|
A Cryptome DVD is offered by Cryptome. Donate $25 for a DVD of the Cryptome 11.5-years archives of 43,000 files from June 1996 to January 2008 (~4.5 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. Archives include all files of cryptome.org, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org. Cryptome offers with the Cryptome DVD an INSCOM DVD of about 18,000 pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985. No additional contribution required -- $25 for both. The DVDs will be sent anywhere worldwide without extra cost. |
31 March 2008
[Federal Register: March 31, 2008 (Volume 73, Number 62)]
[Notices]
[Page 16924-16944]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr31mr08-127]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
Airworthiness Criteria: Airship Design Criteria for Zeppelin
Luftschifftechnik GmbH Model LZ N07 Airship
AGENCY: Federal Aviation Administration (FAA), DOT.
ACTION: Notice of issuance of final design criteria.
-----------------------------------------------------------------------
SUMMARY: This document announces the issuance of final design criteria
for the Zeppelin Luftschifftechnik GmbH model LZ N07 airship. The
German aviation airworthiness authority, the Luftfahrt-Bundesamt (LBA),
forwarded an application for type validation of the Zeppelin
Luftschifftechnik GmbH Company KG (ZLT) model LZ N07 airship on October
1, 2001. The airship will meet the provisions of the Federal Aviation
Administration (FAA) normal category for airships operations and will
be certificated for day and night visual flight rules (VFR);
additionally, an operator of this airship may petition for exemption to
operate the airship in other desired operations.
EFFECTIVE DATE: March 21, 2008.
FOR FURTHER INFORMATION CONTACT: Federal Aviation Administration,
Attention: Mr. Karl Schletzbaum, Project Support Office, ACE-112, 901
Locust, Kansas City, Missouri 64106; telephone: 816-329-4146; e-mail:
karl.schletzbaum@faa.gov; facsimile (816) 329-4090.
SUPPLEMENTARY INFORMATION:
Background
Under the provisions of the Bilateral Aviation Safety Agreement
(BASA) between the United States and Germany, the German aviation
airworthiness authority, the Luftfahrt-Bundesamt (LBA), forwarded an
application for type validation of the Zeppelin Luftschifftechnik GmbH
Company KG (ZLT) model LZ N07 airship on October 1, 2001. The LZ N07
has a rigid structure, 290,330 cubic foot displacement and has
accommodations for twelve passengers and two crewmembers. The airship
will meet the provisions of the FAA normal category for airships;
additionally, an operator of this airship may petition for exemption to
operate the airship in other desired operations. The airship will be
certificated for day and night visual flight rules (VFR).
Discussion of Comments
On April 10, 2007, the Federal Aviation Administration issued a
notice of availability of proposed airworthiness design criteria for
the ZLT model LZ N07 airship. The criteria was the certification basis
accepted for the U.S. validated of the airship according to 14 CFR part
21, Sec. 21.17(b). This criteria consisted of the German national
standard Luftt[uuml]chtigkeitsforderungen f[uuml]r Luftschiffe der
Kategorien Normal und Zubringer (LFLS) [Airworthiness Requirements:
Normal and Commuter Category Airships] and equivalent requirements
identified by the national aviation authority of Germany, the LBA.
The notice was published for public comment on May 3, 2007 (72 FR
24656). The comment period closed on June 4, 2007.
A commenter from the airship design industry requested that we
extend the comment period for the proposed design criteria. We agreed
and issued the reopening of the comment period on July 7 and published
a notice on July 16, 2007 (72FR 38858).
Three commenters provided their comments on the notice. While the
notice was not a notice of a regulatory change or requirement, the FAA
is responding to the comments.
Two commenters came from firms that proposed to operate airships.
These comments were supportive of the standard and the process.
The third commenter came from an airship manufacturer, which
provided extensive comments as discussed below in the sections of the
LFLS.
General Comment
In its decision to accept the German LFLS certification
requirements, the FAA has stated, ``the LFLS requirements are at least
equivalent to and, in many cases, more conservative than the
requirements for the normal category contained in the ADC.'' The LFLS
requirements are for an airship designed to meet a ``commuter''
category for carrying passengers, hence a higher level of safety is
appropriate. [Note: ADC means Airship Design Criteria.]
By this statement, it is implied that the ZLT airship will meet a
higher standard of certification, where in fact, the airship does not
currently meet several critical safety requirements in both the LFLS
and FAA-P-8110-2 Design Criteria. It has, therefore, been designed and
accepted to a lesser standard.
More importantly, several of the claims by ZLT to demonstrate an
equivalent level of safety are not supported by reasonable argument but
are really requests for exemption. They are also at odds with FAA
determinations in previous U.S. airship certification programs in
critical areas affecting safety of flight and in FAA efforts for
standardization.
In reviewing the ZLT exemptions, it also became apparent that the
Zeppelin airship design is a significant departure from a conventional
non rigid design. The industry and the FAA understand that the
designation of conventional non rigid design implies a certain level of
capability, especially in emergency conditions, and, therefore a
certain level of operating environment has been granted. If the
applicant continues to seek exemptions or if these exemptions are
granted, it is more appropriate to call this airship a hybrid and,
thus, issue special operating limitations, which limit the regime it
can fly in.
Generally, it is not understood why such latitude is being
contemplated. In previous U.S. airship certification programs, the FAA
has rigidly applied, and the airship industry has rigidly complied with
certain fundamental airship certification requirements with no
exemptions being granted. The ZLT airship certification program in
Germany does not appear to have met some of these basic requirements.
In addition, the FAA would appear to be
[[Page 16925]]
accepting the airship on the basis of the LFLS certification program
without close scrutiny of the merits of the ZLT arguments for an
equivalent level of safety.
By accepting the ZLT claims, a precedent would be set. To compound
the matter, the claims for a dispensation against the requirements are
numerous in these critical safety areas, thereby having a cumulative
affect and potentially compromising safety.
FAA Response: The FAA reviewed the LFLS and the differences from
this standard as applied by the LBA. We then, compared them to the
currently accepted airship design criteria, the FAA-P-8110-2 Airship
Design Criteria. The LFLS, with the additional or equivalent
requirements applied by the LBA to the Zeppelin N07-100 (now referred
to as the certification basis), was determined to provide the level of
safety specified in 14 CFR part 21, Sec. 21.17(b).
The certification basis criteria, as summarized in the notice, is
accepted by the FAA as providing an equivalent level of safety, as
specified by the 14 CFR part 21, Sec. 21.17(b), and is the accepted
airworthiness criteria for the ZLT LZ N07-100 as defined in that part.
In accepting this certification basis, the FAA considered the entire
proposed certification basis, and does not consider equivalent levels
of safety (for specific regulations), special conditions, or exemptions
in this process, as the need to issue such regulatory processes are not
required when accepting an airworthiness criteria in total for a
special class aircraft. In this case, a criterion that had not been
previously accepted, along with equivalencies granted by the local
authority, was accepted as the airworthiness criteria and is the
certification basis for this special class aircraft.
The ZLT N07-100 airship is a rigid type airship that is capable of
operations that have been previously type certificated by the FAA; the
rigid structure is the only design feature that has not previously been
type certificated. The FAA considers the noticed criteria suitable for
the ZLT LZ N07 airship and does not consider it a hybrid type.
Technical Comments
The commenter continued with specific technical comments on the
notice criteria:
These fundamental certification requirements where ABC [American
Blimp Corporation] considers that ZLT are claiming an unreasonable
equivalent level of safety are identified as follows:
1. LFLS Section 881(a) and ADC paragraph 3.4--Proof of Structure
2. LFLS Section 76 and ADC paragraph 2.11 Engine Failure and
Ballast Requirements
3. LFLS Section 893(b) and ADC paragraph 4.49 Ballast Requirements
during Normal Flight.
4. LFLS Section 143(b) and ADC paragraph 2.14(b)--No Engines--Safe
Descent
5. LFLS Section 673(d) and ADC paragraph 4.14(d)--No Mech Linkage--
Dual Redundancy.
6. LFLS Section 881 (f) and ADC paragraph 4.43 (f)(g) Emergency
Deflation
7. LFLS Section 883(e) and ADC paragraph 4.44(e)--Air to helium
Provision
8. LFLS Section 2498(b) and ADC paragraph 6.25 Position Lighting
(1) Comment:
With respect to item 1 above, the commenter stated:
LFLS Section 881(a) and ADC paragraph 3.4--Proof of Structure
The LFLS section 881(a) Envelope design requirement states that
``The envelope must be designed to be pressurized and maintain
sufficient super pressure (amount of envelope pressure in excess of
ambient pressure) to remain in tension while supporting the limit
design loads for all flight conditions and ground conditions''. ZLT
claims that they should be exempt from this requirement because the
structural integrity of the LZ N07 airship is not dependent on the
envelope tension but on the structural integrity of the rigid
structure. The structure must, therefore, be subject to a full
structural load analysis and full-scale structural tests to ensure it
meets the requirement. We are assuming that the FAA will verify that
full-scale structural tests were carried out. (The ADC paragraph 3.4
Proof of Structure requirement is very specific in this regard and
states, ``Compliance with the strength and deformation requirements
must be shown for each critical load condition. Structural analysis may
be used only if the structure conforms to those for which experience
has shown this method to be reliable.'')
FAA Response
Under the Bilateral Aviation Safety Agreement (BASA) between the
FAA and the LBA, the FAA can accept the provisions of the proposed
certification basis and the method of compliance accepted by the LBA.
In this case, the alternate requirements imposed by the LBA for LFLS
section 881(a) are considered acceptable; the method of compliance was
also accepted. The corresponding LFLS section to ADC section 3.4 is
LFLS section 307. Compliance for these sections was accepted as applied
by the LBA. A review of the LFLS requirements shows that structural
testing is required for certain parts of the structure.
(2) Comment:
With respect to items 2 and 3 above, the commenter stated:
LFLS Section 76 and ADC Paragraph 2.11--Engine Failure and Ballast
Requirements and LFLS 893(b) and ADC Paragraph 4.49--Ballast
Requirements During Normal Flight
The ADC paragraph 2.11 states ``The airship must be capable of
rapidly restoring itself to a state of equilibrium following failure of
one or more engines during any flight condition. Only designated
ballast may be used.'' The FAA states ``ZLT met this requirement with
an equivalent level of safety'' by demonstrating that a zero vertical
speed condition can be established for any flight condition, by using
the thrust vectoring capability of the remaining engines. Being able to
only do this on one engine not on more engines is not equivalent. This
equivalent level of safety claim ignores the essential airship
capability to conduct a free balloon safe landing as required by LFLS
893(b) and ADC paragraph 4.49.
This requirement is applied to not only single engine failure but
also the all-engine failure condition. The FAA in all previous Airship
Certification programs in the U.S. has rigidly applied the requirement
primarily because it is based on the airship's inability to glide to a
safe landing or conduct an autorotation as in a helicopter.
FAA Response:
LFLS section 76 is slightly different than the ADC, in that the
LFLS allows for the failure ``of any engine'' and the ADC specifies the
failure of ``one or more engines.'' As the goal of the requirement is
interpreted to be attaining a zero descent rate, the use of vectored
thrust, as accepted by the LBA, was also accepted by the FAA as an
acceptable approach.
The provisions of LFLS section 893 apply if a ballast system is
installed. The LZ N07-100 airship has a water ballast system, but it is
not approved for in-flight use. For this reason, this section was not
applied to the LZ N07-100 by the LBA. The FAA has accepted this
position.
(3) Comment:
With respect to item 4, the commenter stated:
[[Page 16926]]
LFLS Section 143(b)--Safe Descent
Section 143(b) and ADC paragraph 4.49 state that ``It must be shown
that without engine power, a safe descent and landing under the
conditions of section 561 can be made'' In the ZLT narrative, it is
stated ``With the airship heavy there is no means to modulate the
descent * * *.'' This (flying heavy) is a choice made by the applicant
to make the airship more economically viable.
The equivalent level of safety argument that ``A qualitative safety
analysis will be performed to show that the simultaneous occurrence of
a loss of all engines (combined with worst case weight conditions) is
extremely improbable'' is inaccurate. It is not unrealistic to expect a
total engine failure at maximum heaviness, as could be the case with
fuel contamination. Indeed, total engine failure was experienced in an
airship in the U.S. leading to a free balloon landing. This accident
occurred one hour into the cross-country flight with the airship in a
heavy static weight condition.
Once again, the provisions of this and the previous LFLS section 76
and ADC paragraph 2.11 are a basic airship design requirement and based
on the airships inability to glide or conduct an autorotation. It is
required to also protect people and property on the ground and not just
the occupants of the airship. If the applicant continues to choose to
seek an exemption to the safety requirements of a blimp it is more
appropriate to call this airship a hybrid and thus issue special
operating limitations, which limit the regime it can fly in to
unpopulated areas or at higher altitudes over populated areas.
FAA Response:
LFLS section 143 is the applicable requirement which was again
subject to an equivalent level of safety issued by the LBA, which
allowed an analysis to show that an all engine failure in conjunction
with the maximum heaviness was extremely improbable. This approach was
also accepted by the FAA. It should be noted that even with all engines
inoperative, the airship is still in compliance with LFLS section 561,
Emergency Landing Conditions, General. As previously stated, the FAA
does not consider this airship a hybrid type.
(4) Comment:
With respect to item 5 above, the commenter stated:
LFLS Section 673(d) and ADC Para 4.14(d)--No Mechanical Linkage--Dual
Redundancy
The LFLS section 673(d) requires that airship without a direct
mechanical linkage between the cockpit and primary surfaces, be
designed with a dual redundant control system. ABC does not understand
why the following statement is made ``dual redundant is considered
ambiguous in that it does not clearly define the degree of redundancy
required.'' A dual redundant flight control system is a relatively
straightforward concept that has been incorporated in many aircraft and
the requirement seems quite unambiguous.
It is also stated that compliance will be shown as ``continued safe
flight and landing is assured after complete failure of any one of the
primary flight control system lanes.'' This ignores the requirements of
LFLS section 683(c) for the ``hard over'' condition. Any demonstration
must include one of the control fins in a hard-over condition and not
just one failed lane. The argument that vectored thrust is part of the
primary flight control system then means that it too must comply with
Dual Redundancy. Any use of vectorable engines is going to compromise
the ability to maintain forward speed and limit this recovery
capability.
FAA Response:
LFLS section 673(d) is the applicable requirement, in this case the
LBA referred to the requirements for analysis for the control systems
as specified in LFLS 1309 as adequate substantiation to show that
compliance with LFLS 673(d) had been met. The design of the fly-by-wire
control system of the airship was found to be compliant with LFLS
673(d) when considering that the control system was compliant with LFLS
1309. The FAA concurred with the approach.
(5) Comment:
With respect to item 6 above, the commenter stated:
LFLS Section 881(f) and ADC paragraph 4.43(f)(g)--Emergency Deflation
LFLS Section 881(f) requires that provisions be maintained to allow
for rapid envelope deflation on the airship should it break loose from
the mast. ZLT's airship does not meet this requirement. ZLT's claim
that the masthead design is fail proof is irrelevant if the airship
tears apart behind the nose section and departs the mooring mast. It is
not understood why this important design feature is not incorporated
for the other reason that it can be used to ensure the airship stays on
the ground in any emergency egress of passengers. This again, is a
basic design requirement that, coupled with concessions against other
design issues, adds to an overall compromised design standard. There is
no reason this cannot be incorporated.
FAA Response:
The ADC and LFLS sections fundamentally have the same requirement.
As the LZ N07-100 is a rigid type, envelope deflation is not considered
a possible option in meeting the safety requirement of these sections.
The LBA accepted that an analysis showing the safe life design of the
mooring mast and its systems would be adequate to meet this requirement
on an equivalent basis. The FAA accepted this as equivalent, with the
additional requirement that the applicant also provide additional
ground procedures for handling the airship on the ground, transponder
activation and notification procedures in the case the airship was lost
from the mast.
(6) Comment:
With respect to item 7 above, the commenter stated:
LFLS Section 883(e) and ADC Para 4.44(e)--Air to Helium Provision
LFLS section 883(e) and ADC paragraph 4.44(e) requires that
provisions be maintained to blow air into the helium space in order to
prevent wrinkling of the envelope. The other purpose is to prevent the
ballonet from overfilling and possibly rupturing. The ZLT airship does
not meet this requirement. In the case of the ZLT airship, one of the
ballonets rupturing could bring about a large center of gravity shift.
This again, is a basic and essential airship requirement that should
have been met.
FAA Response:
Again, the ADC and LFLS sections fundamentally have the same
requirement. As the LZ N07-100 is a rigid type, pressurization of the
envelope to prevent envelope wrinkling is not applied, as the rigid
structure eliminates the need for this requirement. With respect to
ballonet rupturing and center of gravity issues, this issue is not
identified as a compliance goal for this section.
(7) Comment:
With respect to item 8, the commenter stated:
LFLS Section 2498(b) and ADC Para 6.25--Position Lighting
LFLS Section 2498(b) and ADC paragraph 6.25 specify the position
lighting requirements for airships. It is not understood why a
dispensation should be given for something that can be easily fixed
with properly TSO'd LED or similar lighting. ABC had to go through a
stringent certification of the lighting on the one model. This was
revisited in a new model and the FAA
[[Page 16927]]
asked ABC to modify our position lighting by providing two sets of bow
lights in slightly different positions to further ensure adequate
brilliance in all sectors. It is not understood why any latitude is
being given to this basic legal requirement affecting safe navigation
of aircraft.
FAA Response:
The FAA notes that there is no LFLS section 2498(b) and that the
comparable LFLS section to ADC section 6.25 is LFLS section 1385. The
only section where an equivalent level of safety to the LFLS lighting
requirements was granted by the LBA is LFLS section 1387(b). The LBA
granted this equivalency based on what was considered compensating
features of the lighting system installed on the LZ N07-100, and the
FAA agreed.
Conclusion
After review of the provided comments, the FAA sees no need to
modify the proposed airworthiness criteria. Accordingly, the
airworthiness criteria, as issued on April 10, 2007, is adopted as the
certification basis for the ZLT LZ N07-100 airship under the provisions
of 14 CFR part 21, Sec. 21.17(b).
The design criterion is shown below:
Design Criteria
Applicable Airworthiness Criteria Under 14 CFR part 21
The only applicable requirement for airship certification in the
United States is FAA document FAA-P-8110-2, Airship Design Criteria
(ADC). This document has been the basis of bilateral validation of
airships between Germany and the United States for many years. However,
in 1995, the LBA issued the initial version of the
Luftt[uuml]chtigkeitsforderungen f[uuml]r Luftschiffe der Kategorien
Normal und Zubringer, (hereafter referred to as the LFLS), which added
a commuter category to German airship categories and also added
additional requirements for normal category airships. Due to this,
where the previously mutually accepted ADC can be considered to be
harmonized in practice, the issuance of the LFLS created regulatory
differences for normal category airships between the United States and
Germany.
In keeping with its bilateral obligations, the FAA has, with
assistance from the LBA, determined that regulatory differences exist
between the two requirements (ADC versus LFLS). This determination is
the Significant Regulatory Differences analysis. In the case of the LZ
N07 airship, the German certification was accomplished to the higher
standard of the commuter category of the LFLS, with various LBA
modifications and additions. The FAA desires to accept the Zeppelin
airship model LZ N07 at the same airworthiness standard as it was
certificated to in Germany, so we have decided to accept the
requirements of the LFLS and the supplemental requirements issued by
the LBA as the U.S. certification basis. With this decision, the bulk
of the regulatory differences are not relevant, as the FAA is accepting
the provisions of the German LFLS certification in the commuter
category in its entirety. The FAA has, after comparing the normal
category ADC to the commuter category LFLS requirements, determined
that all of the LFLS requirements are at least equivalent to and, in
many cases, more conservative than the requirements for normal category
contained in the ADC.
Regulatory Differences
The LFLS was developed considering the ADC at Change 1, but Change
2 provisions were not considered. There will be one regulatory
difference due to this; ZLT will show compliance to ADC Sec. 4.14 at
Change 2.
Additional and Alternative Requirements
The German aviation authority, the Luftfaht-Bundesamt (LBA) issued
additional requirements, special conditions, and equivalent levels of
safety to deal with certain design provisions and airworthiness
concerns specific to the design of the LZ N07 that were not anticipated
by the LFLS. These requirements will also become part of the U.S.
certification basis for this airship.
The U.S. certification basis for the LZ N07 was proposed as an
entire certification basis, including those changes required by the FAA
and the LBA. Based on the provisions of 14 Code of Federal Regulations
(CFR) part 21, Sec. Sec. 21.17(b), 21.17(c) and 21.29, the following
airworthiness requirements were evaluated and found applicable,
suitable, and appropriate for this design, and they remained active
until August 31, 2007, the FAA has now extended the project termination
date to May 31, 2008 and the requirements will stay active until that
date.
The German regulation Luftt[uuml]chtigkeitsforderungen f[uuml]r
Luftschiffe der Kategorien Normal und Zubringer, (referred to as the
LFLS), effective April 13, 2001; except:
(1) In lieu of compliance to LFLS Sec. 673 the LZ N07 will comply
with ADC Sec. 4.14.
(2) B-1 LBA, Equivalent Safety Finding for Sec. 76 LFLS, Engine
Failure.
Discussion
The LFLS requires that the airship restore itself to a state of
equilibrium after the failure of any one engine during any flight
condition. In the case of the LZ N07, a state of equilibrium using
designated ballast cannot be achieved as required by the LFLS. ZLT met
this requirement with an equivalent level of safety.
In lieu of the provisions of LFLS Sec. 76 the following is
required:
In the case of failure of any one engine (of three) it must be
shown that a zero vertical speed condition can be established for any
flight condition by using the thrust vectoring capability of the
remaining two engines and aerodynamic lift.
The time to achieve this zero vertical speed will be demonstrated
to be not more than when using a designated ballast system with a
minimum discharge rate established in LFLS Sec. 893(d).
(3) B-2 LBA, Equivalent Safety Finding for LFLS Sec. 143(b),
Controllability and Maneuverability, General [all engines out].
Discussion
LFLS Sec. 143(b) requires that the airship be capable of a safe
descent and landing after failure of all engines under the conditions
of LFLS Sec. 561. ZLT met this requirement with an equivalent level of
safety.
Even in the event of all engines failing, a limited means to
control the descent of the airship is available, but only with the
airship in equilibrium. With the airship heavy, there is no means to
modulate the descent once speed has dissipated, since the descent rate
is determined by heaviness only. However, descent will be stable and no
unsafe attitude will result and the worst-case descent rate is still in
compliance with the emergency landing conditions of LFLS Sec. 561.
This fulfills the safety objective of LFLS Sec. 143(b).
To satisfy the provisions of LFLS Sec. 143(b), the following is
required:
A qualitative safety analysis will be performed to show that the
simultaneous occurrence of a loss of all engines (combined with worst
case weight conditions) is extremely improbable.
(4) B-3 LBA, Equivalent Safety Finding for LFLS Sec. 33(d)(2),
Propeller Speed and Pitch Limits.
Discussion
LFLS Sec. 33(d)(2) requires a demonstration with the propeller
speed control inoperative that there is a means to limit the maximum
engine speed to
[[Page 16928]]
103 percent of the maximum allowable takeoff rotations per minute
(rpm). The LZ N07 is designed so that in case of a zero thrust
condition in flight, the affected engine is shut off. The shutoff rpm
is above 103 percent of the maximum allowable takeoff rpm.
The LZ N07 airship is not equipped with a traditional propeller
governor system. The propeller speed control function is provided by
the AIU (engine control board). If the AIU fails, a means to shut down
the engine is provided: called the Limiting System (Lasar). The
limiting system provides two functional stages; the first stage limits
rpm between 2725 and 2750, in case the AIU engine control board is
unable to limit engine speed with the propeller in zero thrust pitch
condition. The second stage shuts down the engine at 2900 rpm in case
of limiting system first stage failure in order to avoid engine and
propeller disintegration hazard to the airship. The shutdown of one
engine is considered a major hazard. (Note: maximum rpm = 2700, 103
percent maximum rpm = 2781.)
In traditional governor systems during in-flight operation with
zero thrust pitch selected, overspeed protection is not assured in case
of a governor failure. The LZ N07 design is considered to provide
equivalent or improved safety compared to previously certified
(traditional) governor systems.
To satisfy the provisions of LFLS Sec. 33(d)(2), the following is
required:
The proper function of the systems will be demonstrated by
performing a system ground test simulation.
The propeller overspeed capability of 126 percent of the maximum
rpm will comply with the provisions of JAR P certification, (JAR P
Sec. 170(a)(2)).
(5) B-4 LBA, Equivalent Safety Finding for LFLS Sec. 145,
Longitudinal Control.
Discussion
LFLS Sec. 145 requires a demonstration of nose-down pitch change
out of a stabilized and trimmed climb and 30 degree pitch angle at
maximum continuous power and a nose-up pitch change out of a stabilized
and trimmed descent and -30 degree pitch angle at maximum continuous
power on all engines. ZLT met this requirement with an equivalent level
of safety. The LZ N07 ballonet system limitations prevent stabilized
climbs or descents above certain vertical speeds. The procedure
required in LFLS Sec. 145 cannot be demonstrated by flight test
without modification.
ZLT demonstrated through flight test that sufficient control
authority was available to recover from a steep climb or descent when
the airship is trimmed for the appropriate climb or descent and is
operated under maximum continuous power.
Additionally, it was also shown that it is possible to produce a
nose-down pitch change out of a stabilized and trimmed climbing flight
and a nose-up pitch change out of a similar descent. The LZ N07
ballonet systems limitations prevent this from being demonstrated at
maximum continuous power and 30-degree pitch angle because the climb or
descent rates are too high at the resulting airspeed.
To satisfy the provisions of LFLS Sec. 145 the following is
required:
A flight test procedure will demonstrate that it is possible to
produce:
(1) A nose-down pitch change out of a stabilized climb with a nose-
up flight path angle as limited by the ballonet system for the relevant
true airspeed or 30 degrees, whichever leads to a lower absolute value.
(2) A nose-up pitch change out of a stabilized descent with a nose-
down flight path angle as limited by the ballonet system for the
relevant true airspeed or -30 degrees, whichever leads to a lower
absolute value.
(6) C-1 LBA, Additional Requirement for a Reliable Load Validation;
14 CFR part 25, Sec. 25.301(b).
Discussion
The present LFLS does not include the requirement for the
manufacturer to validate the load assumptions used for stress analyses.
14 CFR part Sec. 25.301(b) requires that methods used to determine
load intensities and distribution must be validated by flight load
measurement unless the methods used for determining those loading
conditions are shown to be reliable.
The following is added as an additional requirement:
The provisions of 14 CFR part 25, Sec. 25.301(b) will be complied
with.
(7) D-1 LBA, Additional Requirements for LFLS Sec. 853(a),
Compartment Interiors [Flammability of Seat Cushions].
Discussion
LFLS Sec. 853 does not provide requirements for flammability
standards for seat cushions as introduced by Amendment 59 of 14 CFR
part 25. The LBA requested a proof test for seat cushions with the oil
burner as specified in 14 CFR part 25, Appendix F, part II or
equivalent for passenger seats, except for crew seats.
To satisfy the provisions of LFLS Sec. 853(a), the following is
required:
A proof test for seat cushions with the oil burner as specified in
14 CFR part 25, Appendix F, part II or equivalent for passenger seats
will be performed successfully.
(8) D-5 LBA, Additional Requirements for LFLS Sec. 673(d), Primary
Flight Controls.
Discussion
LFLS Sec. 673(d) requires that airships without a direct
mechanical linkage between the cockpit and primary flight control
surfaces be designed with a dual redundant control system. The
terminology ``dual redundant'' is considered ambiguous in that it does
not clearly define the degree of redundancy required.
To satisfy the provisions of LFLS Sec. 853(a), the following is
required:
Compliance with LFLS Sec. 1309 will show that continued safe
flight and landing is assured after complete failure of any one of the
primary flight control system lanes.
(9) D-6 LBA, Equivalent Safety Finding for LFLS Sec. 771(c), Pilot
Compartment [Controls Location with Respect to Propeller Hub].
Discussion
LFLS Sec. 771(c) requires that aerodynamic controls and pilots may
not be situated within the trajectories of the designated propeller
burst area. Since a thrust vectoring (including a non-swiveling lateral
propeller) system has been incorporated into the airship, with two
engines forward and one aft engine, formal non-compliance in some cases
cannot be avoided.
To satisfy the provisions of LFLS Sec. 771(c), the following is
required:
A qualitative safety analysis will be accomplished that considers
the mitigating effects of:
(1) The relationship of overall swivel angle of propeller
rotational plane versus crucial swivel angle of propeller rotational
plane,
(2) The distance between aft propeller and aerodynamic controls,
and
(3) The potential energy absorbing and deflecting structure between
aft propulsion unit and controls and pilot.
The analysis will consider the following:
The lateral propeller is continuously operating in idle with the
exception of ground maneuvering and approach phases.
The rear propeller transitions through its crucial angle only,
while swiveling from the horizontal to the vertical position from a
takeoff/approach/landing/hover to a level flight configuration.
Aircraft Flight Manual (AFM) procedures, cockpit placarding, and
swivel lever markings shall be
[[Page 16929]]
established to restrict normal operation in the crucial swivel range.
(10) D-7 LBA, Equivalent Safety Findings for LFLS Sec. 777(c),
Cockpit Controls; 1141(a), Powerplant Controls: General; 1143(c),
Engine Controls; 1149(a)(2), Propeller Speed and Pitch Controls;
1167(c)(1), Vectored Thrust Controls.
Discussion
LFLS Sec. 777(c), 1141(a), 1143(c), 1149(a)(2), and 1167(c)(1) all
involve requirements governing the configuration and characteristics of
throttle, propeller pitch, mixture, and thrust vectoring controls. Due
to the constant speed throttle control concept allowing infinitely
variable thrust vector control between maximum reverse and maximum
forward thrust, a non-conventional control system was developed that is
partially non-compliant with the requirements. The requirements and the
configuration of the LZ N07 are summarized in Table 1 below.
To satisfy the provisions of LFLS Sec. 777(c), 1141(a), 1143(c),
1149(a)(2) and 1167(c)(1) the following is required:
In the case of an identified non-compliance to the LFLS, as shown
in Table 1, compliance will be by an evaluation of the airship and a
finding that there are safe handling characteristics using the type
design engine thrust control/thrust vectoring controls as described in
Table 1.
Table 1
----------------------------------------------------------------------------------------------------------------
Compliant/non- Description of equivalent level of
LFLS paragraph Requirement compliant safety finding
----------------------------------------------------------------------------------------------------------------
777(c).............. throttle, propeller 1. non-compliant...... Propeller speed, thrust, and mixture
pitch, mixture 2. compliant.......... controls are arranged in this order
controls:. from left to right. Propeller speed
1. order left to right. and mixture are grouped together
2. arrange to prevent forward of the THRUST levers because
confusion. they are preset for individual
operating conditions. The THRUST
levers are located separately with
the L/H and R/H THRUST levers and
swivel controls grouped together in
order to achieve convenient vector
operation.
Rear engine thrust control set is
offset to the rear of the center
pedestal, which makes its allocation
to the rear engine obvious.
1141(a)............. 1. arrangement like 777 1. compliant as See 777(c) above; compliant.
2. markings like described above.
1555(a). 2. compliant..........
1143(c)............. 1. separate control of 1. compliant.......... 1. compliant
engines. 2. simultaneous 2. simultaneous control of forward
2. simultaneous control control virtually engines allows for symmetric thrust
of engines. compliant. applications, which are essential for
effective handling of the airship.
The aft engine THRUST lever is not
located between the forward THRUST
levers because it requires individual
control especially during take-off,
hover, landing and ground
maneuvering. Unintentional operation
of the aft engine is prevented by
this arrangement.
1149(a)............. simultaneous speed and Non-compliant for take- In contrast to conventional propeller
pitch control of off, hover, landing, controls, a constant propeller pitch
propellers. and ground maneuvering. is commanded directly by the THRUST
lever and propeller speed is
preselected by the RPM lever and is
automatically governed by means of
throttle variation.
In this operating mode, full RPM is
selected and pitch control is
commanded directly from the THRUST
levers, which are not grouped
together, thus not allowing
simultaneous pitch control. The
reason for this arrangement is
explained in issue 1143(c) above, In
FLIGHT configuration maximum pitch is
preselected by the THRUST levers,
speed control is now accomplished by
movement of the RPM levers, which are
grouped together allowing
simultaneous speed control.
1167(c)(1).......... Thrust vectoring:...... 1. compliant.......... 1. compliant.
1.--independent of 2. non compliant...... 2. simultaneous vectoring control of
other controls. forward engines allows for symmetric
2.--separate and vectoring. Asymmetric control of
simultaneous control of forward swivel angle is made
all propulsion units. impossible in order to prevent pilot
confusion during vector control.
Aft swivel adjustment is limited to 0
for cruise and -90 for T/L. The aft
swivel is separated due to the
individual control requirement.
----------------------------------------------------------------------------------------------------------------
(11) D-8 LBA, Equivalent Safety Findings for LFLS Sec. 807(d) and
Sec. 807(d)(1)(i), Emergency Exits.
Discussion
LFLS Sec. 807(d) and (d)(1)(i) for commuter category airships
carrying less than 15 passengers requires at least three emergency
exits. Refer to Table 2.
Table 2
----------------------------------------------------------------------------------------------------------------
Category versus exits First exit Second exit Third exit
----------------------------------------------------------------------------------------------------------------
Normal Category (Less than 10 External door/Main door: One exit 19 x 26 inches No requirement.
passengers.). Sec. 783(a) (19 x 26 opposite of main door:
inches). Sec. 807(a)(1).
[[Page 16930]]
Commuter Category (Less than 15 Main door must be floor Same as above........... In addition one exit 19
passengers.). level: Sec. 807(d)(1). x 26 required.
Commuter Category Zeppelin LZ Floor level main door Second floor level main Not provided. Equivalent
N07. Design comprising 12 much larger as 19 x 26 door much larger as 19 safety requested for
passengers. inches provided. x 26 inches provided. greater than 9
passengers.
----------------------------------------------------------------------------------------------------------------
The design of the LZ N07 fully complies with the requirement for
the Normal Category; however, the third exit required for compliance in
the Commuter Category is not provided. This results in a formal
noncompliance.
To satisfy the provisions of LFLS Sec. 807(d) and 807(d)(1)(i),
the following is required:
Compliance for LFLS Sec. 807(d) and 807(d)(1)(i) will be shown by:
(1) The first and second exits provided are both floor level exits
and oversized compared to 19 by 26 inches.
(2) The evacuation demonstration required in Sec. 803(e) shall be
accomplished within 60 seconds, (with one exit blocked) instead of 90
seconds.
(12) D-9 LBA, Equivalent Safety Finding for Sec. 881(a), Envelope
Design [Envelope Tension].
Discussion
LFLS Sec. 881(a) requires that the envelope maintain tension while
supporting limit load conditions for all flight conditions. The rigid
design of the LZ N07 allows for limited wrinkling of the envelope under
limit load conditions with no effect on airship handling and
performance.
Due to the unique kind of rigid structural design, the structural
integrity of the LZ N07 airship is not dependent on the tension of the
envelope, as rigid structure replaces the load-carrying envelope. The
alignment of structure, engines, empennage, cabin and other components
affecting handling qualities, performance, and other factors is
independent of any wrinkling condition of the envelope.
To satisfy the provisions of LFLS Sec. 881(a), the following is
required:
Safe handling characteristics will be demonstrated by flight test,
the limit load carrying capability by analysis.
(13) D-10 LBA, Equivalent Safety Finding for LFLS Sec. 881(f),
Envelope Design [Rapid Deflation Provisions].
Discussion
LFLS Sec. 881(f) requires that provisions be maintained to allow
for rapid envelope deflation of the airship should it break loose from
the mast while moored. The present design does not include such a
provision. For German certification, ZLT had to demonstrate an
equivalent level of safety. As part of this, ZLT presented that, due to
the unique kind of rigid structural design of the airship, any rapid
deflation provision will not significantly reduce the effective cross
section of the envelope; thus, the uncontrolled drift of the airship
due to surface winds once free of its moorings could not be brought
under control. ZLT presented that the overall level of safety is
negatively affected by the potential unwanted operation of the required
rapid deflation provision when unintentionally operated or operated due
to individual failure conditions, and that this could lead to a
potentially severe failure condition.
ZLT was required by the LBA to provide an equivalent level of
safety by means of a qualitative safety analysis and by showing that
the reliability of the mast coupling system design is significantly
improved over typical non-rigid airship systems. It also provided proof
of safe life design for the structural parts and to prove the fail-safe
design of the hydraulically powered locking mechanism. These systems
are part of the ground based mooring vehicle.
We understand that the rigid structure of the airship complicates
or eliminates the deflation design feature expected of non-rigid types
of airships, and we believe that this requirement cannot be met without
an equivalent level of safety. The rapid deflation feature of a non-
rigid airship is provided to allow emergency egress without the ship
lifting and to deflate the envelope in case an airship is blown off of
the mast and is subsequently uncontrolled. These concerns still apply
to a rigid airship.
We accept the evacuation procedure, described in the section
discussion LFLS Sec. 809(e), as an acceptable equivalent feature for
the evacuation requirement.
In the event that the airship is blown off of the mast, we believe
that a rigid airship will present the same or enhanced hazard as the
requirement for non-rigid type airships was developed to mitigate, that
being of an unmanned and, or, uncontrolled airship in controlled
airspace in the proximity of persons, property, or other aircraft.
To satisfy the provisions of LFLS Sec. 881(f), the following is
required:
Safe life design for the structural parts and fail-safe design of
the hydraulically powered locking mechanism of the mooring vehicle will
be shown.
The Airship Flight Manual will contain mast procedures for all
approved mast mooring conditions. These procedures will also include a
requirement to have transponder equipment active when the airship is
moored on the mast, and define conditions when a pilot must be in the
airship.
(14) D-11 LBA, Equivalent Safety Finding for LFLS Sec. 883(e),
Pressure System.
Discussion
LFLS Sec. 883(e) requires that provisions be maintained to blow
air into the helium space in order to prevent wrinkling of the
envelope. The present design of the airship does not include this
provision; therefore, ZLT had to demonstrate equivalent level of
safety.
Due to the unique kind of rigid structural design, the structural
integrity of the airship is not dependent on the tension of the
envelope. Rigid structure replaces the load-carrying envelope. The
alignment of structure, engines, empennage, and cabin, etc., affecting
handling qualities and airship controllability is independent of any
wrinkling condition of the envelope.
To satisfy the provisions of LFLS Sec. 883(e), the following is
required:
Safe operation at reduced helium pressures will be demonstrated.
(15) D-12 LBA, Interpretation of LFLS Sec. 785(b), Seats, berths
and safety belts [Approval of].
Discussion
The LFLS requires approval for seats; the LBA required approval of
passenger and crew seats according to TSO C39b. The ZLT uses seats that
are TSO C39b approved by a seat vendor; if this is not done, the seats
used will demonstrate compliance to TSO C39b.
To satisfy the provisions of LFLS Sec. 758(b), the following is
required:
Seats will comply with the provisions of TSO C39b.
[[Page 16931]]
(16) D-13 LBA, Additional Requirement; LFLS Sec. 1585(a)(10),
Operating Procedures [Ditching, Emergency Evacuation].
Discussion
The LFLS does not provide requirements for ditching exits; the LBA
requested a floatation analysis to be done, to analyze the case of an
unplanned ditching. Helium loss during the emergency evacuation
procedure was not considered. It was determined by calculation that the
passenger cabin provides enough buoyancy for safe egress with the
requirement that one emergency exit shall be usable above the static
waterline for at least 90 seconds for emergency evacuation.
To satisfy the provisions of LFLS Sec. 758(b), the following is
required:
It shall be demonstrated by test or analysis that an emergency
evacuation exit will remain above the waterline for at least 90 seconds
after finally settling on the water. Relevant instructions will be
included in the Airship Flight Manual.
(17) D-14 LBA, Interpretative Material; LFLS Sec. 803(e),
Emergency Evacuation Demonstration.
Discussion
LFLS Sec. 803(e) requires an emergency evacuation demonstration.
This evacuation must be completed within 90 seconds. Compliance with
LFLS Sec. 881(g) must be considered in conjunction with Sec. 803(a)
through (e).
This requirement demonstrates the ability of the entire cabin to be
evacuated within 90 seconds using the maximum number of occupants, with
flight crew preparation for the emergency evacuation. Normal valving of
helium to provide emergency deflation on the ground during the
emergency evacuation, according to Sec. 881(g), is assumed.
To satisfy the provisions of LFLS Sec. 803(e), the following is
required:
(1) It will be demonstrated that the cabin can be emergency
egressed within 90 seconds.
(2) In addition, the evacuation method established will include the
preparation of the airship for the ground phase of the emergency
evacuation on the ground. The applicant will demonstrate by analysis
supported by tests that the preparation for cabin emergency evacuation
could be conducted within 30 seconds (from time of landing until start
of cabin emergency evacuation). This technique will be published in the
AFM. Refer to Figure 1, ``ZLT Emergency Evacuation Technique.''
[GRAPHIC] [TIFF OMITTED] TN31MR08.000
(3) The evacuation method established will include four steps:
(a) After the occurrence of the emergency situation, the pilot has
to prepare the airship for an emergency landing.
(b) The pilot has to land the airship.
(c) The pilot has to prepare the airship for the evacuation. This
includes providing enough heaviness so that the airship cannot leave
the ground during the passenger evacuation. Also, the pilot must keep
the airship in a safe position before starting the evacuation. By
controlling the deflation, the pilot must try to prevent trapping of
the envelope over the occupants during the evacuation.
(d) The actual evacuation will only begin when a safe position of
the airship can be maintained and when enough heaviness is provided.
These steps will be reflected in the AFM.
(18) D-15 LBA, Additional Requirements; 14 CFR part 23, Sec. Sec.
23.859 and 23.1181(d), [cabin heating; fuel burner].
Discussion
ZLT wishes to install fuel burner heating equipment for a cabin
heating and ventilation system in the lower shell of the passenger
cabin. The LFLS does not provide adequate requirements for the
installation of fuel burner equipment. The LBA required the application
of 14 CFR part 23, Sec. Sec. 23.859 and 23.1181(d), revised as of
January 1, 1998, in addition to other applicable requirements of the
LFLS. The LBA interpretation of Sec. 23.859(a) is such that the entire
heater compartment will be considered a fire region and has to be of
fireproof construction. Part 23 Sec. 23.859, paragraphs (a)(1) to
(a)(3), will be complied with also. Other applicable FAA regulations
introduced by reference to Sec. Sec. 23.859 and 23.1181(d) by
[[Page 16932]]
the LBA will be complied with by compliance to applicable LFLS
sections.
The airship will comply with the provisions of 14 CFR part 23,
Sec. 23.859, Combustion Heater Fire Protection, and Sec. 23.1181(d),
Firewalls.
(19) E-1 LBA, Additional Requirements Remote Propeller Drive
System.
Discussion
The LZ N07 propellers of both forward and aft propulsion systems
are not conventionally installed directly on the engine crankshaft. A
remote propeller drive system consisting of torque shafts, swivel
gears, friction clutches and a belt drive unit (on the aft engine only)
is installed between engine and propeller to provide thrust and vector
capability for the propellers. The LFLS does not contain requirements
for such power transmission designs.
The LBA required compliance as described in LBA guidance paper I-
231-87, applicable to components installed between engines and
propellers. I-231-87(01) requires compliance with JAR 22H or 14 CFR
part 33; however, instead of JAR 22H or 14 CFR part 33 compliance,
compliance with applicable sections of JAR P (Change 7) as listed in
Table 3 will be required.
Table 3.--Applicable Sections of JAR P and I-231-87
----------------------------------------------------------------------------------------------------------------
Section Summary
----------------------------------------------------------------------------------------------------------------
I-231-87............................................................ Remote torque shafts/Fernwellen.
I-231-87(01)........................................................ Alle Bauteile zwischen Motor und Propeller
FAR 33.
I-231-87(02)........................................................ Kr[auml]fte auf k[uuml]rzestem Weg in
tragende Bauteile.
I-231-87(03)........................................................ Konstruktive Ma[beta]nahmen gegen
ungleiche Dehnung.
I-231-87(04)........................................................ Bei Drehgelenken ungleichf[ouml]rm.
Drehbewegung meiden.
I-231-87(05)........................................................ Abstand Struktur zu rotierenden Teilen
>13mm.
I-231-87(06)........................................................ FVB: Erweichungstemperatur TGA nicht
[uuml]berschreiten.
I-231-87(07)........................................................ Nicht feuersichere Wellen: Feuerschutz zum
Motor.
I-231-87(08)........................................................ Keine Gef[auml]hrdung durch angetr. Rest
gebroch. Welle.
I-231-87(09)........................................................ Unterkritischer Lauf/Kritische Drehzahl
1,5*nmax.
I-231-87(10)........................................................ Schwingungsversuch mit Anla[beta]-
Abstellvorg[auml]ngen.
JAR-P............................................................... Propellers: Change 7, dated 22.10.87.
JAR-P01............................................................. Section 1--Requirements.
JAR-P01 1A.......................................................... SUB-SECTION A--GENERAL
JAR-P030(a)(1)...................................................... Specification detailing airworthiness
requirements.
JAR-P040(b)......................................................... Fabrication methods.
JAR-P040(b)(1)...................................................... Consistently sound structure and reliable.
JAR-P040(b)(2)...................................................... Approved process specifications, if close
control required.
JAR-P040(c)......................................................... Castings.
JAR-P040(c)(1)...................................................... Casting technique, heat treatment, quality
control.
JAR-P040(c)(2)...................................................... AA Approval for casting production
required.
JAR-P040(e)......................................................... Welded structures and welded components.
JAR-P040(e)(1)...................................................... Welding technique, heat treatment, quality
control.
JAR-P040(e)(3)...................................................... Drawings annotated and with working
instructions.
JAR-P040(e)(4)...................................................... If required, radiographic inspection, may
be in steps.
JAR-P070............................................................ Failure analysis.
JAR-P070(a)......................................................... Failure analysis/assessment of propeller
and control systems.
JAR-P070(b)(2)...................................................... Significant overspeed or excessive drag.
JAR-P070(c)......................................................... Proof of probability of failure.
JAR-P070(e)......................................................... Acceptability of failure analysis, if more
on 1 of:
JAR-P070(e)(1)...................................................... A safe life being determined.
JAR-P070(e)(2)...................................................... A high level of integrity, parts to be
listed.
JAR-P070(e)(3)...................................................... Maintenance actions, serviceable items.
JAR-P080............................................................ Propeller pitch limits and settings.
JAR-P090............................................................ Propeller pitch indications.
JAR-P130............................................................ Identification.
JAR-P140............................................................ Conditions applicable to all tests.
JAR-P140(a)......................................................... Oils and lubricants.
JAR-P140(b)......................................................... Adjustments.
JAR-P140(b)(1)...................................................... Adjustments prior to test not be altered
after verification.
JAR-P140(b)(2)...................................................... Adjustment and settings checked/
unintentional variations recorded.
JAR-P140(b)(2)(i)................................................... At each strip examination.
JAR-P140(b)(2)(ii).................................................. When adjustments and settings are reset.
JAR-P140(b)(3)...................................................... Instructions for (b)(1) proposed for
Manuals.
JAR-P140(c)......................................................... Repairs and replacements.
JAR-P140(d)......................................................... Observations.
JAR-P150............................................................ Conditions applicable to endurance tests
only.
JAR-P150(a)......................................................... Propeller accessories to be used during
tests.
JAR-P150(b)......................................................... Controls (ground and flight tests).
JAR-P150(b)(1)...................................................... Automatic controls provided in operation.
JAR-P150(b)(2)...................................................... Controls operated in accordance with
instructions.
JAR-P150(b)(3)...................................................... Instructions provided in Manuals.
JAR-P150(c)......................................................... Stops (ground tests).
JAR-P160............................................................ General.
JAR-P160(b)......................................................... Pass without evidence of failure or
malfunction.
JAR-P160(c)......................................................... Detailed inspection before and after tests
complete.
JAR-P170(c)......................................................... Spinner, deicing equipment, etc., subject
to same test.
[[Page 16933]]
JAR-P190(c)......................................................... Propellers fitted with spinner and fans.
JAR-P200............................................................ Rig tests of propeller equipment.
JAR-P200(a)......................................................... Tests for feathering, beta control, thrust
reverse.
JAR-P200(b)......................................................... Test to represent the amount of 1000 hour
cycles.
JAR-P200(c)......................................................... Evidence of similar tests may be
acceptable.
JAR-P210............................................................ Endurance tests.
JAR-P210(b)......................................................... Variable pitch propellers.
JAR-P210(b)(1)...................................................... Variable pitch propellers tested to one of
following:
JAR-P210(b)(1)(i)................................................... A 110-hour test.
JAR-P210(b)(1)(i)(A)................................................ 5 hours at takeoff power.
JAR-P210(b)(1)(i)(B)................................................ 50 hours maximum continuous power.
JAR-P210(b)(1)(i)(C)................................................ 50 hours consisting of ten 5-hour cycles.
JAR-P210(b)(2)...................................................... At conclusion of the endurance test total
cycles.
JAR-P210(b)(2)(ii).................................................. Governing propellers: 1500 cycles of
control.
JAR-P210(b)(2)(iv).................................................. Reversible-pitch propellers: 200 cycles +
30 seconds.
JAR-P220............................................................ Functional tests not less 50 in flight.
JAR-P220(b)......................................................... Variable pitch (governing) propellers.
JAR-P220(b)(1)...................................................... Propeller governing system compatible w.
engine.
JAR-P220(b)(2)...................................................... Stability of governing under various oil
temperatures conditions.
JAR-P220(b)(3)...................................................... Response to rapid throttle movements,
balked landing.
JAR-P220(b)(4)...................................................... Governing and feathering at all speeds up
to VNE.
JAR-P220(b)(5)...................................................... Unfeathering, especially after cold soak.
JAR-P220(b)(6)...................................................... Beta control response and sensitivity.
JAR-P220(b)(7)...................................................... Correct operation of stops and warning
lights.
JAR-P220(c)......................................................... Propeller design for operation in reverse
pitch 50 landing.
----------------------------------------------------------------------------------------------------------------
To satisfy the additional required provisions, the following is
required:
Compliance will be shown for the Remote Propeller Drive System to
the requirements of LBA document I-237-87, dated September 1987, and
the Joint Aviation Requirements (JARs) summarized in Table 3.
Table 3.--(Repeated)
----------------------------------------------------------------------------------------------------------------
Section Summary
----------------------------------------------------------------------------------------------------------------
I-231-87............................................................ Remote torque shafts/Fernwellen.
I-231-87(01)........................................................ Alle Bauteile zwischen Motor und Propeller
FAR 33.
I-231-87(02)........................................................ Kr[auml]fte auf k[uuml]rzestem Weg in
tragende Bauteile.
I-231-87(03)........................................................ Konstruktive Mabnahmen gegen ungleiche
Dehnung.
I-231-87(04)........................................................ Bei Drehgelenken ungleichfrm. Drehbewegung
meiden.
I-231-87(05)........................................................ Abstand Struktur zu rotierenden Teilen
>13mm.
I-231-87(06)........................................................ FVB: Erweichungstemperatur TGA nicht
[uuml]berschreiten.
I-231-87(07)........................................................ Nicht feuersichere Wellen: Feuerschutz zum
Motor.
I-231-87(08)........................................................ Keine Gef[auml]hrdung durch angetr. Rest
gebroch. Welle.
I-231-87(09)........................................................ Unterkritischer Lauf/ Kritische Drehzahl
1,5*nmax.
I-231-87(10)........................................................ Schwingungsversuch mit Anlab-
Abstellvorg[auml]ngen.
JAR-P............................................................... Propellers Change 7, dated 22.10.87.
JAR-P01............................................................. Section 1--Requirements.
JAR-P01 1A.......................................................... SUB-SECTION A--GENERAL.
JAR-P030(a)(1)...................................................... Specification detailing airworthiness
requirements.
JAR-P040(b)......................................................... Fabrication Methods.
JAR-P040(b)(1)...................................................... Consistently sound structure and reliable.
JAR-P040(b)(2)...................................................... Approved process specification, if close
control required.
JAR-P040(c)......................................................... Castings.
JAR-P040(c)(1)...................................................... Casting technique, heat treatment, quality
control.
JAR-P040(c)(2)...................................................... AA Approval for casting production
required.
JAR-P040(e)......................................................... Welded Structures and Welded Components.
JAR-P040(e)(1)...................................................... Welding technique, heat treatment, quality
control.
JAR-P040(e)(3)...................................................... Drawings annotated and with working
instructions.
JAR-P040(e)(4)...................................................... If required, radiographic inspection, may
be in steps.
JAR-P070............................................................ Failure Analysis.
JAR-P070(a)......................................................... Failure analysis/assessment propeller/
control system.
JAR-P070(b)(2)...................................................... Significant overspeed or excessive drag.
JAR-P070(c)......................................................... Proof of probability of failure.
JAR-P070(e)......................................................... Acceptability of failure analysis, if more
on 1 of:
JAR-P070(e)(1)...................................................... A safe life being determined.
JAR-P070(e)(2)...................................................... A high level of integrity, parts to be
listed.
JAR-P070(e)(3)...................................................... Maintenance actions, serviceable items.
JAR-P080............................................................ Propeller Pitch Limits and Settings.
JAR-P090............................................................ Propeller Pitch Indications.
JAR-P130............................................................ Identification.
[[Page 16934]]
JAR-P140............................................................ Conditions Applicable to All Tests.
JAR-P140(a)......................................................... Oils and Lubricants.
JAR-P140(b)......................................................... Adjustments.
JAR-P140(b)(1)...................................................... Adjustment prior to test not be altered
after verification.
JAR-P140(b)(2)...................................................... Adjustment and settings checked/
unintentional variations recorded.
AR-P140(b)(2)(i).................................................... At each strip examination.
JAR-P140(b)(2)(ii).................................................. When adjustments and settings are reset.
JAR-P140(b)(3)...................................................... Instructions for (b)(1) proposed for
Manuals.
JAR-P140(c)......................................................... Repairs and Replacements.
JAR-P140(d)......................................................... Observations.
JAR-P150............................................................ Conditions Applicable to Endurance Tests
Only.
JAR-P150(a)......................................................... Propeller accessories to be used during
tests.
JAR-P150(b)......................................................... Controls (Ground and Flight Tests).
JAR-P150(b)(1)...................................................... Automatic controls provided in operation.
JAR-P150(b)(2)...................................................... Controls operated in accordance with
instructions.
JAR-P150(b)(3)...................................................... Instructions provided in Manuals.
JAR-P150(c)......................................................... Stops (Ground Tests).
JAR-P160............................................................ General.
JAR-P160(b)......................................................... Pass without evidence of failure or
malfunction.
JAR-P160(c)......................................................... Detailed inspection before and after tests
complete.
JAR-P170(c)......................................................... Spinner, deicing equipment, etc., subject
to same test.
JAR-P190(c)......................................................... Propellers Fitted with Spinner and Fans.
JAR-P200............................................................ Rig Tests of Propeller Equipment.
JAR-P200(a)......................................................... Tests for feathering, Beta Control, thrust
reverse.
JAR-P200(b)......................................................... Test to represent the amount of 1000 h
cycles.
JAR-P200(c)......................................................... Evidence of similar tests may be
acceptable.
JAR-P210............................................................ Endurance Tests.
JAR-P210(b)......................................................... Variable Pitch Propellers.
JAR-P210(b)(1)...................................................... Variable Pitch Propellers tested to one of
following.
JAR-P210(b)(1)(i)................................................... A 110-Hour Test.
JAR-P210(b)(1)(i)(A)................................................ 5 hours at Takeoff Power.
JAR-P210(b)(1)(i)(B)................................................ 50 hours Maximum Continuous Power.
JAR-P210(b)(1)(i)(C)................................................ 50 hours consisting of ten 5-hour cycles.
JAR-P210(b)(2)...................................................... At conclusion of the Endurance Test total
cycles.
JAR-P210(b)(2)(ii).................................................. Governing Propellers: 1500 cycles of
control.
JAR-P210(b)(2)(iv).................................................. Reversible-pitch Propellers: 200 cycles +
30 sec.
JAR-P220............................................................ Functional Tests not less 50 in flight.
JAR-P220(b)......................................................... Variable Pitch (Governing) Propellers.
JAR-P220(b)(1)...................................................... Propeller governing system compatible with
engine.
JAR-P220(b)(2)...................................................... Stability of governing under various oil
temperature conditions.
JAR-P220(b)(3)...................................................... Response to rapid throttle movements,
balked landing.
JAR-P220(b)(4)...................................................... Governing and feathering at all speeds up
to VNE.
JAR-P220(b)(5)...................................................... Unfeathering, especially after cold soak.
JAR-P220(b)(6)...................................................... Beta control response and sensitivity.
JAR-P220(b)(7)...................................................... Correct operation of stops and warning
lights.
JAR-P220(c)......................................................... Propeller Design for Operation in Reverse
Pitch 50 landing.
----------------------------------------------------------------------------------------------------------------
LBA DOCUMENT I-237-87
Preliminary Guideline for Compliance of Transmission-Shafts in
Powerplant Installations of Airplanes (Part 23) and Powered
Sailplanes (JAR 22)
LBA-Document: I231-87
Issue: 30. September 1987
Change record: translated into English, May 2002
Translation has been done by best knowledge and judgment. In any
case, the officially published text in German language is
authoritative.
At the present time the Airworthiness Requirements for motorized
aircraft assume only propeller-engine-combinations, where the
propeller is directly fixed at the engine flange.
Clutches, transmission shafts, intermediate bearings, angular
drives (gearboxes), universal joints, shifting sleeves etc. are
accommodated for neither by JAR-22, nor by part 23 (JAR-23), or part
33 (JAR-E).
The necessity to supplement/amend the Airworthiness Requirements
became obvious for a powered sailplane, where a transmission shaft
from the engine in the middle of the fuselage runs through the
cockpit between the pilots (side-by-side seats) to the bow of the
fuselage where the propeller is mounted.
The rupture of a so installed transmission shaft can, besides
the loss of thrust, also by the whirling of the parts that remain
attached to the run-away engine have catastrophic effects to pilots
and aircrafts/aeroplanes.
Also differently arranged transmission shafts that do not pass
through the cockpit can endanger the surrounding primary structure,
the controls or other important systems critically.
For transmission shaft installations the following Special
Requirements have to be applied for powered sailplanes and aircraft
(aeroplanes) in addition to JAR-22 and part 23 (JAR-23),
respectively part 33 (JAR-E):
(l) All parts between engine and propeller, that serve the
transfer of engine-power to the propeller are regarded as parts of
the engine and are, as far as practicable/applicable, to be shown to
comply with JAR-22 Subpart H Engines or part 33 Aircraft Engines
(JAR-E), respectively.
(2) Propeller thrust, lateral loads and gyroscopic moments have
to be transferred to load carrying members on the shortest possible
way.
(3) Dissimilar expansion/deformation between structural and
powerplant parts, may it be under loads or/and temperatures has to
be accounted for by appropriate means.
(4) Universal joints used in the transmission shaft installation
have to be selected and arranged/installed so that an unsteadiness
of the rotation speed is avoided.
[[Page 16935]]
(5) Wrappings, guidances, protective covers and all other
structural members must have such a spacing from rotating parts,
that under deformation due to flight or ground loads and if pressure
is exerted by parts of the body (pilot or passenger) a radial or
respectively longitudinal distance of at least 13 mm (0.5 inch)
remains.
(6) It has to be guaranteed that parts made of fibre-reinforced
materials during operation do not exceed (reach) the softening
temperature. Softening temperature: TGA according to DIN 29971.
Compliance has to be sought in a ``cooling test flight'' according
to JAR 22.1041/22.1047 or part 23, Sec. Sec. 23.1041/23.1045/
23.1047 (or JAR 23...), respectively.
If the difference between the corrected maximum operational
temperature and the softening temperature is less than 15, the
operational temperature has to be monitored (continuously) by an
instrument.
(7) If parts of the transmission shaft installation are made
from material not being fireproof, these parts have to be protected
against the effects of fire in the engine compartment.
(8) It has to be shown, that the whirling rest of a broken
transmission shaft, still driven by the engine does neither directly
endanger occupants (pilots included) nor parts of the primary
structure in a way that the flight cannot be brought to a safe end.
Compliance has to be sought in a test under the assumption that the
shaft is broken at a place most critical for compliance and the
engine running at take-off power.
(9) The repeated in-flight-stopping and re-starting of the
engine is common practice for powered sailplane. To avoid passing
through a critical RPM-range, transmission shaft installation must
operate in a sub-critical RPM-range.
The critical RPM of any transmission shaft must be at least 1.5
times the maximum operational RPM. When determining the critical RPM
the influences of the maximum imbalance to be expected from the
manufacturing process, as well as the bending of the shaft under
load factor and probable forced bending by fuselage deformation has
to be considered.
(10) The vibration test required by JAR-22.1843 or FAR 33.43
(a)(b)/ (JAR-E) respectively must comprise the complete transmission
shaft installation (engine-transmission-shaft-propeller). The
effects of engine stopping and restarting must be investigated.
The stresses derived from the test above have to be superimposed
with the stresses directly originating from load factors acting on
the transmission shaft or are forced on the transmission shaft by
deformation of the airframe.
The resulting peak stresses must not exceed the fatigue limit of
the material used for the transmission shaft installation.
Figure 2: LBA Document
(20) E-2 LBA, Equivalent Safety Finding; LFLS Sec. 1167(d),
Vectored Thrust Components [Auxiliary Thrust Vectoring].
Discussion
LFLS Sec. 1167(d) (subpart E) requires an auxiliary means be
provided to return the vectoring thrust system into a normal operating
position should the primary means fail. The current design does not
include this design feature. The LZ N07 is equipped with a system of
swiveling propellers. This system is used for conventional cruise
flight with the propellers in a vertical position and also for steering
the airship at low airspeeds with the propellers in swiveled positions.
This results in no one ``normal position'' of the propeller than can be
specified. Even if the propeller swiveling system fails, such a stuck
position might be useful for the pilot. Also, since all three engines
are operating individually, a single vectoring failure does not
interfere with the two remaining propulsion units.
Instead of providing auxiliary means to return the system to the
normal operating position, the design, operation, and function of the
vectoring system on the Zeppelin LZ N07 airship provides an equivalent
level of safety.
To satisfy the provisions of LFLS Sec. 1167(d), the following is
required:
It will be shown by flight test that continued safe flight and
landing is possible with a propeller stuck in any one position with the
affected engine (still) running or shut off.
(21) F-1 LBA, Additional Requirements; LFLS Sec. 1301, Function
and Installation; and LFLS Sec. 1309, Equipment, Systems and
Installations (HIRF).
Discussion
The LZ N07 utilizes new avionics/electronic systems that provide
critical data to the flight crew. The applicable regulations do not
contain adequate or appropriate safety standards for the protection of
these systems from the effects of high intensity radiated fields
(HIRF). The LBA's required additional safety standards considered
necessary to establish a level of safety equivalent to that established
by existing airworthiness standards.
There is no specific regulation that addresses protection
requirements for electrical and electronic systems from HIRF. Increased
power levels from the ground based radio transmitters and the growing
use of sensitive electrical and electronic systems to command and
control the airship, especially under IFR conditions, have made it
necessary to provide adequate protection. To ensure that the level of
safety is achieved equivalent to that intended by the regulations
incorporated by reference, additional requirements are needed for the
LZ N07 to require that new technology electrical and electronic systems
be designed and installed to preclude component damage and interruption
of critical functions due to effect of HIRF.
High Intensity Radiated Fields (HIRF)
With the trend toward increased power levels from ground-based
transmitters, plus the advent of space and satellite communications,
coupled with electrical and electronic command and control of an
airship, the immunity of critical systems to HIRF must be established.
It is not possible to precisely define the HIRF to which the airship
will be exposed in service. There is also uncertainty concerning the
effectiveness of gondola shielding for HIRF. Furthermore, coupling of
electromagnetic energy to gondola-installed equipment through the
windows apertures is undefined. Based on surveys and analysis of
existing HIRF emitters, an adequate level of protection exists when
compliance with the HIRF special condition is shown.
To satisfy the provisions of LFLS Sec. 1301 and LFLS Sec. 1309
the following is required:
The airship systems and associated components, considered
separately and in relation to other systems, must be designed and
installed so that:
(a) Each system that performs a critical or essential function is
not adversely affected when the airship is exposed to the normal HIRF
environment.
(b) All critical functions must not be adversely affected when the
airship is exposed to the certification HIRF environment.
(c) After the airship is exposed to the certification HIRF
environment, each affected system that performs a critical function
recovers normal operation without requiring any crew action, unless
this conflicts with other operational or functional requirements of
that system.
The following definitions apply:
(a) Critical function: A function whose failure would prevent
continued safe flight and landing of the airship.
(b) Essential function: A function whose failure would reduce the
capability of the airship or the ability of the crew to cope with
adverse operating conditions.
(c) The definitions of normal and certification HIRF environments,
frequency bands, and corresponding average and peak levels are defined
in Table 4 and Table 5.
[[Page 16936]]
General Guidance Material
The User Guide for AC/AMJ 20-1317 THE CERTIFICATION OF AIRCRAFT
ELECTRICAL AND ELECTRONICAL SYSTEMS FOR OPERATION IN THE HIGH RADIATED
FIELDS (HIRF) ENVIRONMENT dated 9/21/98 must be used. In case of
conflicting issues, this notice will supersede, unless otherwise
notified.
Criticality Definitions
In order to perform hazard assessments, the table below defines
equivalence:
Table 4
------------------------------------------------------------------------
Guidance according LFLS certification
Definition CRI F-1/HIRF to AC/AMJ 20-1317 basis *
------------------------------------------------------------------------
Critical.................... Catastrophic........ Multiple failure
analysis will not
apply in general.
Essential................... Hazardous Severe Multiple failure
Major. analysis will not
apply in general.
------------------------------------------------------------------------
* Since the LFLS is based on 14 CFR part 23, multiple failure analysis
will not apply in general. However, common mode failures, or failures
if one failure would lead inevitably to another failure, have to be
considered.
Equipment Test Requirements
If ZLT can demonstrate for Level A, B, or C equipment that
equipment testing is adequate for showing compliance, the following
equipment test requirement will be used:
RTCA DO-160 D, if equipment development was launched in 1996 or
later a no TSO or JTSO certification will be obtained by the supplier.
RTCA DO-160 C, or earlier if equipment development was launched in
1995 or earlier, or if the equipment affected already holds a separate
TSO or JZSO certification.
Table 5
------------------------------------------------------------------------
Frequency Peak Average
------------------------------------------------------------------------
10 kHz-100 kHz.................................... 40 40
100 kHz-500 kHz................................... 40 40
500 kHz-2 MHz..................................... 40 40
2 MHz-30 MHz...................................... 100 100
30 MHz-70 MHz..................................... 20 20
70 MHz-100 MHz.................................... 20 20
100 MHz-200 MHz................................... 50 30
200 MHz-400 MHz................................... 70 70
400 MHz-700 MHz................................... 730 30
700 MHz-1 GHz..................................... 1300 70
1 GHz-2 GHz....................................... 2500 160
2 GHz-4 GHz....................................... 3500 240
4 GHz-6 GHz....................................... 3200 280
6 GHz-8 GHz....................................... 800 330
8 GHz-12 GHz...................................... 3500 330
12 GHz-18 GHz..................................... 1700 180
------------------------------------------------------------------------
Certification HIRF Environment
Field Strengths in Volts/Meter, (V/m).
Note: At 10 kHz-100kHz a Height Impedance Field of 320V/m peak
exists.
Table 6
------------------------------------------------------------------------
Frequency Peak Average
------------------------------------------------------------------------
10 kHz-100 kHz.................................... 20 20
100 kHz-500 kHz................................... 20 20
500 kHz-2 MHz..................................... 30 30
2 MHz-30 MHz...................................... 50 50
30 MHz-70 MHz..................................... 10 10
70 MHz-100 MHz.................................... 10 10
100 MHz-200 MHz................................... 30 30
200 MHz-400 MHz................................... 25 25
400 MHz-700 MHz................................... 730 30
700 MHz-1 GHz..................................... 40 10
1 GHz-2 GHz....................................... 1700 160
2 GHz-4 GHz....................................... 3000 170
4 GHz-6 GHz....................................... 2300 280
6 GHz-8 GHz....................................... 530 230
------------------------------------------------------------------------
Normal HIRF Environment
Field Strengths in Volts/Meter, (V/m).
Abbreviations:
GHz Gigahertz
IFR Instrument Flight Rules
kHz Kilohertz
m Meter
MHz Megahertz
V Volt
(22) F-2 LBA, Additional Requirements; LFLS Sec. 1301, Function
and Installation, and LFLS Sec. 1309, Equipment, Systems and
Installations [Software development and transition to RTCA DO-178B/ED-
12B].
Discussion
The LZ N07 will be certificated with microprocessor-based systems
installed that contain software. The LBA considered that there was
limited policy or guidance for transitioning to the use of RTCA DO
178B/ED-12B from earlier guidance regarding means of compliance for
software-based systems. Specific transition criteria were specified for
the LZ N07 compliance program.
RTCA DO 178B/ED-12B, ``Software Considerations in Airborne Systems
and Equipment Certification,'' dated December 1, 1992, provides
guidance for software development where industry and regulatory
experience showed RTCA document DO 178A/ED-12A, ``Software
Considerations in Airborne Systems and Equipment Certification,'' dated
1985, required revision. Through RTCA, Inc./EUROCAE, a joint committee
comprised of representatives from both the public and private sectors,
created DO 178B/ED-12B to reflect the experience gained in the
certification of aircraft and engines containing software based systems
and equipment and to provide guidance in the area not previously
addressed by DO 178A/ED-12A. DO 178B/ED-12B contains more objectively
determinable compliance criteria and considerably enhances the
consistency of software evaluations. The use of DO 178B/ED-12B provides
for a more thorough and sure compliance finding to objective standards,
reducing the likelihood of software errors.
Due to being superseded for the reasons discussed above, DO 178A/
ED-12A and prior versions were not recognized by the LBA as acceptable
means of compliance for software being developed or being modified for
an airship certification program (in Germany) whose application date
was later than January 11, 1993 (except as noted in subparagraph 1(a)
and 1(b) below). The LZ N07 program fell into this category. ZLT was
allowed to propose exceptions to the use of DO 178B/ED-12B (or
equivalently acceptable means of compliance) for specific systems or
equipment. These requests were evaluated on a case-by-case basis and
were considered when:
(a) The LBA determined that the software modification is so simple
or straightforward that an upgrade of the applicant's processes to DO
178B/ED-12B from earlier revisions of DO 178/ED-12 is not necessary for
assuring that the modification is specified, designed, and implemented
correctly, and verified appropriately; or
(b) Where a straightforward and readily obvious determination could
be made by the LBA that airworthiness will not be affected if some
specific objectives of DO 178B/ED-12B were not met.
One example might be the modification of a code table or local or
private data that can be readily verified by inspection. A second
example might
[[Page 16937]]
be minor gain changes necessary for adoption of existing equipment to a
new airframe. A third example might be the modification of a small
percentage of code that has no effect on common or global data or other
forms of coupling between modules nor interfaces with other equipment
or where such effects are easily limited and where such limiting is
easily verifiable. A fourth example might be where a non-essential
system with Level 3 software per DO 178A/ED-12A would be appropriately
re-categorized during the system safety assessment and DO 178B/ED-12B
processes as Level E software. Exemptions such as the above were, for
the most part, directed at previously approved software-based equipment
that had an established and acceptable service history performing the
same function in the same installation environment as the new
application and for which only significant changes were being made such
as outlined above.
Regardless of which version of DO 178/ED-12 was used, ZLT was
required to submit to the LBA a Plan for Software Aspects of
Certification (PSAC), a Software Configuration Index (SCI), and a
Software Accomplishment Summary (SAS) containing the information
specified in DO 178B/ED-12B, paragraphs 11.1, 11.16, and 11.20,
respectively, in addition to any other information required by the
version of DO 178/ED-12 used for the software approval.
For the software being modified, two acceptable methods of
upgrading to DO 178B/ED-12B were specified:
(a) ZLT was allowed to upgrade the entire development baseline,
including all processes and all data items per the provisions of DO
178B/ED-12B, section 12.1.4. Existing processes and data items that can
be shown to already meet the objectives for DO 178B/ED-12B will not
need upgrading.
(b) Alternatively, ZLT was allowed to choose an incremental
approach, using DO 178B/ED-12B processes to make modifications and
upgrading the products (data items) of the life cycle processes only
where they are affected by the modification. A regression analysis
should identify those areas of the code and other data items affected
by the modification. Data items were upgraded in those areas where they
were directly affected by the modification (for instance, new
requirements) and where required in order to satisfy the objectives of
DO 178B/ED-12B, Annex A (for instance, where otherwise unmodified
requirements must be upgraded to provide sufficient data for the
requirements-based testing of the modified code sections).
In planning the transition activities using either alternative, ZLT
should perform an analysis to see where the processes and products of
the software life cycle do not satisfy the DO 178B/ED-12B objectives.
This will provide a limit to the activity required and criteria for
assessing the upgrade.
To satisfy the provisions of LFLS Sec. 1301 and LFLS Sec. 1309,
the following is required:
Software development for the LZ N07 will be accomplished according
to DO 178B/ED-12B (or equivalently acceptable means of compliance) for
specific systems or equipment. Deviations from this requirement will be
considered when:
(a) The software modification is so simple or straightforward that
an upgrade of the applicant's processes to DO 178B/ED-12B from earlier
revisions of DO 178/ED-12 is not necessary for assuring that the
modification is specified, designed, and implemented correctly, and
verified appropriately; or
(b) Where a straightforward and readily obvious determination can
be made by the certifying authority that airworthiness will not be
affected if some specific objectives of DO 178B/ED-12B were not met.
The applicant will submit a Plan for Software Aspects of
Certification (PSAC), a Software Configuration Index (SCI), and a
Software Accomplishment Summary (SAS) containing the information
specified in DO 178B/ED-12B, paragraphs 11.1, 11.16, and 11.20,
respectively, in addition to any other information required by the
version of DO 178/ED-12 used for the software approval.
For software modifications, two methods of upgrading to DO 178B/ED-
12B are acceptable:
(a) Upgrade the entire development baseline, including all
processes and all data items, per the provisions of DO 178B/ED-12B,
section 12.1.4. Existing processes and data items that can be shown to
already meet the objectives for DO 178B/ED-12B will not need upgrading.
(b) Choose an incremental approach, using DO 178B/ED-12B processes
to make modifications and upgrading the products (data items) of the
life cycle processes only where they are affected by the modification.
A regression analysis should identify those areas of the code and other
data items affected by the modification. Data items were upgraded in
those areas where they were directly affected by the modification (for
instance, new requirements), and where required in order to satisfy the
objectives of DO 178B/ED-12B, Annex A (for instance, where otherwise
unmodified requirements must be upgraded to provide sufficient data for
the requirements-based testing of the modified code sections).
In planning the transition activities using either alternative, an
analysis will be performed to determine where the processes and
products of the software life cycle do not satisfy the DO 178B/ED-12B
objectives.
Equipment comprising software that is already certified under TSO,
JTSO, FAA-STC, or LBA requirements, will be excluded from this
requirement. However, the software qualification standard of such
equipment will be at least according to DO 178A.
Equipment comprising software that is specifically developed for
use in LZ N07 and modifications to equipment comprising software
specific for LZ N07 that is not, or is not yet, certified under TSO,
JTSO, FAA-STC, or LBA requirement, will be certified according to this
requirement.
(23) F-3 LBA, Additional Requirements, LFLS Sec. 1301, Function
and Installation, and LFLS Sec. 1309, Equipment, Systems and
Installations [Electronic Hardware Design Assurance (ASIC)].
Discussion
The LZ N07 will utilize electronic systems that may perform
critical and essential functions. During its certification of the
airship, the LBA made the determination that LBA airworthiness
requirements did not contain adequate standards or guidance for the
assurance that the internal hardware of these electronic systems are
designed to meet the appropriate safety standards.
There was no existing LBA policy or guidance for showing compliance
to the existing rules for those aspects of certification associated
with Application Specific Integrated Circuits (ASICs) and Electronic
Programmed Logic Devices (EPLDs). Recently, EUROCAE Working Group 46
``Complex Electronic Hardware'' was established to work in cooperation
with RTCA SC-180 to consider this subject.
LFLS Sec. 1309 was intended by the LBA as a general requirement
that should be applied to all systems and powerplant installations (as
required by LFLS Sec. 901(a)) to determine the effect on the airship
of a functional failure or malfunction. It is based on the principle
that there should be an inverse relationship between the severity of
the effect of a failure and the probability of its occurrence.
[[Page 16938]]
Definitions
a. Continued Safe Flight and Landing: The capability for continued
controlled flight and landing, possibly using emergency procedures, but
without requiring exceptional pilot skill or strength. Some airship
damage may be associated with a Failure Condition, during flight or
upon landing.
b. Error: An occurrence arising as a result of incorrect action by
the flight crew or maintenance personnel.
c. Event: An occurrence that has its origin distinct from the
airship, such as atmospheric conditions (e.g., gusts, temperature
variations, icing, and lightning strikes) runway conditions, cabin and
baggage fires. The term is not intended to cover sabotage.
d. Failure: A loss of function, or a malfunction, of a system or
part thereof. e. Failure Condition: The effect on the Airship and its
occupants, both direct and consequential, caused or contributed to by
one or more failures, considering relevant adverse operational or
environmental conditions. Failure Conditions may be classified
according to their severities as follows:
(1) Minor: Failure Conditions that would not significantly reduce
Airship safety and which involve crew actions that are well within
their capabilities. Minor failure conditions may include, for example,
a slight reduction in safety margins or functional capabilities, a
slight increase in crew workload, such as routine flight plan changes,
or some inconvenience to occupants.
(2) Major: Failure Conditions that would reduce the capability of
the Airship or the ability of the crew to cope with adverse operating
conditions to the extent that there would be, for example, a
significant reduction in safety margins or functional capabilities, a
significant increase in crew workload or in conditions impairing crew
efficiency, or discomfort to occupants, possibly including injuries.
(3) Hazardous: Failure conditions that would reduce the capability
of the airship or the ability of the crew to cope with adverse
operating conditions to the extent that there would be:
(a) A large reduction in safety margins or functional capabilities;
(b) Physical distress or higher workload such that the flight crew
cannot be relied upon to perform their tasks accurately or completely;
or
(c) Serious or fatal injury to a relatively small number of the
occupants.
(4) Catastrophic: Failure conditions that would prevent Continued
Safe Flight and Landing.
f. Redundancy: The presence of more than one independent means for
accomplishing a given function or flight operation. Each means need not
necessarily be identical.
Technical Discussion
LFLS Sec. 1309(b) and (d) require substantiation by analysis and,
where necessary, by appropriate ground, flight, or simulator tests,
that a logical and acceptable inverse relationship exists between the
probability and the severity of each Failure Condition. However, tests
are not required to verify Failure Conditions that are postulated to be
Catastrophic. The goal is to ensure an acceptable overall Airship
safety level, considering all Failure Conditions of all systems.
a. The requirements of LFLS Sec. 1309(b) and (d) are intended to
ensure an orderly and thorough evaluation of the effects on safety of
foreseeable failures or other events, such as errors or external
circumstances, separately or in combination, involving one or more
system functions. The interactions of these factors within a system and
among relevant systems should be considered.
b. The severities of Failure Conditions may be evaluated according
to the following considerations:
(1) Effects on the Airship, such as reductions in safety margins,
degradations in performance, loss of capability to conduct certain
flight operations, or potential or consequential effects on structural
integrity.
(2) Effects on crewmembers, such as increases above their normal
workload that would affect their ability to cope with adverse
operational or environmental conditions.
(3) Effects on the occupants; i.e., passengers and crewmembers.
(4) For convenience in conducting design assessments, Failure
Conditions may be classified according to their severities as Minor,
Major, Hazardous, or Catastrophic. Chapter 1, ``Definitions'' provides
accepted definitions of these terms.
(a) The classification of Failure Conditions does not depend on
whether or not a system or function is the subject of a specific
requirement. Some ``required'' systems, such as transponders, position
lights, and public address systems, may have the potential for only
Minor Failure Conditions. Conversely, other systems that are not
``required,'' such as flight management systems, may have the potential
for Major, Hazardous, or Catastrophic Failure Conditions.
(b) Regardless of the types of assessment used, the classification
of Failure Conditions should always be accomplished with consideration
of all relevant factors; e.g., system, crew, performance, operational,
external, etc. Examples of factors would include the nature of the
failure modes, any effects or limitations on performance, and any
required or likely crew action. It is particularly important to
consider factors that would alleviate or intensify the severity of a
Failure Condition. An example of an alleviating factor would be the
continued performance of identical or operationally similar functions
by other systems not affected by the Failure Condition. Examples of
intensifying factors would include unrelated conditions that would
reduce the ability of the crew to cope with a Failure Condition, such
as weather or other adverse operational or environmental conditions.
The probability that a Failure Condition would occur may be
assessed as Probable, Improbable (Remote or Extremely Remote), or
Extremely Improbable. Each Failure Condition should have a probability
that is inversely related to its severity.
1. Minor Failure Conditions may be Probable.
2. Major Failure Conditions must be no more frequent than
Improbable (Remote).
3. Hazardous Failure Conditions must be no more frequent than
Improbable (Extremely Remote).
4. Catastrophic Failure Conditions must be Extremely Improbable.
c. An assessment to identify and classify Failure Conditions is
necessarily qualitative. On the other hand, an assessment of the
probability of a Failure Condition may be either qualitative or
quantitative. An analysis may range from a simple report that
interprets test results or compares two similar systems to a detailed
analysis that may (or may not) include estimated numerical
probabilities. The depth and scope of an analysis depends on the types
of functions performed by the system, the severities of Failure
Conditions, and whether or not the system is complex. Regardless of its
type, an analysis should show that the system and its installation can
tolerate failures to the extent that Major and Hazardous Failure
Conditions are Improbable and Catastrophic Failure Conditions are
Extremely Improbable:
(1) Experienced engineering and operational judgment should be
applied when determining whether or not a system is complex. Comparison
with similar, previously approved systems is sometimes helpful. All
relevant systems Attributes should be considered; however, the
complexity of the software used to program a digital-computer-
[[Page 16939]]
based system should not be considered because the software is assessed
and controlled by other means, as described in paragraph 2.i.
(2) An analysis should consider the application of the fail-safe
design concept described in paragraph 5 and give special attention to
ensuring the effective use of design techniques that would prevent
single failures or other events from damaging or otherwise adversely
affecting more than one redundant system channel or more than one
system performing operationally-similar functions. When considering
such common-cause failures or other events, consequential or cascading
effects should be taken into account if they would be inevitable or
reasonably likely.
(3) Some examples of such potential common-cause failures or other
events would include rapid release of energy from concentrated sources
such as uncontained failures of rotating parts or pressure vessels,
pressure differentials, non-catastrophic structural failures, loss of
environmental conditioning, disconnection of more than one subsystem or
component by over temperature protection devices, contamination by
fluids, damage from localized fires, loss of power, excessive voltage,
physical or environmental interactions among parts, human or machine
errors, or events external to the system or to the Airship.
d. Compliance for a system or part thereof that is not complex may
sometimes be shown by design and installation appraisals and evidence
of satisfactory service experience on other Airships using the same or
other systems that are similar in their relevant Attributes.
e. In general, a Failure Condition resulting from a single failure
mode of a device cannot be accepted as being Extremely Improbable. In
very unusual cases, however, experienced engineering judgment may
enable an assessment that such a failure mode is not a practical
possibility. When making such an assessment, all possible and relevant
considerations should be taken into account, including all relevant
Attributes of the device. Service experience showing that the failure
mode has not yet occurred may be extensive, but it can never be enough.
Furthermore, flight crew or ground crew checks have no value if a
Catastrophic failure mode would occur suddenly and without any prior
indication or warning. The assessment's logic and rationale should be
so straightforward and readily obvious that, from a realistic and
practical viewpoint, any knowledgeable, experienced person would
unequivocally conclude that the failure mode simply would not occur.
f. LFLS Sec. 1309(c) provides requirements for system monitoring,
failure warning, and capability for appropriate corrective crew action.
Guidance on acceptance means of compliance is provided in paragraph
8.g.
g. In general, the means of compliance described in this Appendix
to CRI F-ASIC's are not directly applicable to software assessments
because it is not feasible to assess the number or kinds of software
errors, if any, that may remain after the completion of system design,
development, and test. RTCA DO-178A and EUROCAE ED-12A, or later
revisions thereto, provide acceptable means for assessing and
controlling the software used to program digital-computer-based
systems. The documents define and use certain terms to classify the
criticalities of functions. These terms have the following
relationships to the terms used in this Appendix to CRI F-ASIC's to
classify Failure Conditions: Failure Conditions adversely affecting
non-essential functions would be Minor, Failure Conditions adversely
affecting essential functions would be Major or Hazardous, and Failure
Conditions adversely affecting critical functions would be
Catastrophic.
h. Functional Hazard Assessment.
Before an applicant proceeds with a detailed safety assessment, it
is useful to prepare a preliminary hazard assessment of the system
functions in order to determine the need for and scope of subsequent
analysis. This assessment may be conducted using service experience,
engineering and operational judgment, or a top-down deductive
qualitative examination of each function performed by the system. A
functional hazard assessment is a systematic, comprehensive examination
of a system's functions to identify potential Major, Hazardous and
Catastrophic Failure Conditions that the system can cause or contribute
to not only if it malfunctions or fails to function but also in its
normal response to unusual or abnormal external factors. It is
concerned with the operational vulnerabilities of the system rather
than with the detailed hardware analysis.
Each system function should also be examined with respect to
functions performed by other Airship systems because the loss of
different but related functions provided by separate systems may affect
the severity of Failure Conditions postulated for a particular system.
In assessing the effects of a Failure Condition, factors that might
alleviate or intensify the direct effects of the initial Failure
Condition should be considered, including consequent or related
conditions existing within the Airship that may affect the ability of
the crew to deal with direct effects, such as the presence of smoke,
acceleration vectors, interruption of communication, interference with
cabin pressurization, etc.
When assessing the consequences of a given Failure Condition,
account should be taken of the warnings given, the complexity of the
crew action, and the relevant crew training. The number of overall
Failure Conditions involving other than instinctive crew actions may
influence the flight crew performance that can be expected. Training
requirements may need to be specified in some cases.
A functional hazard assessment may contain a high level of detail
in some cases, such as for a flight guidance and control system with
many functional modes, but many installations may need only a simple
review of the system design by the applicant. The functional hazard
assessment is a preliminary engineering tool. It should be used to
identify design precautions necessary to ensure independence, to
determine the required software level, and to avoid common mode and
cascade failures.
If further safety analysis is not provided, then the functional
hazard assessment could itself be used as certification documentation.
(1) Analysis of Hazardous and Catastrophic Failure Conditions
(a) A detailed safety analysis will be necessary for each Hazardous
and Catastrophic Failure Condition identified by the functional hazard
assessment. Hazardous Failure Conditions should be Improbable
(Extremely Remote), and Catastrophic Failure Conditions should be
Extremely Improbable. The analysis will usually be a combination of
qualitative and quantitative assessment of the design. Probability
levels that are related to Catastrophic Failure Conditions should not
be assessed only on a numerical basis, unless this basis can be
substantiated beyond reasonable doubt.
(b) For simple and conventional installations, i.e., low complexity
and similarity in relevant Attributes, it may be possible to assess a
Catastrophic Failure Condition as being Extremely Improbable on the
basis of experienced engineering judgment, without using all the formal
procedures listed above. The basis for the assessment will be the
degree of redundancy, the established independence and isolation of the
channels and the reliability record of the technology involved. A
Failure Condition resulting from a single failure
[[Page 16940]]
mode of a device cannot generally be accepted as being Extremely
Improbable, except in very unusual cases.
To satisfy the provisions of LFLS Sec. 1301 and LFLS Sec. 1309
Equipment, Systems and Installations with respect to Electronic
Hardware Design Assurance (ASIC), the design considerations and
analyses described in the above Discussion and Technical Discussion
will be utilized to accomplish the following:
Correct operation will be demonstrated by test or analysis under
all combinations and permutations of conditions of the gates within the
device for electronic hardware whose anomalous behavior would cause or
contribute to a failure of a system resulting in a catastrophic or
hazardous failure condition for the airplane as defined in Advisory
Circular 23.1309-1C.
Correct operation will also be demonstrated by test or analysis
under all combinations and permutations of conditions at the pins of
the device for electronic hardware whose anomalous behavior would cause
or contribute to a failure of a system resulting in a major or minor
failure condition for the airplane as defined in Advisory Circular
23.1309-1C.
If the testing and analysis methods outlined above are impractical
due to the complexity of the device, the electronic hardware should be
developed using a structured development process. The applicant may use
the guidelines in RTCA DO-254, ``Design Assurance Guidance for Airborne
Electronic Hardware'' or another process that is acceptable to the FAA.
If the applicant chooses to use the guidelines in RTCA DO-254, the
hardware development assurance levels should be the same as the
software development assurance levels agreed to by the applicant and
the FAA.
(24) F-4 LBA, Additional Requirements concerning LFLS Sec. 1301,
Sec. 1303, Sec. 1305, Sec. 1309, Sec. 1321, Sec. 1322, Sec. 1330,
Sec. 1431 with respect to Liquid Crystal Displays.
Discussion
ZLT proposed to use Liquid Crystal Displays (LCDs) for presentation
of Airspeed/Altitude/Attitude/Engine/Warning and Caution information to
the pilots. The LBA had no published approval criteria for LCD
technology.
The LCDs to be installed in the LZ-N07 flight deck will display
flight information, including functions critical to safe flight and
landing. There is presently no existing guidance material for Liquid
Crystal Display airworthiness certification in the LFLS. For the LZ-N07
certification, the following Guidance Material for LCD airworthiness
approval was developed. The following Guidance Material provides
acceptable guidance for airworthiness approval of display systems using
LCD technology in the LZ-N07.
Guidance Material
Guidance Material for Electronic Liquid Crystal Display Systems
Airworthiness Approval
Purpose
This Guidance Material provides guidance for certification of
Liquid Crystal Display (LCD) based electronic display systems used for
guidance, control, or decision-making by the pilots of an Airship. Like
all guidance material, this document is not, in itself, mandatory and
does not constitute a regulation. It is issued to provide guidance and
to outline a method of compliance with the rules.
Scope
The material provided in this section consists of guidance related
to pilot displays and specifications for LCDs in the cockpit of an
Airship. The content of the Appendix is limited to statements of
general certification considerations, including color, symbology,
coding, clutter, dimensionality, and attention-getting requirements,
and display visual characteristics.
a. Information Separation
(1) Color Standardization
(a) Although color standardization is desirable, during the initial
certification of electronic displays, color standards for symbology
were not imposed (except for cautions and warnings in LFLS Sec. 1322).
At that time, the expertise did not exist within industry or the LBA,
nor did sufficient service experience exist to rationally establish a
suitable color standard.
(b) In spite of the permissive LCD color atmosphere that existed at
the time of initial LCD display certification programs, an analysis of
the major certifications to date reveals many areas of common color
design philosophy; however, if left unrestricted, in several years
there will be few remaining common areas of color selection. If that is
the case, information transfer problems may begin to occur that have
significant safety implications. To preclude this, the following colors
are being recommended based on current-day common usage. Deviations may
be approved with acceptable justification.
(c) The following depicts acceptable display colors related to
their functional meaning recommended for electronic display systems.
1. Display features should be color-coded as follows:
------------------------------------------------------------------------
------------------------------------------------------------------------
Warnings................................. Red
Flight envelope and system limits........ Red
Cautions, abnormal sources............... Amber/Yellow
Earth.................................... Tan/Brown
Engaged modes............................ Green
Sky...................................... Cyan/Blue
ILS deviation pointer.................... Magenta
Flight director bar...................... Magenta/Green
------------------------------------------------------------------------
2. Specified display features should be allocated colors from one
of the following color sets:
------------------------------------------------------------------------
Color set 1 Color set 2
------------------------------------------------------------------------
Fixed reference symbols........ White............. Yellow*
Current data, values........... White............. Green
Armed modes.................... White............. Cyan
Selected data, values.......... Green............. Cyan
Selected heading............... Magenta**......... Cyan
Active route/flight plan....... Magenta........... White
------------------------------------------------------------------------
*The extensive use of the color yellow for other than caution/abnormal
information is discouraged.
**In color Set 1, magenta is intended to be associated with those
analogue parameters that constitute ``fly to'' or ``keep centered''
type information.
[[Page 16941]]
(d) When deviating from any of the above symbol color assignments,
the manufacturer should ensure that the chosen color set is not
susceptible to confusion or color meaning transference problems due to
dissimilarities with this standard. The Authority test pilot should be
familiar with other systems in use and evaluate the system specifically
for confusion in color meanings.
(e) The LBA does not intend to limit electronic displays to the
above colors, although they have been shown to work well. The colors
available from a symbol generator/display unit combination should be
carefully selected on the basis of their chrominance separation.
Research studies indicate that regions of relatively high color
confusion exist between red and magenta, magenta and purple, cyan and
green, and yellow and orange (amber). Colors should track with
brightness so that chrominance and relative chrominance separation are
maintained as much as possible over day/night operation. Requiring the
flight crew to discriminate between shades of the same color for symbol
meaning in one display is not recommended.
(f) Chrominance uniformity should be in accordance with the
guidance provided in SAE Document ARP 1874. As designs are finalized,
the manufacturer should review his color selections to ensure the
presence of color works to the advantage of separating logical
electronic display functions or separation of types of displayed data.
Color meanings should be consistent throughout all color LCD displays
in the cockpit. In the past, no criteria existed requiring similar
color schemes for left and right side installations using electro-
mechanical instruments.
(2) Color Perception versus Workload
(a) When color displays are used, colors should be selected to
minimize display interpretation workload. Symbol coloring should be
related to the task or crew operation function. Improper color-coding
increases response times for display item recognition and selection,
and it increases the likelihood of errors in situations where response
rate demands exceed response accuracy demands. Color assignments that
differ from other displays in use, either electromechanical or
electronic, or that differ from common usage (such as red, yellow, and
green for stoplights), can potentially lead to confusion and
information transferal problems.
(b) When symbology is configured such that symbol characterization
is not based on color contrast alone but on shape as well, then the
color information is seen to add a desirable degree of redundancy to
the displayed information. There are conditions in which pilots whose
vision is color deficient can obtain waivers for medical qualifications
under National crew license regulations. In addition, normal aging of
the eye can reduce the ability to sharply focus on red objects or
discriminate blue/green. For pilots with such deficiency, display
interpretation workload may be unacceptably increased unless symbology
is coded in more dimensions than color alone. Each symbol that needs
separation because of the criticality of its information content should
be identified by at least two distinctive coding parameters (size,
shape, color, location, etc.).
(c) Color diversity should be limited to as few colors as practical
to ensure adequate color contrast between symbols. Color grouping of
symbols, annunciations, and flags should follow a logical scheme. The
contribution of color to information density should not make the
display interpretation times so long that the pilot perceives a
cluttered display.
(3) Standard Symbology. Many elements of electronic display formats
lend themselves to standardization of symbology, which would shorten
training and transition times when pilots change airplane types.
(4) Symbol Position
(a) The position of a message or symbol within a display conveys
meaning to the pilot. Without the consistent or repeatable location of
a symbol in a specific area of the electronic display, interpretation
errors and response times may increase. The following symbols and
parameters should be position consistent:
(1) All warning/caution/advisory annunciation locations.
(2) All sensor data: altitude, airspeed, glideslope, etc.
(3) All sensor failure flags. (Where appropriate, flags should
appear in the area where the data is normally placed.)
(4) Either the pointer or scale for analogue quantities should be
fixed. (Moving scale indicators that have a fixed present value may
have variable limit markings.)
(b) An evaluation of the positions of the different types of
alerting messages and annunciations available within the electronic
display should be conducted, with particular attention given to
differentiation of normal and abnormal indications. There should be no
tendency to misinterpret or fail to discern a symbol, alert, or
annunciation due to an abnormal indication being displayed in the
position of a normal indication and having similar shape, size or
color.
(c) Pilot and copilot displays may have minor differences in
format, but all such differences should be evaluated specifically to
ensure that no potential for interpretation error exists when pilots
make cross-side display comparisons.
(5) Clutter. A cluttered display is one that uses an excessive
number and/or variety of symbols, colors, or small spatial
relationships. This causes increased processing time for display
interpretation. One of the goals of display format design is to convey
information in a simple fashion in order to reduce display
interpretation time. A related issue is the amount of information
presented to the pilot. As this increases, tasks become more difficult
as secondary information may detract from the interpretation of
information necessary for the primary task. A second goal of display
format design is to determine what information the pilot actually
requires in order to perform the task at hand. This will serve to limit
the amount of information that needs to be presented at any point in
time. Addition of information by pilot selection may be desirable,
particularly in the case of navigational displays, as long as the basic
display modes remain uncluttered after pilot de-selection of secondary
data. Automatic de-selection of data has been allowed in the past to
enhance the pilot's performance in certain emergency conditions.
(6) Interpretation of Two-Dimensional Displays. Modern
electromechanical attitude indicators are three-dimensional devices.
Pointers overlay scales; the fixed airplane symbol overlays the flight
director single cue bars that, in turn, overlay a moving background.
The three-dimensional aspect of a display plays an important role in
interpretation of instruments. Electronic flight instrument system
displays represent an attempt to copy many aspects of conventional
electromechanical displays but in only two dimensions. This can present
a serious problem in quick-glance interpretation, especially for
attitude. For displays using conventional, discrete symbology, the
horizon line, single cue flight director symbol, and fixed airplane
reference should have sufficient conspicuity such that the quick-glance
interpretation should never be misleading for basic attitude. This
conspicuity can be gained by ensuring that the outline of the fixed
airplane symbol(s) always retains its distinctive shape, regardless of
the background or position of the horizon line or pitch ladder. Color
contrast is helpful in defining distinctive display elements but is
insufficient by itself
[[Page 16942]]
because of the reduction of chrominance difference in high ambient
light levels. The characteristics of the flight director symbol should
not detract from the spatial relationship of the fixed airplane
symbol(s) with the horizon. Careful attention should be given to the
symbol priority (priority of displaying one symbol overlaying another
symbol by editing out the secondary symbol) to assure the conspicuity
and ease of interpretation similar to that available in three-
dimensional electromechanical displays.
Note: Horizon lines and pitch scales that overwrite the fixed
airplane symbol or roll pointer have been found unacceptable in the
past.
(7) Attention-Getting Requirements
(a) Some electronic display functions are intended to alert the
pilot to changes: navigation sensor status changes (VOR flag), computed
data status changes (flight director flag or command cue removal), and
flight control system normal mode changes (annunciator changes from
armed to engaged) are a few examples. For the displayed information to
be effective as an attention-getter, some easily noticeable change must
be evident. A legend change by itself is inadequate to annunciate
automatic or uncommanded mode changes. Color changes may seem adequate
in low light levels or during laboratory demonstrations but become much
less effective at high ambient light levels. Motion is an excellent
attention-getting device. Symbol shape changes are also effective, such
as placing a box around freshly changed information. Short-term
flashing symbols (approximately 10 seconds or flash until acknowledge)
are effective attention-getters. A permanent or long-term flashing
symbol that is non-cancelable should not be used.
(b) In some operations, continued operation with inoperative
equipment is allowed (under provisions of an MEL). The display designer
should consider the applicant's MEL desires because in some cases a
continuous strong alert may be too distracting for continued dispatch.
(8) Color Drive Failure. Following a single color drive failure,
the remaining symbology should not present misleading information,
although the display does not have to be usable. If the failure is
obvious, it may be assumed that the pilot will not be susceptible to
misleading information due to partial loss of symbology. To make this
assumption valid, special cautions may have to be included in the AFM
procedures that point out to the pilot that important information
formed from a single primary color may be lost, such as red flags.
(9) For Both Active Matrix and Segmented Liquid Crystal Displays
Viewing Envelope: The installed display must meet all the following
requirements when viewed from a rectangle centered on the design eye
position and sized 1-foot vertical dimension and 2-feet horizontal
dimension.
General: The display symbology must be clearly readable throughout
the viewing envelope under all ambient illumination levels ranging from
1.1 lux (0.10 fc) to sun shaft illumination of 86,400 lux (8000 fc) at
45 degrees incidence to the face of the display.
Symbol Alignment: Symbols that are interpreted relative to each
other must be aligned to preclude erroneous interpretation.
Flicker: Flicker must not be readily discernible or distracting
under day, twilight, or night conditions, considering both foveal and
full peripheral vision, and using a format most susceptible to
producing flicker.
Multiple Images: Multiple display images produced by light not
normal to the display surface must neither be distracting nor cause
erroneous interpretation.
Luminance: The display luminance must be sufficient to provide a
comfortable level of viewing under all conditions and provide rapid eye
adaptation when transitioning from looking outside the flight deck.
Minimum Luminance: Under night lighting, with the display
brightness set at the lowest usable level for flight with normal
symbology, all flags and annunciators must be adequately visible.
Lighting: In order to aid daylight viewing, the displays'
backlighting must be designed such that adequate daylight backlighting
is provided when the cockpit discrete lighting control is set to the
`bright' position. In ``non-bright'' positions, the displays must be
modulated in a balanced fashion in conjunction with other cockpit
lighting.
(10) For Active Matrix Displays
Matrix Anomalies: For both static and dynamic formats, the display
must have no matrix anomalies that cause distraction or erroneous
interpretation.
Line Width Uniformity: Lines of specified color and luminance must
remain uniform in width at all orientations. Unintended line width
variation must not be readily apparent or distracting in any case.
Symbol Quality: Symbols must not have distracting gaps or geometric
distortions that cause erroneous interpretations.
Symbol Motion: Display symbology that is in motion must not have
distracting or objectionable jitters, jerkiness, or ratcheting effects.
Image Retention: Image retention must not be readily discernible
day or night and must not be distracting or cause an erroneous
interpretation or smearing effect for motion dynamic symbology.
Defects: Visible defects on the display surface (such as ``on''
elements, ``off'' elements, spots, discolored areas, etc.) must not be
distracting or cause an erroneous interpretation. Service limits for
defects must be established.
Luminance Uniformity: Display areas of a specified color and
luminance must have a luminance uniformity of less than 50 percent
across the utilized display surface. The rate of change of luminance
within any small area shall be minimized to eliminate distracting
visual effects. These requirements apply for any eye position within
the display viewing envelope.
Contrast Ratios: The average contrast ratio over the usable display
surface must be a minimum of 201 at the design eye position and 101 for
any eye position within the display viewing envelope when measured
under a dark ambient illumination. This requirement is based on a 0.5
mm (0.0201) line width. Smaller line widths must have a comparable
readability, which may require a higher contrast ratio.
(11) For Segmented Displays
Activated Segments: Activated segments must have a contrast ratio
with the immediately adjacent inactivated background of 21 for viewing
angles of on-axis to 50 degrees off-axis.
Inactivated Segments: When segments are not electrically activated,
there must be no obtrusive difference between the normal background
luminance, color, or texture and the inactivated segments of the area
surrounding them. The contrast ratio between inactivated segments and
the background must not be greater than 1.151 in a light ambient when
viewed from an angle normal to the display up to an angle 50 degrees
off-axis.
For the purpose of this Issue Paper, the following definition
applies:
Luminance Uniformity = (Lmax - Lmin /
Lave (expressed in percent)
Where
Lmax = Maximum luminance measured anywhere on the
utilized display surface
Lmin = Minimum luminance measured anywhere on the
utilized display surface
Lave = Average luminance of the utilized display surface
To satisfy the provisions of LFLS Sec. 1301, Sec. 1303, Sec.
1305, Sec. 1309, Sec. 1321,
[[Page 16943]]
Sec. 1322, Sec. 1330, Sec. 1431 with respect to Liquid Crystal
Displays, the design considerations and analyses described in the above
Guidance Material will be utilized:
(a) Equipment comprising LCDs that is not specifically developed
for use in the LZ-N07, and which is already certified under TSO, JTSO,
FAA-STC, or LBA Kennblatt, will be excluded and not certified according
to these guidelines.
(b) Equipment comprising LCDs that is specifically developed for
the use in LZ-N07, and modifications to equipment comprising LCDs
specific for the LZ-N07, and that is not, or not yet, certified under
TSO, JTSO, FAA-STC, or LBA Kennblatt, will be certified according to
these guidelines.
(25) F-5 LBA, Additional Requirements; LFLS Sec. 1301, Function
and Installation, and LFLS Sec. 1309, Equipment, Systems and
Installations, Use of Commercial Off-The-Shelf (COTS) Software in
Airship Avionics Systems.
General Discussion
The LZ N07 will be certificated with digital microprocessor based
systems installed that may contain commercial off-the-shelf (COTS)
software. This Guidance Material identifies acceptable means of
certifying airborne systems and equipment containing COTS software on
the airship.
Background
Many COTS software applications and components have been developed
for use outside the field of commercial air transportation. Much of the
COTS software has been developed for systems for which safety is not a
concern or for systems with safety criteria different from that of
commercial airships. Consequently, for COTS software, adequate
artifacts may not be available to assess the adequacy of the software
integrity. Available evidence may be insufficient to show that adequate
software life cycle processes were used. RTCA DO 178B/ED-12B recognizes
the above and addresses means by which COTS may be shown to comply with
airship certification requirements.
Technical Discussion
Document RTCA DO 178B/ED-12B provides a means for obtaining the
approval of airborne COTS software. For those systems that make use of
COTS software, the objectives of RTCA DO 178B/ED-12B should be
satisfied. If deficiencies exist in the life cycle data of COTS
software, DO 178B/ED-12B addresses means to augment that data to
satisfy the objectives. If Zeppelin chooses to utilize a means other
than DO 178B/ED-12B, the LBA requests Zeppelin to propose, via the Plan
for Software Aspects of Certification (PSAC), how it intends to show
that all COTS software complies with Airship Requirements LFLS
Sec. Sec. 1301, 1309. Zeppelin should obtain agreement on the means of
compliance from the LBA prior to implementation.
Abbreviations Used in this Guidance
Table 7
------------------------------------------------------------------------
Abbreviation Explanation
------------------------------------------------------------------------
COTS...................................... Commercial Off-the-Shelf
Software
CRI....................................... Certification Review Item
EUROCAE................................... European Organization for
Civil Aviation Electronics
LBA....................................... Luftfahrt Bundesamt
LFLS...................................... Airworthiness Requirements
for Airships
PSAC...................................... Plan for Software Aspects of
Certification
RTCA...................................... Radio Technical Commission
for Aeronautics
------------------------------------------------------------------------
To satisfy the provisions of LFLS Sec. 1301, Function and
Installation, and LFLS Sec. 1309, Equipment, Systems and
Installations, Use of Commercial Off-the-Shelf (COTS) Software in
Airship Avionics Systems the design considerations and analyses
described in the above Guidance Material will be utilized:
Equipment comprising COTS that is not specifically developed for
use in the LZ-N07, and which is already certified under TSO, JTSO, FAA-
STC, or LBA Kennblatt, will be excluded and not certified according to
this Guidance Material.
Equipment comprising COTS that is specifically developed for use in
the LZ-N07, and modifications to equipment comprising COTS specific for
LZ-N07, and that is not, or not yet, certified under TSO, JTSO, FAA-
STC, or LBA Kennblatt, will be certified according to this Guidance
Material.
(26) F-6 LBA, Sec. Sec. 1301, 1322, 1528, 1585; LFLS (Equivalent
Safety Finding) Envelope Pressure Indicator--Color Coding.
Discussion
To indicate the envelope pressure of the LZ-N07, ZLT will propose
an instrument (Envelope Pressure Indicator, EPI) that will provide
annunciation of the Helium and Ballonet Pressure as well as indications
of the aft and forward Fan and Sensor Fail status using LED columns.
The measurement range covers a red, amber, and green band by a colored
scale adjacent to the LED columns. The LED columns are continuously of
an amber color, due to the technical solution possible only. In
addition, any out-of-limit pressure determination will trigger a
discrete warning output to the Integrated Instrument Display System
(IIDS) for crew alerting and generation of an appropriate warning
message.
Using the pressure indications, the flight crew is able to monitor
and control the airship throughout the flight. Furthermore, the ground
crew will utilize the EPI to maintain constant pressures in the hull.
Messages on displays should be unambiguous and easily readable and
should be designed to avoid confusion to the crew. The use of an amber
colored LED column, indicating possible red, amber, and green status of
the associated systems, is not in line with the general color
philosophy of the LZ N07 cockpit and the applicable LFLS requirements,
and it was considered by the LBA as an unusual design feature.
While the LBA allowed the use of amber based on an equivalent
safety finding, we believe that the provisions of LFLS Sec. 1322,
where an amber indication is reserved to indicate where immediate crew
awareness is required and subsequent crew action will be required,
should be adhered to.
The control and indicating systems will, therefore, comply with the
provisions of LFLS Sec. 1322.
(27) F-7 LBA, Equivalent Safety Finding Sec. 1387(b) LFLS, Bow
Light Dihedral Angle.
Discussion
LFLS Sec. 1387(b) requires a dihedral angle formed by two
intersecting vertical planes making angles of 110 degrees to the right
and to the left. LFLS appendix table 10 requires, in addition, a
minimum light intensity of 20 cd throughout the dihedral angle. The LZ-
N07 system only attains the required intensity over 100 degrees but is
still visible from 100 degrees to 110 degrees (left and right) at a
reduced intensity. The LBNA granted an equivalency to LFLS Sec.
1387(b) based on the greater dihedral angle coverage of the aft light,
+/-80 degrees rather than +/-70 degrees at the specified intensity.
This is acceptable to the FAA.
To satisfy the provisions of LFLS Sec. 1387(b), the following is
required:
The LFLS Sec. 1387(b) required dihedral angle will be no less than
100 degrees at the intensities specified in Table 10 of the appendix of
the LFLS. In addition, the rear light will have an included angle of +/
-80 degrees at the specified intensity from Table 10 of the appendix of
the LFLS. Refer to Figure 3.
[[Page 16944]]
[GRAPHIC] [TIFF OMITTED] TN31MR08.001
(28) Ballast Water.
Discussion
To minimize the possibility of environmental contamination from
ballast water, there will be provisions in the airship or servicing
provisions that ensure that biological or chemical contamination does
not occur due to the servicing of ballast water of one location and
dumping of water in a different location. This provision will be added
to the certification basis as a special environmental requirement:
Under no circumstances may water ballast be loaded or released
that does not comply with the provisions of 40 CFR part 141,
National Primary Drinking Water Regulations. Obtaining water from a
water supply use for human consumption is acceptable; water aerially
released or otherwise dumped cannot degrade beyond the limits set by
40 CFR part 141. If ballast water is contaminated, it can only be
released into appropriate sewage facilities in accordance with
national and local laws and regulations. These provisions will be
explained in the Airship Flight Manual and ground operations
materials and manuals. Procedures will also be developed that will
eliminate the possibility of biological contamination growing in the
ballast system and then being jettisoned or dumped, unless detected
and treated.
The ballast system will have a method of securing filler locations
to eliminate the possibility of tampering with the system.
Issued in Kansas City, Missouri, on March 21, 2008.
David R. Showers
Acting Manager, Small Airplane Directorate, Aircraft Certification
Service.
[FR Doc. E8-6600 Filed 3-28-08; 8:45 am]
BILLING CODE 4910-13-P