the stations for the third and fourth crew members; or
(ii) if the stations specified in sub-paragraph (c)(4)(i) are not required or if the signal at such a station is picked up by another channel, each microphone on the flight deck that is used with the passenger loudspeaker system if its signals are not picked up by another channel.
(iii) Each microphone on the flight deck that is used with the rotorcraft’s loudspeaker system, if its signals are not picked up by another channel.
No channel shall record communication or audio signals from more than one of the following sources: the first pilot station, second pilot station, cockpit-mounted area microphone, and additional crew member stations.
(d) Each cockpit voice recorder must be installed so that:
(1) (i) It receives its electrical power from the bus that provides the maximum reliability for operation of the recorder without jeopardising service to essential or emergency loads; and
(ii) It remains powered for as long as possible without jeopardising the emergency operation of the rotorcraft;
(2) There is an automatic means to stop the recording within 10 minutes after crash impact;
(3) There is an aural or visual means for pre-flight checking of the recorder for proper operation.
(4) Any single electrical failure that is external to the recorder does not disable both the cockpit voice recorder function and the flight data recorder function;
(5) There is a means for the flight crew to stop the cockpit voice recorder function upon completion of the flight in a way such that re-enabling the cockpit voice recorder function is only possible by dedicated manual action; and
(6) It has an alternate power source:
— that provides 10 minutes of electrical power to operate both the recorder and the cockpit-mounted area microphone; and
— to which the recorder and the cockpit-mounted area microphone are switched automatically in the event that all other power to the recorder is interrupted either by a normal shutdown or by any other loss of power.
(e) The container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of:
— impact with the Earth’s surface;
— the heat damage caused by a post-impact fire; and
— immersion in water.
(f) If the cockpit voice recorder has an erasure device or function, the installation must be designed to minimise the probabilities of inadvertent operation and of actuation of the erasure device or function during crash impact.
(g) The recorder container of the cockpit voice recorder must:
(1) be bright orange;
(2) have reflective tape affixed to its external surface to facilitate locating it; and
(3) have an underwater locating device on or adjacent to the container which is secured in such a manner that they are not likely to be separated during crash impact.
[Amdt 29/7]
[Amdt 29/9]
AMC 29.1457 Cockpit Voice Recorders
ED Decision 2021/010/R
This AMC provides further guidance and acceptable means of compliance to supplement FAA AC 29-2C § AC 29.1457. § 29.1457, to meet EASA's interpretation of CS 29.1457. As such, it should be used in conjunction with the FAA AC.
1. General
In showing compliance with CS 29.1457, the applicant should take into account EUROCAE Document ED 112A ‘MOPS for Crash-Protected Airborne Recorder Systems’ or a later revision.
2. Automatic means to stop the recording after a crash impact
The automatic means to stop the recording within 10 minutes after a crash impact may rely on:
a. Dedicated crash impact detection sensors. In this case, negative acceleration sensors (also called ‘g-switches’) should not be used as the sole means of detecting a crash impact; or
b. The recording start-and-stop logic, provided that this start-and-stop logic stops the recording 10 ± 1 minutes after the loss of power on all engines.
3. Means for the flight crew to stop the cockpit voice recorder
The means for the flight crew to stop the cockpit voice recorder function after the completion of the flight is needed in order to preserve the recording for the purpose of investigating accidents and serious incidents. In fulfilling this requirement, it is acceptable to use circuit breakers to remove the power to the equipment. Such a means to stop the cockpit voice recorder function is not in contradiction with FAA AC 29-2C, § AC 29.1357, § 29.1357, point b.(6), because it would not be used under normal operating conditions, but only after an accident or a serious incident has occurred.
4. Power sources
The alternate power source is a power source that is different from the source(s) that normally provides (provide) power to the cockpit voice recorder. In CS 29.1457(d)(6), a ‘normal shutdown’ of power to the recorder means a commanded interruption of the power supply from the normal cockpit voice recorder power bus; for example, after the termination of a normal flight. The following applies to the installation of an alternate power source:
a. A tolerance of 1 minute on the 10 minutes minimum power requirement of CS 29.1457(d)(6) is acceptable;
b. The use of helicopter batteries or other power sources is acceptable, provided that electrical power to the essential and critical loads is not compromised;
c. If the alternate power source relies on dedicated stand-alone batteries (such as a recorder independent power supply), then these batteries should be located as close as practicable to the recorder;
d. If the cockpit voice recorder function is combined with other recording functions within the same unit, the alternate power source may also power the other recording functions; and
e. The means for performing a pre-flight check of the recorder for proper operation should include a check of the availability of the alternate power source.
5. Combination recorder
In cases where the recorder performs several recording functions, the means for pre-flight checking of the recorder for proper operation should indicate which recording functions (e.g. FDR, CVR, data-link recording, etc.) have failed.
6. Evaluation of the CVR recording
The following acceptable means of compliance with CS 29.1457(b) is provided to demonstrate that the performance of a new or modified CVR system is acceptable and that the quality of the CVR recording is acceptable. Inspections of the CVR recording that are part of the instructions for continued airworthiness (ICAs) are not within the scope of this paragraph.
a. The CVR system should be installed in accordance with the recommendations made in EUROCAE Document ED-112A, in particular:
— Chapter 2-5 ‘Equipment installation and installed performance’, and
— Part I ‘Cockpit Voice Recorder System’, Chapter I-6.1.1 ‘Interface design’, I-6.1.2 ‘Recorder Operation’ and I-6.1.3 ‘Bulk Erasure Interlocks’.
Particular attention should be given to the location of the cockpit area microphone (CAM).
ED-112A, Chapter I-6.2. ‘Equipment location’, provides guidance on this topic.
It should be noted that the CVR may record on more than four channels, and that this may help to avoid superimposition between signal sources recorded on the same CVR channel.
b. To ensure that the CVR system is properly installed, and to verify that the audio signals recorded on all channels achieve the acceptable level of quality, the applicant should conduct a flight test. The recording obtained should be evaluated to confirm an acceptable level of quality during all normal phases of flight (including taxi-out, hover, take-off, climb, cruise, descent, approach, landing, taxi-in) and autorotation. ED-112A provides guidance for testing a new CVR installation (refer to Chapter I-6.3).
c. The evaluation of the CVR recording should include:
i. the tasks described in ED-112A, Annex I-A, Chapter I-A.3;
ii. checking that the vocal signal sources are intelligible and that non-vocal alerts on headsets or speakers can be identified;
iii. checking that the levels of side tone signals (e.g. radio) and public address (PA) are adjusted so that these signals are audible and do not mask the signals from the flight crew microphones (refer to ED-112A, Part I, Chapter I-6.1.1);
iv. checking the start-and-stop function of the CVR system. The CVR should begin to operate no later than when power from sources other than from the alternate power source is available and the pre-flight checklist is started. The CVR should continue to operate either until the completion of the final post-flight checklist or until 10 minutes after power is lost on all engines; and
v. checking for the presence of any fault in the memory of the built-in test feature of the CVR, if applicable.
d. The evaluation of the CVR recording should fulfil all of the conditions below:
i. The equipment used for the CVR recording replay should meet the specifications of Chapter I-A.2 of Annex I-A of ED-112A, or a higher standard;
ii. The replay and evaluation of CVR recordings should be performed by personnel with adequate knowledge of CVR systems and aircraft operations, and who have the appropriate experience with the techniques used to evaluate recordings;
iii. The observations from the evaluation should be documented in an evaluation report. An example of an evaluation report is provided in ED-112A, Annex I-A; and
iv. The evaluation report should indicate the quality of each audio signal that is required to be recorded by CS 29.1457(c) according to defined criteria. For example, the following audio quality rating scale may be used:
GOOD:
1. When considering a vocal signal source (crew voice, radio reception, radio side tone, interphone, public address, synthetic voice in call-outs, warnings and alerts) recorded on a channel other than the CAM channel, the signal is intelligible without using any signal post-processing techniques, and no significant issue (e.g. saturation, noise, interference, or inadequate signal level of a source) affects the quality of this signal;
2. When considering non-vocal alerts recorded on a channel other than the CAM channel, the sounds are accurately identifiable in the recording without using any signal post-processing techniques, and no significant issue affects the quality of the sound recording;
3. When considering the CAM, the recording is representative of the actual ambient sound, conversations and alerts as if an observer were listening in the cockpit, and no significant issue affects the quality of the signal; and
4. No ‘medium’ or ‘major’ issue is identified on any channel (see Table 1 below for examples).
FAIR: A significant issue affects the signal source being considered. However, the related signal can still be analysed without signal post-processing, or by using signal post-processing techniques provided by standard audio analysis tools (e.g. audio level adjustment, notch filter, etc.). The severity of the identified issues is not rated higher than ‘medium’ (see Table 1 below for examples).
POOR: The signal source being considered is not intelligible or not identifiable, and this cannot be corrected even with the use of signal post-processing techniques. The severity of the identified issues is not necessarily rated as ‘major’; it may also be rated as ‘medium’ depending on the consequence for the required signal sources (see Table 1 below for examples); and
v. the audio quality rating of a CVR channel required by CS 29.1457(c) should be the same as the worst audio quality rating among the signal sources to be recorded on this channel.
e. The performance of the CVR system should be considered acceptable by the applicant only if, for none of the signal sources required by CS 29.1457(c) or by the applicable operating rules, the audio quality of the recording was rated as ‘POOR’. In addition, if the CVR system is part of a new aircraft type, the performance of the CVR system should be considered acceptable by the applicant only if for all of the signal sources required by CS 25.1457(c) and by the applicable operating rules, the quality of the audio recording was rated as ‘GOOD’.
Table 1: Examples of issues affecting a signal source and of the associated severity
|
Issue severity rating |
Examples of issues |
|
MAJOR —
leading to a ‘POOR’ rating for the affected signal |
— One or more warnings or call-outs are not recorded — Uncommanded interruption of the CAM signal — Unexplained variation of the CAM dynamic range — Hot-microphone function not operative — CVR time code not available — CAM saturation (due to low-frequency vibration) — Radio side tone is missing — One required signal source is missing from the recording (e.g. one microphone signal not recorded) — Poor intelligibility of one microphone source (e.g. speech through oxygen mask microphone) — Quasi-permanent physical saturation of the CAM due to its excessive sensitivity — Quasi-permanent electrical saturation of a CVR channel — Mechanical and/or electrical interference making the transcription of signals difficult or impossible — Insufficient CAM sensitivity — Fault in the start/stop sequence |
|
MEDIUM —
leading to a ‘POOR’ or ‘FAIR’ rating for the affected signals, depending on the duration and the occurrence rate of the issues |
— Inappropriate level balance between signal sources on a CVR channel, which results in a signal source masking other signal sources — Electrical interference caused by either the aircraft or the recorder power supply — Low dynamic range of the recording on a CVR channel — Low recording level of alert and/or call-out — Oversensitivity of the CAM line* to electromagnetic interference in the HF, UHF or EHF domain (Wi-Fi, GSM, 5G, etc.) — Oversensitivity of the CAM line* to electrostatic discharge (ESD) phenomena — Oversensitivity of the CAM to air flow or air-conditioning noise (bleed air) — Phasing anomaly between CVR channels — Side tone recorded with low level — Transitory saturation |
*CAM line: microphone+control or preamplifier unit+wiring to the CVR
7. Instructions for continued airworthiness (ICAs)
When developing the ICAs for the CVR system, required by CS 29.1529 and its Appendix A, the applicant should address all failures that may affect the correct functioning of the CVR system or the quality of the recorded audio signals.
Examples of failures (indicative and non-exhaustive list):
— The loss of the recording function or of the acquisition function of the CVR.
— Any communication or audio signal (required by CS 29.1457(c) or by the applicable air operations regulations) is missing, or is recorded with an audio quality that is rated ‘POOR’ (refer to the example of audio quality rating provided in Section 6 of this AMC).
— The failure of a sensor, transducer or amplifier dedicated to the CVR system (e.g. failure of the cockpit area microphone).
— The failure of a means to facilitate the finding of the CVR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder).
— The failure of any power source dedicated to the CVR (e.g. dedicated battery).
— The failure of the start-and-stop function.
— The failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).
[Amdt 29/7]
[Amdt 29/9]
CS 29.1459 Flight data recorders
ED Decision 2021/010/R
(See AMC 29.1459)
(a) Each flight data recorder required by the applicable operating rules must be approved and must be installed so that:
(1) It is supplied with airspeed, altitude, and directional data obtained from sources that meet the accuracy requirements of CS 29.1323, 29.1325, and 29.1327, as applicable;
(2) The vertical acceleration sensor is rigidly attached, and located longitudinally within the approved centre of gravity limits of the rotorcraft;
(3) (i) It receives its electrical power from the bus that provides the maximum reliability for operation of the flight recorder without jeopardising service to essential or emergency loads; and
(ii) It remains powered for as long as possible without jeopardising the emergency operation of the rotorcraft;
(4) There is an aural or visual means for pre-flight checking of the recorder for proper recording of data in the storage medium;
(5) Except for recorders powered solely by the engine-driven electrical generator system, there is an automatic means to stop the recording within 10 minutes after any crash impact;
(6) If the cockpit voice recorder function is also performed by the recorder and no other recorder is installed on board the rotorcraft, any single electrical failure that is external to the recorder does not disable both the cockpit voice recorder function and the flight data recorder function; and
(7) If another recorder is installed on board the rotorcraft to perform the cockpit voice recorder function, any single electrical failure that is external to the recorder dedicated to the flight data recorder function does not disable both the recorders.
(b) The container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing, as a result of any possible combinations of:
— impact with the Earth’s surface;
— the heat damage caused by post-impact fire; and
— immersion in water.
(c) A correlation must be established between the flight data recorder readings of airspeed, altitude, and heading and the corresponding readings (taking into account correction factors) of the first pilot’s instruments. This correlation must cover the airspeed range over which the aircraft is to be operated, the range of altitude to which the aircraft is limited, and 360° of heading. Correlation may be established on the ground as appropriate.
(d) The container of the flight data recorder must comply with the specifications in CS 29.1457(g) that are applicable to the container of the cockpit voice recorder.
[Amdt No: 29/7]
[Amdt No: 29/9]
AMC 29.1459 Flight Data Recorders
ED Decision 2021/010/R
This AMC provides further guidance and acceptable means of compliance to supplement FAA AC 29-2C § AC 29.1459. § 29.1459, to meet EASA's interpretation of CS 29.1459. As such, it should be used in conjunction with the FAA AC.
1. General
The installation of a recorder with an ETSO authorisation against ETSO-C124 (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 29.1459(a).
In showing compliance with CS 29.1459, the applicant should take into account EUROCAE Document ED-112A ‘MOPS for Crash-Protected Airborne Recorder Systems’ or a later revision.
’FDR system’ designates the flight data recorder (FDR) and its dedicated equipment. It may include the following items as appropriate to the aircraft:
a. Equipment necessary to:
i. acquire and process analogue and digital sensor signals;
ii. store the recorded data in a crash-survivable recording medium; and
iii. when necessary, support dedicated sensors.
b. Digital data buses and/or networks providing communications between the elements of the system.
2. Automatic means to stop the recording after a crash impact
Refer to the Section of AMC 29.1457 titled ‘Automatic means to stop the recording after a crash impact’.
3. Combination recorder
Refer to the Section of AMC 29.1457 titled ‘Combination recorder’.
4. Instructions for continued airworthiness (ICAs)
When developing the ICAs for the FDR system, required by CS 29.1529 and its Appendix A, the applicant should address all failures that may affect the correct functioning of the FDR system or the quality of the recorded data.
Examples of failures (indicative and non-exhaustive list):
— The loss of the recording function or of the acquisition function of the FDR.
Any parameter (required by CS 29.1459(a)(1) or by the applicable air operations regulations) is missing or is not correctly recorded.
— The failure of a sensor dedicated to the FDR system.
— The failure of a means to facilitate the finding of the FDR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder).
— The failure of the start-and-stop function.
— The failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).
In addition, the ICAs should include the following items, unless the applicant shows that this is not applicable:
— Calibration checks of the parameters from sensors dedicated to the FDR to verify the accuracy of these parameters; and
— FDR decoding documentation:
i. Definitions
FDR decoding documentation: a document that presents the information necessary to retrieve the raw binary data of an FDR data file and convert it into engineering units and textual interpretations.
Fixed frame recording format: a recording format organised in frames and subframes of a fixed length and that are recorded chronologically. ARINC specifications 573 and 717 provide an example of a fixed frame recording format.
Variable frame recording format: a recording format based on recording frames which are individually identified and time stamped, so that their order in the recording file is not important. ARINC specification 767 provides an example of variable frame recording format.
ii. Content of the FDR decoding documentation
The FDR decoding documentation should at least contain information on the following:
— the aircraft make and model;
— the document modification date and time;
— in the case of a fixed-frame recording format:
— the sync pattern sequence;
— the number of bits per word, of words per subframe and of subframes per frame; and
— the time duration of a subframe;
— in the case of a variable-frame recording format, the list of frames, and for each frame:
— its identification;
— information on whether the frame is scheduled or event triggered;
— the recording rate (for a scheduled frame);
— the frame event condition (for an event-triggered frame); and
— the list of parameters, by order of recording;
— for every parameter:
— the identification: name (and mnemonic code or other identification if applicable);
— the sign convention and the units of the converted values (if applicable);
— the location of each parameter component in the data frame;
— instructions and equations to assemble the parameter components and convert the raw binary values into engineering units (if applicable); and
— the conversion to text or the discrete decipher logic (if applicable).
iii. Format of the FDR decoding documentation
The FDR decoding documentation should:
— be provided in an electronic format;
— contain all the information described in paragraph (ii) above; and
— comply with the standard of ARINC Specification 647A or a later equivalent industry standard.
[Amdt 29/7]
[Amdt 29/9]
CS 29.1460 Data link recorders
ED Decision 2021/010/R
(See AMC 29.1460)
(a) Each recorder performing the data link recording function required by the operating rules must be approved and must be installed so that it will record the data link communication messages related to air traffic service (ATS) communications to and from the rotorcraft.
(b) Each data link recorder must be installed so that:
(1)(i) it receives its electrical power from the bus that provides the maximum reliability for the operation of the recorder without jeopardising service to essential or emergency loads; and
(1)(ii) it remains powered for as long as possible without jeopardising the emergency operation of the rotorcraft; and
(2) there is an aural or visual means for pre-flight checking of the recorder for the proper recording of data in the storage medium.
(c) The container of the recording medium must be located and mounted so as to minimise the probability of the container rupturing, the recording medium being destroyed, or the underwater locating device failing as a result of any possible combinations of:
— impact with the Earth’s surface;
— the heat damage caused by a post-impact fire; and
— immersion in water.
(d) The container of the data link recorder must comply with the specifications applicable to the container of the cockpit voice recorder in CS 29.1457(g).
[Amdt 29/9]
AMC 29.1460 Data link recorders
ED Decision 2021/010/R
1. General
The installation of a recorder with an ETSO authorisation against ETSO-C177 (or equivalent standard accepted by EASA) satisfies the approval requirement in CS 29.1460(a).
In showing compliance with CS 29.1460, the applicant should take into account EUROCAE Document ED-112A, ‘Minimum Operational Performance Specification for Crash Protected Airborne Recorder Systems’, dated September 2013, or standard later revision.
‘DLR system’ designates the data link recorder (DLR) and its dedicated equipment. It may include the following items as appropriate to the aircraft:
a. A crash-protected recorder.
b. Digital interface equipment suitable for converting a data link communication message into a format which is to be recorded.
c. Digital data buses and/or networks providing communications between the elements of the system.
The data link recording function may be performed by:
a. a cockpit voice recorder;
b. a flight data recorder;
c. a flight data and cockpit voice combination recorder; or
d. a dedicated data link recorder.
2. Combination recorders
Refer to the paragraph of AMC 29.1457 titled ‘Combination recorder’.
3. Recorded data
The recorded data should be sufficient to allow investigators, in the framework of an accident or incident investigation, to accurately reconstruct the sequence of data link communications between the aircraft and the air traffic service units, other aircraft and other entities. For this purpose, the data link recording should comply with the following:
a. EUROCAE Document ED-93, ‘Minimum Aviation System Performance Specification for CNS/ATM Message Recording Systems’, Section 2.3.1, ‘Choice of recording points’, and Section 2.3.2, ‘Choice of data to be recorded on board the aircraft’; and
b. EUROCAE Document ED-112A, ‘Minimum Operational Performance Specification for Crash Protected Airborne Recorder Systems’ (dated September 2013), Part IV, Chapter IV-2, Section IV-2.1.6, ‘Data to be recorded’.
4. Instructions for continued airworthiness (ICAs)
When developing the ICAs for the DLR system, required by CS 29.1529 and its Appendix A, the applicant should address all failures that may affect the correct functioning of the DLR system or the integrity of the recorded information.
Examples of failures (indicative and non-exhaustive list):
— The loss of the recording function or of the acquisition function of the DLR.
— Part of the data link communication (required by CS 29.1460(a) or by the Air Operations Regulation) is missing or is corrupted.
— The failure of a means to facilitate the finding of the DLR recording medium after an accident (e.g. an underwater locating device or an emergency locator transmitter attached to the recorder).
— The failure of a means to detect a crash impact (for the purpose of stopping the recording after a crash impact, or for the purpose of deploying the recorder if it is deployable).
In addition, the ICAs should include the following, unless the applicant shows that this is not applicable:
— Documentation to perform the following:
i. convert the recorded data back to the original format of the data link communication messages;
ii. retrieve the time and the priority of each recorded message; and
iii. correlate the recorded messages with the FDR and CVR recordings.
[Amdt 29/9]
CS 29.1461 Equipment containing high energy rotors
ED Decision 2003/16/RM
(a) Equipment containing high energy rotors must meet sub-paragraphs (b), (c), or (d).
(b) High energy rotors contained in equipment must be able to withstand damage caused by malfunctions, vibration, abnormal speeds, and abnormal temperatures. In addition:
(1) Auxiliary rotor cases must be able to contain damage caused by the failure of high energy rotor blades; and
(2) Equipment control devices, systems, and instrumentation must reasonably ensure that no operating limitations affecting the integrity of high energy rotors will be exceeded in service.
(c) It must be shown by test that equipment containing high energy rotors can contain any failure of a high energy rotor that occurs at the highest speed obtainable with the normal speed control devices inoperative.
(d) Equipment containing high energy rotors must be located where rotor failure will neither endanger the occupants nor adversely affect continued safe flight.
CS 29.1465 Vibration Health Monitoring
ED Decision 2012/022/R
(a) If certification of a rotorcraft with vibration health monitoring of the rotors and/or rotor drive systems is requested by the applicant, then the design and performance of an installed system must provide a reliable means of early detection for the identified failure modes being monitored.
(b) If a vibration health monitoring system of the rotors and/or rotor drive systems is required by the applicable operating rules, then the design and performance of the vibration health monitoring system must, in addition, meet the requirements of this paragraph.
(1) A safety analysis must be used to identify all component failure modes that could prevent continued safe flight or safe landing, for which vibration health monitoring could provide a reliable means of early detection;
(2) All typical VHM indicators and signal processing techniques should be considered in the VHM System design;
(3) Vibration health monitoring must be provided as identified in subparagraph (1) and (2), unless other means of health monitoring can be substantiated.
[Amdt 29/3]
AMC 29.1465 Vibration health monitoring
ED Decision 2012/022/R
a. Explanation
(1) The purpose of this AMC is to provide an Acceptable Means of Compliance and Guidance Material for the design and certification of Vibration Health Monitoring (VHM) applications. VHM is used to increase the likelihood of detection of dynamic component incipient faults in the rotors and rotor drive systems that could prevent continued safe flight or safe landing, by providing timely indications of potential failures to maintenance personnel.
(2) Designing a VHM system in accordance with this AMC is expected to achieve the required performance together with acceptable levels of system integrity and reliability for compliance with type certification and/or operational regulations that require VHM of rotor and/or rotor drive systems.
(3) This AMC defines terms, processes, performance and standards that a VHM system should meet and also the support that a VHM approval holder should provide after the system has entered into service.
(4) VHM systems which satisfy this AMC and that perform functions, the failure of which are categorised as Minor or No Safety Effect (see paragraph p.), can be accepted without the need for additional compliance with AC 29-2C MG15.
Note 1: FAA AC 29-2C Miscellaneous Guidance (MG)15, which addresses the use of HUMS in Maintenance, is complementary to this AMC.
Note 2: If an applicant wishes to install a VHM system that is not compliant with CS 29.1465(a), it may still be accepted for installation on a “No hazard/No credit” basis. However, it cannot replace any existing type-design maintenance instructions or change the established methods of complying with CS-29.
b. Procedures
(1) CS 29.1465 does not mandate the fitment of VHM systems. However, if a VHM system is installed on the rotorcraft to meet a type-certification or operational rule, then compliance is required. Three typical scenarios are foreseen as to when compliance by the applicant may be requested. The three scenarios in question are:
(i) as a means of demonstrating compliance with an operational rule requiring helicopters be fitted with a VHM system and that operators of such helicopters implement procedures covering data collection, analysis and determination of serviceability;
(ii) as a selected compensating provision to mitigate the probability of a failure condition, identified from the design assessments of CS 29.547(b) and/or CS 29.917(b), from arising;
(iii) on a voluntary basis to meet a customer requirement or company objective.
(2) CS 29.1465(a) allows non-required and/or partial VHM applications with limited capability to monitor specific failure modes to be approved. Such systems can offer safety benefits and it is not the intention here to discourage their installation and use. However, any installed system must meet CS 29.1301 and be of a kind and design appropriate to its intended function and function properly when installed. The guidance given in this AMC is therefore considered to be applicable to these types of VHM systems.
(3) Where an operating rule mandates installation of a VHM system, CS 29.1465(b) aims to provide a VHM system capability that maximises the safety benefit. All typical VHM indicators and signal processing techniques should be considered in the VHM design and a system safety assessment undertaken to identify failure modes where VHM could provide early detection of incipient failures. VHM must be provided for all potential failure modes unless other means of health monitoring can be substantiated.
(4) The safety analysis required by CS 29.1465(b)(1) is limited to rotors and rotor drive systems. The existing design assessments of CS 29.547 and CS 29.917 can be used for this purpose. All component failure modes that could prevent continued safe flight or safe landing (Catastrophic and Hazardous failure conditions) and for which vibration health monitoring could provide a reliable means of early detection must be identified. Previous experience together with the guidance in this AMC can be used to determine failure modes that could benefit from VHM and the applicable techniques that can produce reliable indications of incipient failures.
(5) CS 29.1465(b)(2) requires the design and performance of the VHM system to consider indicators and processing techniques used on typical existing VHM installations. A non-exhaustive list is provided in Table 1 of this AMC.
(6) CS 29.1465(b)(3) states that VHM must be provided as identified in subparagraph (b)(1) and (b)(2), unless other means of health monitoring can be substantiated. For many failure modes, there may be other compensating provisions which are capable of providing protection against the risk of premature failure. In such cases, the added benefit of VHM in increasing the likelihood of early detection should be assessed. It will not be necessary to implement VHM for a given failure mode if no safety benefit can be established.
c. Definitions
(1) Alarm: An Alert that, following additional processing or investigation, has resulted in a maintenance action being required.
(2) Alert: An indication produced by the VHM system that requires further processing or investigation by the operator to determine if corrective maintenance action is required.
(3) Commercial Off-the-Shelf (COTS): This term defines equipment hardware and software that is not qualified to aircraft standards.
(4) Controlled Service Introduction (CSI): A period in-service where capabilities and functions that could not be verified prior to entry into service (including support functions) are evaluated.
(5) False Alarm: An Alert that after further processing or investigation has resulted in unnecessary maintenance action.
(6) False Alert: This is an Alert that after further processing or investigation has been determined to not require any further action.
(7) Ground-Based System: A means of access to VHM data, including Alerts, for immediate post-flight fault diagnosis by the responsible maintenance staff.
(8) Prognostic Interval: The predicted time between an Alarm and the component becoming unairworthy.
(9) Vibration Health Monitoring (VHM): Use of data generated by processing vibration signals to detect incipient failure or degradation of mechanical integrity.
(10) VHM Application: A VHM function implemented for a defined purpose.
(11) VHM Indicator: A VHM Indicator is the result of processing sampled data by applying an algorithm to achieve a single value, which relates to the health of a component with respect to a particular failure mode.
(12) VHM System: Typically comprises vibration sensors and associated wiring, data acquisition and processing hardware, the means of downloading data from the rotorcraft, the Ground-Based System and all associated instructions for operation of the system.
d. Component Monitoring Capability
The scope of the VHM capability is determined by the range of components monitored and their incipient failures which can be detected. For each component to be monitored the range of potential damage being diagnosed should be declared and the principles of the monitoring techniques applied should be described. The health monitoring effectiveness should be demonstrable (see paragraph o).
e. System Design Considerations
(1) Sensors: They are the hardware that measures vibration. They should provide a reliable signal with an appropriate and defined performance. The position and installation of a vibration sensor is as critical as its performance. Sensor selection, positioning and installation should be designed to enable analysis of the processed signals to discriminate the vibration characteristics of the declared monitored component failure modes. Built-In Test capability is necessary to determine the correct functioning of the sensor. Maintenance instructions should ensure that the correct function, and any calibration, of sensors and their installation are adequately controlled.
(2) Signal Acquisition: It is likely that processed VHM data will be sensitive to the flight regime of the rotorcraft. For this reason it is desirable to focus data acquisition to particular operating conditions or phases of flight. Consideration should be given to the likely operation of rotorcraft that may utilise the VHM system and the practicality of acquiring adequate data from each flight to permit the Alert and Alarm processing to be performed to the required standard. The method of vibration signal acquisition should be designed so that:
(i) The vibration signal sampling rate is sufficient for the required bandwidth and to avoid aliasing with an adequate dynamic range and sensitivity.
(ii) The data acquired from the vibration signal should be automatically gathered in specifically defined regimes at an appropriate rate and quantity for the VHM signal processing to produce robust data for defect detection.
(iii) If the mission profile does not allow regular acquisition of complete data sets, then the data acquisition regimes should be capable of reconfiguration appropriate to particular flight operations.
(iv) The acquisition cycle should be designed in such a way that all selected components and their defects are monitored with an adequate frequency irrespective of any interruptions in the cycle due to the operational profile.
(3) Signal Processing: The helicopter’s rotor and rotor drive systems are a mixture of complex and simple mechanical elements. Therefore, the signal processing or the analysis techniques utilised should reflect the complexity of the mechanical elements being monitored as well as the transmission path of the signal and should be demonstrated as being appropriate to the failure modes to be detected. The objective of processing the sampled data should be to produce VHM Indicators that clearly relate to vibration characteristics of the monitored components, from which the health of these components can be determined. A key part of the success of in-service VHM is the signal-to-noise enhancement techniques such as vibration signal averaging for gears and signal band-pass filtering and enveloping for bearings. These techniques are used to generate enhanced component vibration signatures prior to the calculation of the VHM Indicators. Accordingly, the method of signal enhancement should be shown to be effective. The method of signal processing and the analysis techniques utilised to generate the data used for defect detection should be defined for the claimed defect detection capability (see Table 1 below).
Table 1: Typical Vibration Health Monitoring Indicators & Signal Processing Techniques
|
Assembly |
Component Type |
Types of VHM indicators used |
|
Engine to main gearbox input drive shafts |
Shafts |
Fundamental shaft order and harmonics |
|
Gearboxes |
Shafts |
Fundamental shaft order and harmonics |
|
Gears |
Gear meshing frequency and harmonics, modulation of meshing waveform, impulse detection and energy measurement, non-mesh-related energy content |
|
|
Bearings |
High frequency energy content, impulse detection, signal envelope modulation patterns and energies correlated with bearing defect frequencies |
|
|
Tail rotor drive shaft |
Shafts |
Fundamental shaft order and harmonics |
|
Hangar Bearings |
As for gearbox bearings, but can utilise simple band-passed signal energy measurements |
|
|
Oil cooler |
Oil Cooler Blower and Drive Shaft |
Fundamental shaft order and harmonics, blade pass frequency |
|
Main and Tail rotor |
Rotors |
Fundamental shaft order and harmonics up to blade pass frequency, plus multiples of this. |
Recording and storing of some raw vibration data and the processed vibration signal, from which the Indicators are derived, may also be of significant diagnostic value. Typical signal processing techniques include;
(i) Asynchronous Power Spectrum where phase information or frequency tracking is not required.
(ii) Synchronous Spectrum where phase information or frequency tracking is required.
(iii) Band-pass filtered signal Envelope Power Spectrum Analysis (a recommended technique for gearbox bearings).
(iv) Synchronous Averaging for time and frequency domain signal analysis (a recommended technique for gearbox gears).
(v) Band-pass filtering and the measurement of filtered signal statistics, including crest factor (can be used for bearings not within engines or gearboxes).
(vi) Further signal enhancement techniques are typically required in the calculation of certain VHM indicators targeted at detecting specific defect-related features (e.g. localised signal distortion associated with a gear tooth crack).
Note 1: When showing compliance to CS 29.1465(a), for non-required and/or partial VHM applications with limited capability to monitor specific failure modes, it is not necessary to address the scope of VHM capability stated in Table 1.
Note 2: When showing compliance to CS 29.1465(b), it is not always necessary for the VHM system to cover the complete capability defined in Table 1. However, absence of any of these areas, and/or techniques, should be substantiated. It is acknowledged that the above provides a prescriptive scope for monitoring rotor and rotor drive system components. If alternative methods are proposed, which can be shown to be as effective and reliable as those prescribed and which are to the satisfaction of the Agency, then these can also be accepted.
f. Data Management
The data transfer process from the rotorcraft to the maintenance personnel interface should be sufficient to determine all the VHM Indicators post flight. The upload/download should have minimal impact on flight operations. VHM data should be accessible in order to permit alternative analysis and comparison. The following should be specified:
(1) Data transfer, processing, networking, data integrity assurance.
(2) Methods to ensure the reliability of this process.
(3) The time for upload/download and retrieval of data and/or health report.
(4) Facilities for the warehousing of all of the data downloaded from the VHM systems and to permit timely access to the data.
g. Alert Management
(1) VHM Alert Generation: VHM Alert criteria should be applied to every monitored component. VHM Alerts are produced to indicate possible anomalous behaviour or a specific defect.
Note: The fixed or learnt thresholds for each individual health monitoring indicator may have a limited capability to detect incipient failures in a timely manner. This is because the process for threshold setting is sometimes a compromise between increasing sensitivity and incurring a higher risk of false alarms, or reducing sensitivity, which will delay the point at which a rising indicator value will trigger an alert. In-service experience has shown that MGB component fatigue failures can propagate from initiation to failure in a relatively short period of time, thus the use of fixed thresholds alone may not provide a timely indication of impending failure. One characteristic that can often provide an earlier indication of anomalous behaviour is the rate of change of a health monitoring indicator, and automatic trend detection software has been developed and shown to be effective. Another method, commonly referred to as Advanced Anomaly Detection (AAD), combines numerous indicators into multi-dimensional parameters, whereby simultaneous changes of multiple indicators can provide increased confidence of the anomalous behaviour at an earlier point in the failure process. (Further information on AAD can be found in Related documents v.(3)).
(2) VHM Alert Management: Diagnostic processes are required to determine if VHM driven maintenance of the rotorcraft is necessary.
h. Pilot Interface
Pilot interaction with the VHM system, if any, should be specified and should not adversely impact on pilot workload.
Note: The level of system integrity for VHM provided under this AMC is not sufficient to support the provision of in-flight cockpit VHM alerts.
i. Maintenance Personnel Interface
The person responsible for releasing a rotorcraft into service should be provided with VHM data, maintenance recommendations and VHM system Built-In Test data necessary to release that rotorcraft. This should include the ability to view VHM Indicators, trend data and detection criteria, including thresholds, for relevant VHM parameters from that rotorcraft. These capabilities should be available locally to maintenance personnel for immediate post flight fault diagnosis.
j. Fleet Diagnostic Support Interface
Where an operator has multiple rotorcraft of the same type, facilities should be made available to the operator to support the analysis of all data acquired by the VHM systems in the operator’s fleet. The operator and all parties supporting the operator should have remote, multi-user and timely access to the data and the diagnostic processes in order to assist in determining the continued airworthiness of their fleet.
k. VHM system installation
The VHM system installation must comply with CS-29, as applicable to the specific rotorcraft type.
l. Ground-Based System Architecture
Any Ground-Based System Architecture requirements should be specified (see paragraph q. Technical Publications). The Ground-Based System may include COTS hardware, software and services, compatible with the Data Management objectives of paragraph (f) above.
m. Software
(1) For the case where the VHM system is stand alone
All software that makes up the VHM processing, whether airborne or ground-based, is to be produced to the software quality standard required to achieve the necessary level of system integrity.
All COTS software should be identified and should be of a quality standard that does not compromise the overall system’s integrity.
All ground-based system software (specifically developed for VHM processing and COTS) should be developed to EUROCAE ED-109A/RTCA DO-278A Assurance Level 5 (AL5). DO 278 Assurance Level 5 (AL5) provides an acceptable method for acceptance of ground-based systems which include COTS.
VHM applications with hazard severity level Major or higher are addressed by MG15 and not AMC 29.1465.
Note: EUROCAE ED-12C/RTCA DO-178C Level D software for airborne systems and EUROCAE ED-109A/RTCA DO-278A Assurance Level 5 for non-airborne systems can be applied where VHM is utilised in addition to traditional helicopter design provisions. This will not require certification to a level any higher than Minor, based on the required reliability for these VHM applications. Should a design be proposed where greater reliance was placed solely on VHM, this would not be in compliance with the “minimise” target of CS 29.917(b) and CS 29.547(b).
(2) For the case where the VHM is integrated into a system with other functions
Software partitioning is addressed in both EUROCAE ED-12C/RTCA DO-178C and EUROCAE ED-109A/RTCA DO-278A.
n. Performance Criteria
(1) Signal Acquisition
The applicant for VHM system certification should specify the rate of acquisition of data sets for defect diagnostics in consistent flight regimes.
As a target, the total data set acquired in a flight should be sufficient for complete and reliable diagnostics to be produced for every flight above a defined duration in stabilised conditions. As a minimum, at least the data set for all components should be automatically obtained on each flight of greater than 30 minutes in stabilised conditions without the need for in-flight pilot action. For operations which do not contain periods of stabilised operation of greater than 30 minutes, alternative procedures need to be incorporated to ensure that the total data set is recorded within a specified number of flying hours related to the minimum adequate frequency of data collection determined under AMC 29.1465(e)(2), and in any case no longer than 25 flying hours.
Where subsystem performance is critical or relied upon to achieve the quoted defect probability of detection or False Alert rate, such as sensor accuracy, dynamic range or bandwidth, then this should be quoted.
(2) Data transfer and Storage Capability
The VHM defect status data should be capable of being downloaded during rotors running turnarounds.
All the data sets acquired should be stored until successfully transferred to the Ground-Based System. The storage capacity should not be less than 25 flying hours.
The applicant should describe the maximum interval between data downloads for which the system memory capacity is not exceeded.
In the event that a complete data set is not recorded, the data transfer process should be capable of downloading a partial data set to the Ground-Based System. In such a case, the ground station should alert maintenance personnel of a missing maintenance log or that the data set provided is incomplete.
(3) VHM Alert generation and fault detection performance
The Alert and Alarm generation processing should be designed to achieve a claimed probability of detection that is acceptable to the Agency for each component defect being monitored. Processing to isolate False Alerts and False Alarms should not result in an unacceptable workload. Also this processing should not compromise the verification and validating evidence of claimed defect detection performance. This workload should be assessed prior to completion of the Controlled Service Introduction (CSI) phase.
o. Performance Validation
The applicant should demonstrate how the VHM system provides an acceptable defect detection performance. Experiences gained during the CSI phase should be reviewed to confirm that this is the case.
(1) Validation methodology
It is not practical to verify predicted component defect detection performance for all failure modes by in-service experience or by trials. Therefore it is necessary that the methodology employed can be clearly substantiated from an understanding of how the failure mechanisms affect vibration and how the diagnostic processing will generate appropriate Alarms. Direct or indirect evidence should be provided as follows:
(i) Direct evidence includes:
(A) Actual service experience on VHM equipped rotorcraft of the same or of similar type and configuration, including information from module strips, component removals, inspections and other investigations which is relevant to the review of VHM system performance.
(B) Test rig results.
(C) Rotorcraft trials, investigating cause and effect (for example, introducing degrees of imbalance or mal-alignment and calibrating the techniques response). This should be supported by flight experience to demonstrate that the False Alert criterion can be met and that all the diagnostic indicators lie within reasonable ranges.
Note: A mechanism should be established for requesting maintenance feedback with respect to component failure/degradation and VHM indication. The cases are as follows:
— to verify component condition following rejection after an Alarm, in order to establish the diagnostic accuracy, probability of detection and the False Alarm rate.
— to inform the TC holder in the event that a failure occurs which is monitored by VHM, where the VHM fails to provide an Alarm. This will provide the missed Alarm rate.
(ii) Indirect evidence includes:
(A) Evidence as to the provenance of the technology and its suitability for application to rotorcraft.
(B) Reference to adequate performance in other applications.
(C) Modelling of the processes
The types of evidence stated in (i) and (ii) above can be used to substantiate:
(A) That the Alert processing methodology can deliver an adequate False Alarm rate, Prognostic Interval and probability of detection.
(B) Data acquired in a flight is sufficient for complete and reliable diagnostics to be produced for every flight above a minimum duration in stabilised conditions.
(C) The sensitivity, dynamic range and bandwidth of the signal acquisition are adequate.
(D) That the processed vibration signal-to-noise ratio is acceptable and that it is capable of discriminating the features required to identify potential incipient defects for the monitored components.
Typically, the False Alarm Rate and Alert Management performance will be validated during the CSI phase.
p. VHM System Criticality
(1) It is necessary to understand the criticality of a VHM function in order to determine the appropriate level of integrity required. Criticality describes the severity of the end result of a VHM application failure/malfunction and is determined by an assessment that considers the safety effect that the VHM application can have on the rotorcraft.
Note: The criticality of the VHM function relates only to its contribution to the overall integrity of the component being monitored.
(2) The criticality categories are defined in FAA AC 29.1309. In order to determine the appropriate level of criticality of the VHM function, it will be necessary to perform a safety assessment or functional hazard analysis on the rotorcraft systems affected. This should be carried out in accordance with standard safety assessment requirements such as CS 29.1309. In performing this assessment it will be necessary to consider the possibility of dormant and common mode failures and the possibility of the VHM system introducing additional risks, e.g. due to the False Alarm rate.
(3) Different VHM Systems have functions that can have different levels of criticality, such as those described below:
(i) Many VHM applications provide a method of enhanced health monitoring which adds to traditional techniques that have been used to establish an acceptable level of component integrity. Where a VHM application is not necessary for compliance with CS 29.547(b) and/or CS 29.917(b), the failure effect of these functions is considered to be ‘No Safety Effect’ when there have been no changes to the traditional techniques.
(ii) Where a VHM application is identified as a compensating provision in order to comply with CS 29.547(b) and/or CS 29.917(b), then the failure criticality is considered to be ‘Minor’. A proposed design that places greater reliance on VHM would not be deemed compliant with the “minimise” target of CS 29.547(b) and CS 29.917(b).
(iii) When an on-board VHM system is used to replace existing portable test equipment, and is performing an identical function, (though not necessarily utilising the same method of detection), this can be classified as ‘No Safety Effect’, providing that in such cases there will be no reduction in scheduled component inspection, or extension of overhaul or replacement intervals. A level of system integrity related to Minor criticality supports the reduction or elimination of check flights after standard vibration reduction checks and/or adjustments (rotor track and balance, balancing, absorber tuning, etc.).
As this equipment is airborne equipment, it is considered that a quality standard for the software used is necessary. For this reason software to EUROCAE ED-12C/RTCA DO-178C Level D is necessary.
Note: As there should be no effect on safety of the helicopter as a result of utilising the airborne system, it will not be necessary to carry out recurring independent verification means.
(iv) When a validated on-board VHM system is used to replace an existing maintenance task, this can be considered to be minor if the validated detection capability and integrity is better than the maintenance task being replaced. For example, VHM system monitoring of grease packed bearings which results in modification to manual inspection intervals.
For use of EUROCAE ED-12C/RTCA DO-178C level D software, it will be necessary to carry out periodic functional verification of the VHM system for dormant hardware or software failure or following a hardware or software change. An alternative approach to periodic functional verification is the retention of the original inspection at an increased interval. These instructions will need to be specified in the ICA.
Note: In cases (iii) and (iv), it is essential that the reliability and accuracy of the VHM must be equal to or better than that of the process it is replacing. This will require direct or indirect verification such as seeded fault testing (bench) or operational experience in accordance with paragraph (o) of this AMC. Compliance with paragraph (o) may require access to the design data and MSG3 analysis (or equivalent) used during substantiation of the original maintenance task.
q. Technical Publications
Appropriate Instructions for Continued Airworthiness (ICA) are required by CS 29.1529 and Appendix A. ICA and other supporting data should be available to operators and maintenance organisations before entry into service and should be updated whenever necessary during the service life of the system.
ICA should include the following:
(1) Guidance for the interpretation of the diagnostic information produced by the VHM system for all components monitored, to include Alert and Alarm management, a description of the indicators, and Alert generation methods.
(2) Maintenance instructions defining the actions to be taken in the event of all Alarms, including the appropriate rotorcraft inspections (or other maintenance) necessary for fault-finding to verify the Alarm.
(3) Scheduled maintenance to be carried out on the VHM system itself, including inspections to confirm sensor performance and system functionality.
(4) Instructions for all maintenance of the VHM System, including Illustrated Parts Catalogue/Illustrated Parts Breakdown and wiring diagrams.
(5) Installation instructions for retrofit VHM systems addressing all aspects of VHM system integration with the rotorcraft.
(6) A recommendation of the maximum period of unavailability of VHM functions for inclusion in the rotorcraft Master Minimum Equipment List (MMEL) or maintenance instructions, as required.
(7) Operating Instructions detailing the operation of the VHM system including any ground-based elements or functions.
(8) Required Flight Manual instructions.
r. Training
Suitable training should be made available with respect to operation and maintenance of the VHM system. This training should be made available prior to initial delivery of the VHM system. Training material and training courses should evolve to include lessons learned from service experience and appropriate diagnostic case studies. Training material and training courses should cover:
(1) Installation of the VHM system.
(2) Line maintenance of the VHM system (including VHM system fault-finding, any calibration necessary).
(3) Use of the VHM System during Line maintenance to monitor the rotorcraft, including the data transfer, interface with data analysis, response to Alerts and Alarm processing, rotorcraft fault-finding and other Line diagnostic actions.
(4) Necessary system administration functions, covering operational procedures relating to data transfer and storage, recovery from failed down loads and the introduction of hardware and software modifications.
(5) Any data analysis and reporting functions that are expected to be performed by the operator.
s. Product Support — System Data and Diagnostic Support
The necessary support should be provided to operators to ensure that the VHM system remains effective and compliant with any applicable requirements throughout its service life. The support provided should cover both the VHM system itself (i.e. system support), and the data generated (data and diagnostic support).
The data and diagnostic support provided should ensure that:
(1) The operator has timely access to approved external data interpretation and diagnostic advice. It is the responsibility of the approval holder to provide this information; however, this may also involve.
t. Minimum Equipment List (MEL) Recommendation
The MEL should address the Airborne Element of the VHM system. The maximum period for absence of an assessment of any VHM indicator, to which Alert criteria are applied, should be limited to a suitable period and should not exceed 25 hours.
Note: If the VHM data is subject to close monitoring due to an increased likelihood of a developing mechanical problem, the maximum alleviation of 25 hours provided by the MMEL should be reduced or removed.
It is recommended that the VHM system automatically generates an indication to the operator if no VHM data has been gathered for a particular component for longer than a certain number of hours.
In the absence of any VHM data, reversion to the standard procedures used to ensure component integrity should be made.
u. Controlled Service Introduction
(1) When a VHM system initially enters into service or it is adapted to a new application on a different rotorcraft type, then a Controlled Service Introduction (CSI) phase is usually necessary in order to fully validate the system performance.
(2) If a CSI phase is considered to be necessary, then this activity should be detailed in a CSI plan to be approved prior to release to service, detailing the VHM applications being developed and the criteria for the successful completion of the CSI. Such criteria should address:
(i) The number of rotorcraft, number of operators, calendar time and flying hours.
(ii) Validation of specific sensor performance.
(iii) If targeted failures or defects occur during the CSI phase, it should be verified that the applicable VHM system applications provide an accurate timely Alarm. (iv) Validate the False Alarm rate.
(v) Evolution of Alert criteria.
(vi) Validate the timeliness and integrity of the end-to-end data transfer and analysis process.
(vii) Demonstration of specific support processes.
(viii) System hardware reliability.
(ix) System maintainability.
(x) System usability (including rotorcraft and ground based man-machine interfaces).
(xi) ICA usability.
(xii) Effectiveness of training.
(xiii) Effectiveness and timeliness of diagnostic support.
(3) A CSI Plan should be agreed between the applicant for VHM system certification and the Agency prior to initial approval of the VHM system. This plan should then be implemented by the VHM approval holder and the operator(s) and monitored periodically by the Agency. Prior to any VHM function replacing an existing maintenance task, it may be necessary to complete a period of in-service operation. The validation and improvement activities should be detailed in this plan which should also detail the objectives that must be achieved before the CSI can be considered to be completed.
(4) Formal CSI meetings should take place in order to review service experience against the CSI criteria. They should involve the VHM system approval holder, the Agency (as applicable), and the operators.
(5) Once all parties agree that the intent of the CSI has been satisfied, the CSI phase will be considered closed. The process of review and closure should be recorded.
v. Related documents
(1) Federal Aviation Administration (FAA) AC 29-2C MG 15 ‘Airworthiness Approval of Rotorcraft Health Usage Monitoring Systems (HUMS)’
http://www.faa.gov/regulations_policies/advisory_circulars/
(2) CAP 753: Helicopter Vibration Health Monitoring (VHM) — Guidance Material for Operators Utilising VHM in Rotor and Rotor Drive Systems of Helicopters
http://www.caa.co.uk/docs/33/CAP753.pdf
(3) CAA Paper 2011/01: Intelligent Management of Helicopter Vibration Health Monitoring Data
CS 29.1470 Emergency locator transmitter (ELT)
ED Decision 2018/007/R
Each emergency locator transmitter, including sensors and antennae, required by the applicable operating rule, must be installed so as to minimise damage that would prevent its functioning following an accident or incident.
[Amdt No: 29/5]
AMC 29.1470 Emergency locator transmitters (ELTs)
ED Decision 2018/007/R
(a) Explanation
The purpose of this AMC is to provide specific guidance for compliance with CS 29.1301, CS 29.1309, CS 29.1470, CS 29.1529 and CS 29.1581 regarding emergency locator transmitters (ELT) and their installation.
An ELT is considered to be a passive and dormant device whose status is unknown until it is required to perform its intended function. As such, its performance is highly dependent on proper installation and post-installation testing.
(b) References
Further guidance on this subject can be found in the following references:
(1) ETSO-C126b 406 and 121.5 MHZ Emergency Locator Transmitter;
(2) ETSO-C126b 406 MHz Emergency Locator Transmitter;
(3) FAA TSO-C126b 406 MHz Emergency Locator Transmitter (ELT);
(4) EUROCAE ED-62A MOPS for aircraft emergency locator transmitters (406 MHz and 121.5 MHz (optional 243 MHz));
(5) RTCA DO-182 Emergency Locator Transmitter (ELT) Equipment Installation and Performance; and
(6) RTCA DO-204A Minimum Operational Performance Standards for 406 MHz Emergency Locator Transmitters (ELTs).
(c) Definitions
(1) ELT (AF): an ELT (automatic fixed) is intended to be permanently attached to the rotorcraft before and after a crash, is automatically activated by the shock of the crash, and is designed to aid search and rescue (SAR) teams in locating a crash site.
(2) ELT (AP): an ELT (automatic portable) is intended to be rigidly attached to the rotorcraft before a crash and is automatically activated by the shock of the crash, but is readily removable from the rotorcraft after a crash. It functions as an ELT (AF) during the crash sequence. If the ELT does not employ an integral antenna, the rotorcraft-mounted antenna may be disconnected and an auxiliary antenna (stowed in the ELT case) connected in its place. The ELT can be tethered to a survivor or a life raft. This type of ELT is intended to assist SAR teams in locating the crash site or survivor(s).
(3) ELT (S): an ELT (survival) should survive the crash forces, be capable of transmitting a signal, and have an aural or visual indication (or both) that power is on. Activation of an ELT (S) usually occurs by manual means but automatic activation (e.g. activation by water) may also apply.
(i) ELT (S) Class A (buoyant): this type of ELT is intended to be removed from the rotorcraft, deployed and activated by survivors of a crash. It can be tethered to a life raft or a survivor. The equipment should be buoyant and it should be designed to operate when floating in fresh or salt water, and should be self-righting to establish the antenna in its nominal position in calm conditions.
(ii) ELT (S) Class B (non-buoyant): this type of ELT should be integral to a buoyant device in the rotorcraft, deployed and activated by the survivors of a crash.
(4) ELT (AD) or automatically deployable emergency locator transmitter (ADELT): this type of automatically deployable ELT is intended to be rigidly attached to the rotorcraft before a crash and automatically deployed after the crash sensor determines that a crash has occurred or after activation by a hydrostatic sensor. This type of ELT should float in water and is intended to aid SAR teams in locating the crash site.
(5) A crash acceleration sensor (CAS) is a device that detects an acceleration and initiates the transmission of emergency signals when the acceleration exceeds a predefined threshold (Gth). It is also often referred to as a ‘g switch’.
(d) Procedures
(1) Installation aspects of ELTs
The installation of the equipment should be designed in accordance with the ELT manufacturer’s instructions.
(i) Installation of the ELT transmitter unit and crash acceleration sensors
The location of the ELT should be chosen to minimise the potential for inadvertent activation or damage by impact, fire, or contact with passengers, baggage or cargo.
The ELT transmitter unit should ideally be mounted on primary rotorcraft load-carrying structures such as trusses, bulkheads, longerons, spars, or floor beams (not rotorcraft skin). Alternatively, the structure should meet the requirements of the test specified in 6.1.8 of ED-62A. For convenience, the requirements of this test are reproduced here, as follows:
‘The mounts shall have a maximum static local deflection no greater than 2.5 mm when a force of 450 Newtons (100 lbf) is applied to the mount in the most flexible direction. Deflection measurements shall be made with reference to another part of the airframe not less than 0.3 m or more than 1.0 m from the mounting location.’
However, this does not apply to an ELT (S), which should be installed or stowed in a location that is conspicuously marked and readily accessible, or should be integral to a buoyant device such as a life raft, depending on whether it is of Class A or B.
A poorly designed crash acceleration sensor installation can be a source of problems such as nuisance triggers, failures to trigger and failures to deploy.
Nuisance triggers can occur when the crash acceleration sensor does not work as expected or is installed in a way that exposes it to shocks or vibration levels outside those assumed during equipment qualification. This can also occur as a result of improper handling and installation practices.
A failure to trigger can occur when an operational ELT is installed such that the crash sensor is prevented from sensing the relevant crash accelerations.
Particular attention should be paid to the installation orientation of the crash acceleration sensor. If the equipment contains a crash sensor with particular installation orientation needs, the part of the equipment containing the crash sensor will be clearly marked by the ELT manufacturer to indicate the correct installation orientation(s).
The design of the installation should follow the instructions contained in the installation manual provided by the equipment manufacturer. In the absence of an installation manual, in general, in the case of a helicopter installation, if the equipment has been designed to be installed on fixed-wing aircraft, it may nevertheless be acceptable for a rotorcraft application. In such cases, guidance should be sought from the equipment manufacturer. This has typically resulted in a recommendation to install the ELT with a different orientation, e.g. of 45 degrees with respect to the main longitudinal axis (versus zero degrees for a fixed wing application). This may help the sensor to detect forces in directions other than the main longitudinal axis, since, during a helicopter crash, the direction of the impact may differ appreciably from the main aircraft axis. However, some ELTs are designed specifically for helicopters or designed to sense forces in several axes.
(ii) Use of hook and loop style fasteners
In several recent aircraft accidents, ELTs mounted with hook and loop style fasteners, commonly known by the brand name Velcro®, have detached from their aircraft mountings. The separation of the ELT from its mount could cause the antenna connection to be severed, rendering the ELT ineffective.
Inconsistent installation and reinstallation practices can lead to the hook and loop style fastener not having the necessary strength to perform its intended function. Furthermore, the retention capability of the hook and loop style fastener may degrade over time, due to wear and environmental factors such as vibration, temperature, or contamination. The safety concern about these attachments increases when the ELT manufacturer’s instructions for continued airworthiness (ICA) do not contain specific instructions for regularly inspecting the hook and loop style fasteners, or a replacement interval (e.g. Velcro life limit). This concern applies, regardless of how the hook and loop style fastener is installed in the aircraft.
Separation of ELTs has occurred, even though the associated hook and loop style fastener design was tested during initial European Technical Standard Order (ETSO) compliance verification against crash shock requirements.
Therefore, it is recommended that when designing an ELT installation, the ELT manufacturer’s ICA is reviewed and it is ensured that the ICA for the rotorcraft (or the modification, as applicable) appropriately addresses the in-service handling of hook and loop style fasteners.
It is to be noted that ETSO/TSO-C126b states that the use of hook and loop fasteners is not an acceptable means of attachment for automatic fixed (AF) and automatic portable (AP) ELTs.
(iii) ELT antenna installation
This section does not apply to the ELT (S) or ELT (AD) types of ELT.
The most recurrent issue found during accident investigations concerning ELTs is the detachment of the antenna (coaxial cable), causing the transmission of the ELT unit to be completely ineffective.
Chapter 6 of ED-62A addresses the installation of an external antenna and provides guidance, in particular, on:
(A) the location of the antenna;
(B) the position of the antenna relative to the ELT transmission unit;
(C) the characteristics of coaxial-cables; and
(D) the installation of coaxial-cables.
Any ELT antenna should be located away from other antennas to avoid disruption of the antenna radiation patterns. In any case, during installation of the antenna, it should be ensured that the antenna has a free line of sight to the orbiting COSPAS-SARSAT satellites at most times when the aircraft is in the normal flight attitude.
Ideally, for the 121.5 MHz ELT antenna, a separation of 2.5 metres from antennas receiving very high frequency (VHF) communications and navigation data is sufficient to minimise unwanted interference. The 406 MHz ELT antenna should be positioned at least 0.8 metres from antennas receiving VHF communications and navigation data to minimise interference.
External antennas which have been shown to be compatible with a particular ELT will either be part of the ETSO/TSO-approved ELT or will be identified in the ELT manufacturer’s installation instructions. Recommended methods for installing antennas are outlined in FAA AC 43.13-2B.
The antenna should be mounted as close to the respective ELT as practicable. Provision should be taken to protect coaxial cables from disconnection or from being cut. Therefore, installation of the external antenna close to the ELT unit is recommended. Coaxial cables connecting the antenna to the ELT unit should not cross rotorcraft production breaks.
In the case of an external antenna installation, ED-62A recommends that its mounting surface should be able to withstand a static load equal to 100 times the antenna’s weight applied at the antenna mounting base along the longitudinal axis of the rotorcraft. This strength can be substantiated by either test or conservative analysis.
If the antenna is installed within a fin cap, the fin cap should be made of an RF-transparent material that will not severely attenuate the radiated transmission or adversely affect the antenna radiation pattern shape.
In the case of an internal antenna location, the antenna should be installed as close to the ELT unit as practicable, insulated from metal window casings and restrained from movement within the cabin area. The antenna should be located such that its vertical extension is exposed to an RF-transparent window. The antenna’s proximity to the vertical sides of the window and to the window pane and casing as well as the minimum acceptable window dimensions should be in accordance with the equipment manufacturer’s instructions.
The voltage standing wave ratio (VSWR) of the installed external antenna should be checked at all working frequencies, according to the test equipment manufacturer’s recommendations, during the first certification exercise for installation on a particular rotorcraft type.
Coaxial cables between the antenna and the ELT unit should be provided on each end with an RF connector that is suitable for the vibration environment of the particular installation application. When the coaxial cable is installed and the connectors mated, each end should have some slack in the cable, and the cable should be secured to rotorcraft structures for support and protection.
In order to withstand exposure to fire or flames, the use of fire-resistant coaxial cables or the use of fire sleeves compliant to SAE AS1072 is recommended.
(2) Deployment aspects of ELTs
Automatically deployable emergency locator transmitters (ADELTs) have particularities in their designs and installations that need to be addressed independently of the general recommendations.
The location of an ADELT and its manner of installation should minimise the risk of injury to persons or damage to the rotorcraft in the event of its inadvertent deployment. The means to manually deploy the ADELT should be located in the cockpit, and be guarded, such that the risk of inadvertent manual deployment is minimised.
Automatically deployable ELTs should be located so as to minimise any damage to the structure and surfaces of the rotorcraft during their deployment. The deployment trajectory of the ELT should be demonstrated to be clear of interference from the airframe or any other parts of the rotorcraft, or from the rotor in the case of helicopters. The installation should not compromise the operation of emergency exits or of any other safety features.
In some helicopters, where an ADELT is installed aft of the transport joint in the tail boom, any disruption of the tail rotor drive shaft has the potential to disrupt or disconnect the ADELT wiring. From accident investigations, it can be seen that if a tail boom becomes detached, an ADELT that is installed there, aft of the transport joint, will also become detached before signals from sensors that trigger its deployment can be received.
Therefore, it is recommended to install the ADELT forward of the transport joint of the tail boom. Alternatively, it should be assured that ELT system operation will not be impacted by the detachment of the structural part on which it is installed.
The hydrostatic sensor used for automatic deployment should be installed in a location shown to be immersed in water within a short time following a ditching or water impact, but not subject to water exposure in the expected rotorcraft operations. This assessment should include the most probable rotorcraft attitude when crashed, i.e. its capability to keep an upright position after a ditching or a crash into water.
The installation supporting the deployment feature should be demonstrated to be robust to immersion. Assuming a crash over water or a ditching, water may immerse not only the beacon and the hydrostatic sensor, which is designed for this, but also any electronic component, wires and the source of power used for the deployment.
(3) Additional considerations
(i) Human factors (HF)
The ELT controls should be designed and installed so that they are not activated unintentionally. These considerations should address the control panel locations, which should be clear from normal flight crew movements when getting into and out of the cockpit and when operating the rotorcraft, and the control itself. The means for manually activating the ELT should be guarded in order to avoid unintentional activation.
(ii) The rotorcraft flight manual (RFM) should document the operation of the ELT, and in particular, any feature specific to the installed model.
(iii) Batteries
An ELT operates using its own power source. The ELT manufacturer indicates the useful life and expiration date of the batteries by means of a dedicated label. The installation of the ELT should be such that the label indicating the battery expiration date is clearly visible without requiring the removal of the ELT or other LRU from the rotorcraft.
(4) Maintenance and inspection aspects
This Chapter provides guidance for the applicant to produce ICA related to ELT systems. The guidance is based on Chapter 7 of ED-62A.
(i) The ICA should explicitly mention that:
(A) The self-test function should be performed according to the manufacturer’s recommendation but no less than once every 6 months. Regulation at the place of operation should be considered when performing self-tests, as national aviation authorities (NAAs) may have established specific procedures to perform self-tests.
(B) As a minimum, a periodic inspection should occur at every battery replacement unless an inspection is required more frequently by the airworthiness authorities or the manufacturer.
(ii) Each inspection should include:
(A) the removal of all interconnections to the ELT antenna, and inspection of the cables and terminals;
(B) the removal of the ELT unit, and inspection of the mounting;
(C) access to the battery to check that there is no corrosion;
(D) a check of all the sensors as recommended by Chapter 7.6 of ED-62A — Periodic inspection; and
(E) measurement of the transmission frequencies and the power output.
(5) Rotorcraft flight manual/flight manual supplement (RFM/RFMS)
The rotorcraft flight manual (RFM) or supplement (RFMS), as appropriate, should contain all the pertinent information related to the operation of the ELT, including the use of the remote control panel in the cockpit. If there are any limitations on its use, these should be declared in the ‘Limitations’ section.
Detailed instructions for pre-flight and post-flight checks should be provided. As a pre-flight check, the ELT remote control should be checked to ensure that it is in the armed position. Post-flight, the ELT should be checked to ensure that it does not transmit, by activating the indicator on the remote control or monitoring 121.5 MHz.
Information on the location and deactivation of ELTs should also be provided. Indeed, accident investigations have shown that following aircraft ground impact, the remote control switch on the instrument panel may become inoperative, and extensive fuselage disruption may render the localisation of, and the access to, the ELT unit difficult. As a consequence, in the absence of information available to the accident investigators and first responders, this has led to situations where the ELT transmitted for a long time before being shut down, thus blocking the SAR channel for an extended time period. It is therefore recommended that information explaining how to disarm or shut down the ELT after an accident, including when the remote control switch is inoperative, should be included.
[Amdt No: 29/5]