2014-19539. Special Conditions: Robinson Model R66 Helicopter, § 27.1309, Installation of HeliSAS Autopilot and Stabilization Augmentation System (AP/SAS)

AGENCY:

Federal Aviation Administration (FAA), DOT.

ACTION:

Final special conditions; request for comments.

SUMMARY:

These special conditions are issued for the modification of the Robinson Helicopter Company Model R66 helicopter. This model helicopter will have a novel or unusual design feature after installation of the HeliSAS helicopter autopilot/stabilization augmentation system (AP/SAS) that has potential failure conditions with more severe adverse consequences than those envisioned by the existing applicable airworthiness regulations. These special conditions contain the added safety standards the Administrator considers necessary to ensure the failures and their effects are sufficiently analyzed and contained.

DATES:

The effective date of these special conditions is August 7, 2014. We must receive your comments on or before October 3, 2014.

ADDRESSES:

Send comments identified by docket number [FAA-2014-0596] using any of the following methods:

• Federal eRegulations Portal: Go to http://www.regulations.gov and follow the online instructions for sending your comments electronically.
• Mail: Send comments to Docket Operations, M-30, U.S. Department of Transportation (DOT), 1200 New Jersey Avenue SE., Room W12-140, West Building Ground Floor, Washington, DC 20590-0001.
• Hand Delivery of Courier: Deliver comments to the Docket Operations, in Room W12-140 of the West Building Ground Floor at 1200 New Jersey Avenue SE., Washington, DC between 9 a.m., and 5 p.m., Monday through Friday, except federal holidays.
• Fax: Fax comments to Docket Operations at 202-493-2251.

Privacy: The FAA will post all comments it receives, without change, to http://regulations.gov,, including any personal information the commenter provides. Using the search function of the docket Web site, anyone can find and read the electronic form of all comments received into any FAA docket, including the name of the individual sending the comment (or signing the comment for an association, business, labor union, etc.). DOT's complete Privacy Act Statement can be found in the Federal Register published on April 11, 2000 (65 FR 19477-19478), as well as at http://DocketsInfo.dot.gov.

Docket: Background documents or comments received may be read at http://www.regulations.gov. Follow the online instructions for accessing the docket or go to the Docket Operations in Room W12-140 of the West Building Ground Floor at 1200 New Jersey Avenue SE., Washington, DC, between 9 a.m., and 5 p.m., Monday through Friday, except Federal holidays.

FOR FURTHER INFORMATION CONTACT:

Mark Wiley, Aviation Safety Engineer, FAA, Rotorcraft Directorate, Regulations and Policy Group (ASW-111), 2601 Meacham Blvd., Fort Worth, Texas 76137; telephone [phone]; facsimile [phone]; or email to [e-mail].

SUPPLEMENTARY INFORMATION:

Reason for No Prior Notice and Comment Before Adoption

The FAA has determined that notice and opportunity for public comment are unnecessary because the substance of these special conditions has been subjected to the notice and comment period previously and has been derived without substantive change from those previously issued. As it is unlikely that we will receive new comments, the FAA finds that good cause exists for making these special conditions effective upon issuance.

Comments Invited

While we did not precede this with a notice of proposed special conditions, we invite interested people to take part in this action by sending written comments, data, or views. The most helpful comments reference a specific portion of the special conditions, explain the reason for any recommended change, and include supporting data.

We will consider all comments we receive by the closing date for comments. We will consider comments filed late if it is possible to do so without incurring expense or delay. We may change these special conditions based on the comments we receive.

If you want us to let you know we received your mailed comments on these special conditions, send us a pre-addressed, stamped postcard on which the docket number appears. We will stamp the date on the postcard and mail it back to you.

Background

On July 11, 2014, the Robinson Helicopter Company applied to amend type certificate (TC) Number R00015LA to install a HeliSAS AP/SAS on the Robinson Helicopter Company model R66 helicopter. The Robinson Helicopter Company model R66 helicopter is a 14 CFR part 27 normal category, single turbine engine, conventional helicopter designed for civil operation. This helicopter model is capable of carrying up to four passengers with one pilot, and has a maximum gross weight of up to 2,700 pounds, depending on the model configuration. The major design features include a 2-blade, fully articulated main rotor, an anti-torque tail rotor system, a skid landing gear, and a visual flight rule basic avionics configuration. Robinson Helicopter Company proposes to modify this model helicopter by installing a two-axis HeliSAS AP/SAS.

Type Certification Basis

Under 14 CFR 21.101, the Robinson Helicopter Company must show that the model R66 helicopter, as modified by the installed HeliSAS AP/SAS, continues to meet the applicable regulations in effect on the date of application for the change to the type certificate. The baseline of the certification basis for the unmodified Robinson Helicopter Company model R66 helicopter is listed in TC Number R00015LA. Additionally, compliance must be shown to any applicable equivalent level of safety findings, exemptions, and special conditions prescribed by the Administrator as part of the certification basis.

The Administrator has determined the applicable airworthiness regulations (that is, 14 CFR part 27), as they pertain to this amended TC, do not contain adequate or appropriate safety standards for the Robinson Helicopter Company model R66 helicopter because of a novel or unusual design feature. Therefore, special conditions are prescribed under § 21.16.

In addition to the applicable airworthiness regulations and special conditions, the Robinson Helicopter Company must show compliance of the HeliSAS AP/SAS amended TC altered model R66 helicopter with the noise certification requirements of 14 CFR part 36.

The FAA issues special conditions, as defined in § 11.19, in accordance with § 11.38 and they become part of the type certification basis under § 21.101(d).

Novel or Unusual Design Features

The HeliSAS AP/SAS incorporates novel or unusual design features for installation in a Robinson Helicopter Company model R66 helicopter, TC Number R00015LA. This HeliSAS AP/SAS performs non-critical control functions. However, the possible failure conditions for this system, and their effect on the continued safe flight and landing of the helicopter, are more severe than those envisioned by the present rules.

Discussion

The effect on safety is not adequately covered under § 27.1309 for the application of new technology and new application of standard technology. Specifically, the present provisions of § 27.1309(c) do not adequately address the safety requirements for systems whose failures could result in catastrophic or hazardous/severe-major failure conditions, or for complex systems whose failures could result in major failure conditions. The current regulations are inadequate because when § 27.1309(c) were promulgated, it was not envisioned that this type of rotorcraft would use systems that are complex or whose failure could result in “catastrophic” or “hazardous/severe-major” effects on the rotorcraft. This is particularly true with the application of new technology, new application of standard technology, or other applications not envisioned by the rule that affect safety.

To comply with the provisions of the special conditions, we require that Robinson Helicopter Company provide the FAA with a systems safety assessment (SSA) for the final HeliSAS AP/SAS installation configuration that will adequately address the safety objectives established by a functional hazard assessment (FHA) and a preliminary system safety assessment (PSSA), including the fault tree analysis (FTA). This will ensure that all failure conditions and their resulting effects are adequately addressed for the installed HeliSAS AP/SAS. The SSA process, FHA, PSSA, and FTA are all parts of the overall safety assessment process discussed in FAA Advisory Circular 27-1B (Certification of Normal Category Rotorcraft) and Society of Automotive Engineers document Aerospace Recommended Practice 4761 (Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment).

These special conditions require that the HeliSAS AP/SAS installed on Robinson Helicopter Company model R66 helicopter meet the requirements to adequately address the failure effects identified by the FHA, and subsequently verified by the SSA, within the defined design integrity requirements.

Failure Condition Categories. Failure conditions are classified, according to the severity of their effects on the rotorcraft, into one of the following categories:

1. No Effect. Failure conditions that would have no effect on safety. For example, failure conditions that would not affect the operational capability of the rotorcraft or increase crew workload; however, could result in an inconvenience to the occupants, excluding the flight crew.

2. Minor. Failure conditions which would not significantly reduce rotorcraft safety, and which would involve crew actions that are well within their capabilities. Minor failure conditions would include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in crew workload such as routine flight plan changes or result in some physical discomfort to occupants.

3. Major. Failure conditions which would reduce the capability of the rotorcraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or result in impairing crew efficiency, physical distress to occupants, including injuries, or physical discomfort to the flight crew.

4. Hazardous/Severe-Major.

a. Failure conditions which would reduce the capability of the rotorcraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:

(1) a large reduction in safety margins or functional capabilities;

(2) physical distress or excessive workload that would impair the flight crew's ability to the extent that they could not be relied on to perform their tasks accurately or completely; or

(3) possible serious or fatal injury to a passenger or a cabin crewmember, excluding the flight crew.

b. “Hazardous/severe-major” failure conditions can include events that are manageable by the crew by the use of proper procedures, which, if not implemented correctly or in a timely manner, may result in a catastrophic event.

5. Catastrophic—Failure conditions which would result in multiple fatalities to occupants, fatalities or incapacitation to the flight crew, or result in loss of the rotorcraft.

Radio Technical Commission for Aeronautics, Inc. (RTCA) Document DO-178C (Software Considerations in Airborne Systems And Equipment Certification) provides software design assurance levels most commonly used for the major, hazardous/severe-major, and catastrophic failure condition categories. The HeliSAS AP/SAS system equipment must be qualified for the expected installation environment. The test procedures prescribed in RTCA Document DO-160G (Environmental Conditions and Test Procedures for Airborne Equipment) are recognized by the FAA as acceptable methodologies for finding compliance with the environmental requirements. Equivalent environment test standards may also be acceptable. This is to show that the HeliSAS AP/SAS system performs its intended function under any foreseeable operating condition, which includes the expected environment in which the HeliSAS AP/SAS is intended to operate. Some of the main considerations for environmental concerns are installation locations and the resulting exposure to environmental conditions for the HeliSAS AP/SAS system equipment, including considerations for other equipment that may be affected environmentally by the HeliSAS AP/SAS equipment installation. The level of environmental qualification must be related to the severity of the considered failure conditions and effects on the rotorcraft.

Applicability

These special conditions are applicable to the HeliSAS AP/SAS installed as an amended TC approval in Robinson Helicopter Company model R66 helicopter, TC Number R00015LA.

Conclusion

This action affects only certain novel or unusual design features for a HeliSAS AP/SAS amended TC installed on one model helicopter. It is not a rule of general applicability and affects only the applicant who applied to the FAA for approval of these features.

List of Subjects in 14 CFR Part 27

• Aircraft
• Aviation safety

The authority citation for these special conditions is as follows:

Authority: 42 U.S.C. 7572, 49 U.S.C. 106(g), 40105, 40113, 44701-44702, 44704, 44709, 44711, 44713, 44715, 45303.

The Special Conditions

Accordingly, pursuant to the authority delegated to me by the Administrator, the following special conditions are issued as part of the Robinson Helicopter Company amended type certificate basis for the installation of a HeliSAS helicopter autopilot/stabilization augmentation system (AP/SAS) on the model R66 helicopter, Type Certificate Number R00015LA. In addition to the requirements of § 27.1309(c), HeliSAS AP/SAS installations on Robinson Helicopter company model R66 helicopter must be designed and installed so that the failure conditions identified in the functional hazard assessment (FHA) and verified by the system safety assessment (SSA), after design completion, are adequately addressed in accordance with the following requirements.

Requirements

The Robinson Helicopter Company must comply with the existing requirements of § 27.1309 for all applicable design and operational aspects of the HeliSAS AP/SAS with the failure condition categories of “no effect,” and “minor,” and for non-complex systems whose failure condition category is classified as “major.” The Robinson Helicopter Company must comply with the requirements of these special conditions for all applicable design and operational aspects of the HeliSAS AP/SAS with the failure condition categories of “catastrophic” and “hazardous severe/major,” and for complex systems whose failure condition category is classified as “major.” A complex system is a system whose operations, failure conditions, or failure effects are difficult to comprehend without the aid of analytical methods (for example, FTA, Failure Modes and Effect Analysis, FHA).

System Design Integrity Requirements

Each of the failure condition categories defined in these special conditions relate to the corresponding aircraft system integrity requirements. The system design integrity requirements for the HeliSAS AP/SAS, as they relate to the allowed probability of occurrence for each failure condition category and the proposed software design assurance level, are as follows:

1. “Major”—For systems with “major” failure conditions, failures resulting in these major effects must be shown to be remote, a probability of occurrence on the order of between 1 × 10⁻⁵ to 1 × 10⁻⁷ failures/hour, and associated software must be developed, at a minimum, to the Level C software design assurance level.

2. “Hazardous/Severe-Major”—For systems with “hazardous/severe-major” failure conditions, failures resulting in these hazardous/severe-major effects must be shown to be extremely remote, a probability of occurrence on the order of between 1 × 10⁻⁷ to 1 × 10⁻⁹ failures/hour, and associated software must be developed, at a minimum, to the Level B software design assurance level.

3. “Catastrophic”—For systems with “catastrophic” failure conditions, failures resulting in these catastrophic effects must be shown to be extremely improbable, a probability of occurrence on the order of 1 × 10⁻⁹ failures/hour or less, and associated software must be developed, at a minimum, to the Level A design assurance level.

System Design Environmental Requirements

The HeliSAS AP/SAS system equipment must be qualified to the appropriate environmental level for all relevant aspects to show that it performs its intended function under any foreseeable operating condition, including the expected environment in which the HeliSAS AP/SAS is intended to operate. Some of the main considerations for environmental concerns are installation locations and the resulting exposure to environmental conditions for the HeliSAS AP/SAS system equipment, including considerations for other equipment that may be affected environmentally by the HeliSAS AP/SAS equipment installation. The level of environmental qualification must be related to the severity of the considered failure conditions and effects on the rotorcraft.

Test and Analysis Requirements

Compliance with the requirements of these special conditions may be shown by a variety of methods, which typically consist of analysis, flight tests, ground tests, and simulation, as a minimum. Compliance methodology is related to the associated failure condition category. If the HeliSAS AP/SAS is a complex system, compliance with the requirements for failure conditions classified as “major” may be shown by analysis, in combination with appropriate testing to validate the analysis. Compliance with the requirements for failure conditions classified as “hazardous/severe-major” may be shown by flight-testing in combination with analysis and simulation, and the appropriate testing to validate the analysis. Flight tests may be limited for “hazardous/severe-major” failure conditions and effects due to safety considerations. Compliance with the requirements for failure conditions classified as “catastrophic” may be shown by analysis, and appropriate testing in combination with simulation to validate the analysis. Very limited flight tests in combination with simulation are used as a part of a showing of compliance for “catastrophic” failure conditions. Flight tests are performed only in circumstances that use operational variations, or extrapolations from other flight performance aspects to address flight safety.

These special conditions require that the HeliSAS AP/SAS system installed on a Robinson Helicopter Company model R66 helicopter, Type Certificate Number R00015LA, meet these requirements to adequately address the failure effects identified by the FHA, and subsequently verified by the SSA, within the defined design system integrity requirements.

Issued in Fort Worth, Texas on August 7, 2014.

Lance T. Gant,

Acting Manager, Rotorcraft Directorate, Aircraft Certification Service.