82 FR 13962 - Special Conditions: Robinson Helicopter Company Model R22 BETA Helicopter; Installation of Helitrak Autopilot System

DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration

Federal Register Volume 82, Issue 50 (March 16, 2017)

Page Range		13962-13965
FR Document		2017-05268
These special conditions are issued for the Robinson Helicopter Company (Robinson) Model R22 BETA helicopter. This helicopter as modified by Helitrak, Incorporated (Helitrak) will have a novel or unusual design feature associated with an autopilot (AP) system. The applicable airworthiness regulations do not contain adequate or appropriate safety standards for this design feature. These special conditions contain the additional safety standards the Administrator considers necessary to establish a level of safety equivalent to that ensured by the existing airworthiness standards.
Federal Register, Volume 82 Issue 50 (Thursday, March 16, 2017)
[Federal Register Volume 82, Number 50 (Thursday, March 16, 2017)]
[Rules and Regulations]
[Pages 13962-13965]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2017-05268]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 27

[Docket No. FAA-2017-0167; Special Conditions No. 27-032-SC]


Special Conditions: Robinson Helicopter Company Model R22 BETA 
Helicopter; Installation of Helitrak Autopilot System

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final special conditions; request for comments.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for the Robinson 
Helicopter Company (Robinson) Model R22 BETA helicopter. This 
helicopter as modified

[[Page 13963]]

by Helitrak, Incorporated (Helitrak) will have a novel or unusual 
design feature associated with an autopilot (AP) system. The applicable 
airworthiness regulations do not contain adequate or appropriate safety 
standards for this design feature. These special conditions contain the 
additional safety standards the Administrator considers necessary to 
establish a level of safety equivalent to that ensured by the existing 
airworthiness standards.

DATES: The effective date of these special conditions is March 16, 
2017. We must receive your comments by May 15, 2017.

ADDRESSES: Send comments identified by docket number [FAA-2017-0167] 
using any of the following methods:
     Federal eRegulations Portal: Go to http://www.regulations.gov and follow the online instructions for sending your 
comments electronically.
     Mail: Send comments to Docket Operations, M-30, U.S. 
Department of Transportation (DOT), 1200 New Jersey Avenue SE., Room 
W12-140, West Building Ground Floor, Washington, DC 20590-0001.
     Hand Delivery of Courier: Deliver comments to the Docket 
Operations, in Room W12-140 of the West Building Ground Floor at 1200 
New Jersey Avenue SE., Washington, DC, between 9 a.m., and 5 p.m., 
Monday through Friday, except federal holidays.
     Fax: Fax comments to Docket Operations at 202-493-2251.
    Privacy: The FAA will post all comments it receives, without 
change, to http://regulations.gov, including any personal information 
the commenter provides. Using the search function of the docket Web 
site, anyone can find and read the electronic form of all comments 
received into any FAA docket, including the name of the individual 
sending the comment (or signing the comment for an association, 
business, labor union, etc.). DOT's complete Privacy Act Statement can 
be found in the Federal Register published on April 11, 2000 (65 FR 
19477-19478), as well as at http://DocketsInfo.dot.gov.
    Docket: You can read the background documents or comments received 
at http://www.regulations.gov. Follow the online instructions for 
accessing the docket or go to the Docket Operations in Room W12-140 of 
the West Building Ground Floor at 1200 New Jersey Avenue SE., 
Washington, DC, between 9 a.m., and 5 p.m., Monday through Friday, 
except Federal holidays.

FOR FURTHER INFORMATION CONTACT: Mark Wiley, Aviation Safety Engineer, 
FAA, Rotorcraft Directorate, Regulations and Policy Group (ASW-111), 
10101 Hillwood Parkway, Fort Worth, TX 76177; telephone (817) 222-5134; 
or email to [email protected].

SUPPLEMENTARY INFORMATION:

Reason for No Prior Notice and Comment Before Adoption

    The FAA considers prior notice to be unnecessary as we have 
provided previous opportunities to comment on substantially identical 
proposed special conditions, and we are satisfied that new comments are 
unlikely. Therefore, the FAA has determined that prior public notice 
and comment are unnecessary and finds that good cause exists for 
adopting these special conditions effective upon issuance. The FAA is 
requesting comments to allow interested persons to submit views that 
may not have been submitted in response to the prior opportunities for 
comment.

Comments Invited

    While we did not precede this with a notice of proposed special 
conditions, we invite interested people to take part in this action by 
sending written comments, data, or views. The most helpful comments 
reference a specific portion of the special conditions, explain the 
reason for any recommended change, and include supporting data.
    We will consider all comments we receive by the closing date for 
comments. We will consider comments filed late if it is possible to do 
so without incurring expense or delay. We may change these special 
conditions based on the comments we receive.

Background

    On January 27, 2012, Helitrak applied for a supplemental type 
certificate (STC) to install an AP system on the Robinson Model R22 
BETA helicopter. The Robinson Model R22 BETA helicopter, currently 
approved under Type Certificate No. H10WE, is a 14 CFR part 27 normal 
category, single reciprocating engine, conventional helicopter designed 
for civil operation. This helicopter model is capable of carrying one 
passenger with one pilot, and has a maximum gross weight of up to 1,370 
pounds. The major design features include a two-blade teetering main 
rotor, an anti-torque tail rotor system, a skid landing gear, and a 
visual flight rule basic avionics configuration. Helitrak proposes to 
modify this model helicopter by installing a two-axis Helitrak AP.
    The present Sec.  27.1309(c) regulation does not adequately address 
the safety requirements for systems whose failures could result in 
``catastrophic'' or ``hazardous/severe-major'' failure conditions, or 
for complex systems whose failures could result in ``major'' failure 
conditions. When Sec.  27.1309(c) was promulgated, it was not 
envisioned that a normal category rotorcraft would use systems that are 
complex or whose failure could result in ``catastrophic'' or 
``hazardous/severe-major'' effects on the rotorcraft. The Helitrak AP 
controls rotorcraft flight control surfaces. Possible failure modes 
exhibited by this system could result in a catastrophic event.

Type Certification Basis

    Under 14 CFR 21.101 and 21.115, Helitrak must show that the 
Robinson Model R22 BETA helicopter, as modified by the installed 
Helitrak AP, continues to meet the applicable provisions of the 
regulations incorporated by reference in Type Certificate No. H10WE or 
the applicable regulations in effect on the date of application for the 
change. Additionally, Helitrak must comply with the following 
equivalent level of safety findings, exemptions, and special conditions 
prescribed by the Administrator as part of the certification basis:

14 CFR part 27 dated February 1, 1965, including Amendments 27-1 
through 27-10
National Environmental Act of 1969
Noise Control Act of 1972
Equivalent Safety Finding: Number TD10352LA-R/S-1
14 CFR part 27.1401(d), Anticollision Light System

    In addition, Helitrak must show the Helitrak AP STC-altered 
Robinson Model R22 BETA helicopter complies with the noise 
certification requirements of 14 CFR part 36.

Regulatory Basis for Special Conditions

    If the Administrator finds the applicable airworthiness regulations 
(that is, 14 CFR part 27) do not contain adequate or appropriate safety 
standards for the Robinson Model R22 BETA helicopter because of a novel 
or unusual design feature, special conditions are prescribed under 
Sec.  21.16.
    The FAA issues special conditions, as defined in Sec.  11.19, in 
accordance with Sec.  11.38 and they become part of the type 
certification basis under Sec.  21.101.
    Special conditions are initially applicable to the model for which 
they are issued. Should Helitrak apply for an STC to modify any other 
model included on the H10WE type certificate to incorporate the same 
novel or unusual design feature, the special conditions would also 
apply to the other model.

[[Page 13964]]

Novel or Unusual Design Features

    The Robinson Model R22 BETA will incorporate the following novel or 
unusual design features: A Helitrak AP. This AP system performs non-
required flight control functions. The Helitrak AP is a two-axis system 
with two operational flight control modes: Heading and airspeed hold or 
heading and altitude hold. Other flight control functions include 
unusual attitude recovery, collective pulldown, and an autorotation 
function.

Discussion

    The effect on safety is not adequately covered under Sec.  27.1309 
for the application of new technology and new application of standard 
technology. Specifically, the provisions of Sec.  27.1309(c) do not 
adequately address the safety requirements for systems whose failures 
could result in catastrophic or hazardous/severe-major failure 
conditions and for complex systems whose failures could result in major 
failure conditions.
    To comply with these special conditions, we require that Helitrak 
provide the FAA with a systems safety assessment (SSA) for the final 
Helitrak AP installation configuration that will adequately address the 
safety objectives established by a functional hazard assessment (FHA) 
and a preliminary system safety assessment (PSSA), including the fault 
tree analysis (FTA). This will ensure that all failure conditions and 
their resulting effects are adequately addressed for the installed 
Helitrak AP. The SSA process, FHA, PSSA, and FTA are all parts of the 
overall safety assessment process discussed in FAA Advisory Circular 
27-1B, Certification of Normal Category Rotorcraft, and Society of 
Automotive Engineers document Aerospace Recommended Practice 4761, 
Guidelines and Methods for Conducting the Safety Assessment Process on 
Civil Airborne Systems and Equipment.
    These special conditions require that the Helitrak AP installed on 
a Robinson Model R22 BETA helicopter meets the requirements to 
adequately address the failure effects identified by the FHA, and 
subsequently verified by the SSA, within the defined design integrity 
requirements.

Applicability

    These special conditions are applicable to the Robinson Model R22 
BETA helicopter. Should Helitrak apply at a later date for an STC to 
modify any other model included on Type Certificate No. H10WE to 
incorporate the same novel or unusual design feature, the special 
conditions would apply to that model as well.

Conclusion

    This action affects only certain novel or unusual design features 
on one model helicopter. It is not a rule of general applicability and 
affects only the applicant who applied to the FAA for approval of these 
features on the helicopter.
    Under standard practice, the effective date of final special 
conditions would be 30 days after the date of publication in the 
Federal Register; however, the substance of these special conditions 
has been subjected to the notice and comment period previously and has 
been derived without substantive change from those previously issued. 
As it is unlikely that prior public comment would result in a 
significant change from the substance contained herein, the FAA 
considers prior notice to be unnecessary and finds that good cause 
exists to make these special conditions effective upon issuance.

List of Subjects in 14 CFR Part 27

    Aircraft, Aviation safety.

    The authority citation for these special conditions is as follows:

    Authority: 42 U.S.C. 7572; 49 U.S.C. 106(g), 40113, 44701-44702, 
44704.

The Special Conditions

    Accordingly, pursuant to the authority delegated to me by the 
Administrator, the following special conditions are issued as part of 
the type certification basis for Robinson Helicopter Company (Robinson) 
Model R22 BETA helicopters as modified by Helitrak, Incorporated.
    In addition to the requirement of Sec.  27.1309(c), the Helitrak 
autopilot (AP) system installation on Robinson Model R22 BETA 
helicopters must be designed and installed so that the failure 
conditions identified in the functional hazard assessment (FHA) and 
verified by the system safety assessment (SSA) are adequately addressed 
in accordance with the following requirements.
    Helitrak, Incorporated must provide the FAA with a SSA for the 
final Helitrak AP installation configuration that will adequately 
address the safety objectives established by the FHA and the 
preliminary system safety assessment (PSSA), including the fault tree 
analysis (FTA). This will show that all failure conditions and their 
resulting effects are adequately addressed for the installed Helitrak 
AP.
    Note 1: The SSA process, FHA, PSSA, and FTA are all parts of the 
overall safety assessment (SA) process discussed in FAA Advisory 
Circular (AC) 27-1B (Certification of Normal Category Rotorcraft) and 
Society of Automotive Engineers (SAE) document Aerospace Recommended 
Practice (ARP) 4761 (Guidelines and Methods for Conducting the Safety 
Assessment Process on civil airborne Systems and Equipment).
    Failure Condition Categories. Failure conditions are classified, 
according to the severity of their effects on the rotorcraft, into one 
of the following categories:
    1. No Effect. Failure conditions have no effect on safety. These 
failure conditions would not affect the operational capability of the 
rotorcraft or increase crew workload; however, could result in an 
inconvenience to the occupants, excluding the flight crew.
    2. Minor. Failure conditions do not significantly reduce rotorcraft 
safety, and involve crew actions that are well within their 
capabilities. Minor failure conditions would include, for example, a 
slight reduction in safety margins or functional capabilities, a slight 
increase in crew workload, such as, routine flight plan changes, or 
result in some physical discomfort to occupants.
    3. Major. Failure conditions reduce the capability of the 
rotorcraft or the ability of the crew to cope with adverse operating 
conditions to the extent that there would be, for example, a 
significant reduction in safety margins or functional capabilities, a 
significant increase in crew workload or result in impairing crew 
efficiency, physical distress to occupants, including injuries, or 
physical discomfort to the flight crew. The potential for a failure to 
result in a condition characterized as major should be remote with a 
probability of occurrence between 1 x 10^-\3\ to 1 x 
10^-\5\ failures/flight hour.
    4. Hazardous/Severe-Major.
    a. Failure conditions reduce the capability of the rotorcraft or 
the ability of the crew to cope with adverse operating conditions to 
the extent that there would be:
    (1) A large reduction in safety margins or functional capabilities;
    (2) physical distress or excessive workload that would impair the 
flight crew's ability to the extent that they could not be relied on to 
perform their tasks accurately or completely; or
    (3) possible serious or fatal injury to a passenger or a cabin 
crewmember, excluding the flight crew. The potential that a failure 
results in a condition characterized as hazardous/severe-major should 
be extremely remote with a probability of occurrence between 1 x 
10^-\5\ to 1 x 10^-\7\ failures/flight hour.

[[Page 13965]]

    b. ``Hazardous/severe-major'' failure conditions can include events 
that are manageable by the crew by the use of proper procedures, which, 
if not implemented correctly or in a timely manner, may result in a 
catastrophic event.
    5. Catastrophic. Failure conditions result in multiple fatalities 
to occupants, fatalities or incapacitation to the flight crew, or 
result in loss of the rotorcraft. The potential that a failure results 
in a condition characterized as catastrophic should be extremely 
improbable with probability of occurrence 1 x 10^-\9\ 
failures/flight hour or less.

Requirements

    Helitrak must comply with the existing requirements of Sec.  
27.1309 for all applicable design and operational aspects of the 
Helitrak AP with the failure condition categories of ``no effect'' and 
``minor,'' and for non-complex systems whose failure condition category 
is classified as ``major.'' Helitrak must comply with the requirements 
of these special conditions for all applicable design and operational 
aspects of the Helitrak AP with the failure condition categories of 
``catastrophic'' and ``hazardous severe/major,'' and for complex 
systems whose failure condition category is classified as ``major.'' A 
complex system is a system whose operations, failure conditions, or 
failure effects are difficult to comprehend without the aid of 
analytical methods (for example, FTA, Failure Modes and Effect 
Analysis, FHA).

System Design Integrity Requirements

    Each of the failure condition categories defined in these special 
conditions relate to the corresponding aircraft system integrity 
requirements. The system design integrity requirements for the Helitrak 
AP, as they relate to the allowed probability of occurrence for each 
failure condition category and the proposed software design assurance 
level, are as follows:
    Systems with failures that may result in a ``major'' effect must be 
shown to be remote and develop software to the Radio Technical 
Commission for Aeronautics (RTCA) Document DO-178B, Software 
Considerations in Airborne Systems and Equipment Certification, Level C 
software design assurance level and must develop complex hardware to 
the Radio Technical Commission for Aeronautics (RTCA) Document DO-254, 
Design Assurance Guidance for Airborne Electronic Hardware, Level C 
hardware design assurance level.
    Systems with failures that may result in ``hazardous/severe-major'' 
effects must be shown to be extremely remote must develop software to 
the RTCA Document DO-178B, Software Considerations in Airborne Systems 
and Equipment Certification, Level B software design assurance level 
and must develop complex hardware to the Radio Technical Commission for 
Aeronautics (RTCA) Document DO-254, Design Assurance Guidance for 
Airborne Electronic Hardware, Level B hardware design assurance level.
    Systems with failures that may result in ``catastrophic'' effects 
must be shown to be extremely improbable, and develop software to the 
RTCA Document DO-178B, Software Considerations in Airborne Systems and 
Equipment Certification, Level A design assurance level and must 
develop complex hardware to the Radio Technical Commission for 
Aeronautics (RTCA) Document DO-254, Design Assurance Guidance for 
Airborne Electronic Hardware, Level A hardware design assurance level.

System Design Environmental Requirements

    The AP system equipment must be qualified to the appropriate 
environmental level per RTCA Document DO-160F, Environmental Conditions 
and Test Procedures for Airborne Equipment, for all relevant aspects. 
This is to show that the AP system performs its intended function under 
any foreseeable operating condition, including the expected environment 
in which the AP is intended to operate. Some of the main considerations 
for environmental concerns are installation locations and the resulting 
exposure to environmental conditions for the AP system equipment, 
including considerations for other equipment that may be affected 
environmentally by the AP equipment installation. The level of 
environmental qualification must be related to the severity of the 
considered failure conditions and effects on the rotorcraft.

Test & Analysis Requirements

    Compliance with the requirements of these special conditions may be 
shown by a variety of methods, which typically consist of analysis, 
flight tests, ground tests, and simulation, at a minimum. Compliance 
methodology is related to the associated failure condition category. If 
the AP is a complex system, compliance with the requirements for 
failure conditions classified as ``major'' may be shown by analysis, in 
combination with appropriate testing, to validate the analysis. 
Compliance with the requirements for failure conditions classified as 
``hazardous/severe-major'' may be shown by flight-testing in 
combination with analysis and simulation, and the appropriate testing 
to validate the analysis. Flight tests may be limited for ``hazardous/
severe-major'' failure conditions and effects due to safety 
considerations. Compliance with the requirements for failure conditions 
classified as ``catastrophic'' may be shown by analysis and appropriate 
testing in combination with simulation to validate the analysis. Very 
limited flight tests in combination with simulation are used as a part 
of a showing of compliance for ``catastrophic'' failure conditions. 
Flight tests are performed only in circumstances that use operational 
variations, or extrapolations from other flight performance aspects to 
address flight safety.
    These special conditions require that the Helitrak AP system 
installed on a Robinson Model R22 BETA helicopter, Type Certificate No. 
H10WE, meet these requirements to adequately address the failure 
effects identified by the FHA, and subsequently verified by the SSA, 
within the defined design system integrity requirements.

    Issued in Fort Worth, Texas, on March 10, 2017.
Lance Gant,
Manager Rotorcraft Standard Staff, Aircraft Certification Service.
[FR Doc. 2017-05268 Filed 3-15-17; 8:45 am]
BILLING CODE 4910-13-P
13962 Federal Register / Vol. 82, No. 50 / Thursday, March 16, 2017 / Rules and Regulations

model already included on the same limiting aircraft speed to VDF/MDF certification basis for the Embraer S.A.
type certificate be modified to (demonstrated flight diving speed). Model ERJ 190–300 series airplanes.
incorporate the same novel or unusual The controllability and
Flight Envelope Protection: Pitch, Roll,
design feature, these special conditions maneuverability requirements of 14 CFR
and High-Speed Limiting Functions
would also apply to the other model 25.143 do not specifically relate to flight
under § 21.101. characteristics associated with fixed In addition to § 25.143, the following
In addition to the applicable attitude limits or a high-speed limiter requirements apply:
airworthiness regulations and special that might preclude or modify flying 1. Pitch and Roll Limiting Functions.
conditions, the ERJ 190–300 must qualities assessment in the overspeed a. The pitch limiting function must
comply with the fuel vent and exhaust region. not impede normal maneuvering for
emission requirements of 14 CFR part These special conditions contain the pitch angles up to the maximum
34 and the noise-certification additional safety standards that the required for normal maneuvering,
requirements of 14 CFR part 36. Administrator considers necessary to including a normal all-engines operating
The FAA issues special conditions, as establish a level of safety equivalent to takeoff, plus a suitable margin to allow
defined in 14 CFR 11.19, in accordance that established by the existing for satisfactory speed control.
with § 11.38, and they become part of airworthiness standards. b. The pitch and roll limiting
the type certification basis under functions must not restrict or prevent
§ 21.101. Applicability attaining pitch attitudes necessary for
As discussed above, these special emergency maneuvering or roll angles
Novel or Unusual Design Features up to 66° with flaps up or 60° with flaps
conditions are applicable to the ERJ
The ERJ 190–300 will incorporate the 190–300 series airplanes. Should down. Spiral stability, which is
following novel or unusual design Embraer S.A. apply at a later date for a introduced above 33° roll angle, must
feature: An electronic flight control change to the type certificate to include not require excessive pilot strength to
system that contains fly-by-wire control another model incorporating the same achieve these roll angles. Other
laws, including flight envelope novel or unusual design feature, these protections, which further limit the roll
protection functions that impose pitch- special conditions would apply to that capability under certain extreme angle
angle, bank-angle, and high-speed limits model as well. of attack or attitude or high speed
during normal operation. conditions, are acceptable, as long as
Conclusion they allow at least 45° of roll capability.
Discussion c. A lower limit of roll is acceptable,
This action affects only a certain
The Embraer S.A. ERJ 190–300 design novel or unusual design feature on one beyond the overspeed warning, if it is
has a full-digital flight control system, model of airplane. It is not a rule of possible to recover the aircraft to the
referred to as fly-by-wire architecture. general applicability. normal flight envelope without undue
The fly-by-wire architecture provides The substance of these special difficulty or delay.
closed-loop flight control laws and 2. High-Speed Limiting Functions.
conditions has been subjected to the
multiple protection functions. Operation of the high-speed limiter
notice and comment period in several
The basic characteristics of pitch, during all routine and descent
prior instances and has been derived
bank, and high-speed limiting functions procedure flight must not impede
without substantive change from those
are as follows: normal attainment of speeds up to
previously issued. It is unlikely that
1. Pitch Limiting Function: overspeed warning.
prior public comment would result in a
While in normal mode, the ERJ 190–
significant change from the substance Michael Kaszycki,
300 airplane presents positive and
contained herein. Therefore, because a Assistant Manager, Transport Airplane
negative pitch attitude soft limits. After
delay would affect the certification of Directorate, Aircraft Certification Service.
surpassing the established limits set at
the airplane, the FAA has determined [FR Doc. 2017–05200 Filed 3–15–17; 8:45 am]
30° and ¥15°, the airplane presents a
that prior public notice and comment BILLING CODE 4910–13–P
natural tendency to return (positive
are unnecessary and impracticable, and
stability) to within these limits when
good cause exists for adopting these
pitch control is released.
2. Bank Limiting Function (Spiral special conditions upon publication in DEPARTMENT OF TRANSPORTATION
Stability and Roll Limiting): the Federal Register. The FAA is
requesting comments to allow interested Federal Aviation Administration
While in normal mode at speeds up
to VMO/MMO (maximum operating limit persons to submit views that may not
have been submitted in response to the 14 CFR Part 27
speed), the ERJ 190–300 airplane
presents neutral stability up to 33° bank prior opportunities for comment [Docket No. FAA–2017–0167; Special
angle. Above 33°, positive spiral described above. Conditions No. 27–032–SC]
stability is introduced; however, there is List of Subjects in 14 CFR Part 25
no bank angle hard limit. When Special Conditions: Robinson
overspeed protection is engaged, Aircraft, Aviation safety, Reporting Helicopter Company Model R22 BETA
positive spiral stability is provided in and recordkeeping requirements. Helicopter; Installation of Helitrak
the range of ±33° and a bank angle hard The authority citation for these Autopilot System
limit (non-overridable) is set at that special conditions is as follows: AGENCY: Federal Aviation
bank angle. Authority: 49 U.S.C. 106(g), 40113, 44701, Administration (FAA), DOT.
jstallworth on DSK7TPTVN1PROD with RULES

3. High-Speed Limiting Function 44702, 44704. ACTION: Final special conditions; request
(Overspeed Protection): for comments.
While in normal mode, the overspeed The Special Conditions
protection function prevents pilots from Accordingly, pursuant to the SUMMARY: These special conditions are
exceeding the airplane maximum design authority delegated to me by the issued for the Robinson Helicopter
speeds by providing strong positive Administrator, the following special Company (Robinson) Model R22 BETA
stability at and above VMO/MMO, and conditions are issued as part of the type helicopter. This helicopter as modified

VerDate Sep<11>2014 14:18 Mar 15, 2017 Jkt 241001 PO 00000 Frm 00002 Fmt 4700 Sfmt 4700 E:\FR\FM\16MRR1.SGM 16MRR1
13964 Federal Register / Vol. 82, No. 50 / Thursday, March 16, 2017 / Rules and Regulations

Novel or Unusual Design Features feature, the special conditions would discussed in FAA Advisory Circular
The Robinson Model R22 BETA will apply to that model as well. (AC) 27–1B (Certification of Normal
incorporate the following novel or Category Rotorcraft) and Society of
Conclusion
unusual design features: A Helitrak AP. Automotive Engineers (SAE) document
This action affects only certain novel Aerospace Recommended Practice
This AP system performs non-required
or unusual design features on one model (ARP) 4761 (Guidelines and Methods for
flight control functions. The Helitrak AP
helicopter. It is not a rule of general Conducting the Safety Assessment
is a two-axis system with two
applicability and affects only the Process on civil airborne Systems and
operational flight control modes:
applicant who applied to the FAA for Equipment).
Heading and airspeed hold or heading
approval of these features on the Failure Condition Categories. Failure
and altitude hold. Other flight control
helicopter. conditions are classified, according to
functions include unusual attitude
Under standard practice, the effective the severity of their effects on the
recovery, collective pulldown, and an
date of final special conditions would rotorcraft, into one of the following
autorotation function.
be 30 days after the date of publication categories:
Discussion in the Federal Register; however, the 1. No Effect. Failure conditions have
The effect on safety is not adequately substance of these special conditions no effect on safety. These failure
covered under § 27.1309 for the has been subjected to the notice and conditions would not affect the
application of new technology and new comment period previously and has operational capability of the rotorcraft
application of standard technology. been derived without substantive or increase crew workload; however,
Specifically, the provisions of change from those previously issued. As could result in an inconvenience to the
§ 27.1309(c) do not adequately address it is unlikely that prior public comment occupants, excluding the flight crew.
the safety requirements for systems would result in a significant change 2. Minor. Failure conditions do not
whose failures could result in from the substance contained herein, significantly reduce rotorcraft safety,
catastrophic or hazardous/severe-major the FAA considers prior notice to be and involve crew actions that are well
failure conditions and for complex unnecessary and finds that good cause within their capabilities. Minor failure
systems whose failures could result in exists to make these special conditions conditions would include, for example,
major failure conditions. effective upon issuance. a slight reduction in safety margins or
To comply with these special List of Subjects in 14 CFR Part 27 functional capabilities, a slight increase
conditions, we require that Helitrak in crew workload, such as, routine flight
Aircraft, Aviation safety. plan changes, or result in some physical
provide the FAA with a systems safety
assessment (SSA) for the final Helitrak The authority citation for these discomfort to occupants.
AP installation configuration that will special conditions is as follows: 3. Major. Failure conditions reduce
adequately address the safety objectives Authority: 42 U.S.C. 7572; 49 U.S.C. the capability of the rotorcraft or the
established by a functional hazard 106(g), 40113, 44701–44702, 44704. ability of the crew to cope with adverse
assessment (FHA) and a preliminary operating conditions to the extent that
The Special Conditions there would be, for example, a
system safety assessment (PSSA),
including the fault tree analysis (FTA). Accordingly, pursuant to the significant reduction in safety margins
This will ensure that all failure authority delegated to me by the or functional capabilities, a significant
conditions and their resulting effects are Administrator, the following special increase in crew workload or result in
adequately addressed for the installed conditions are issued as part of the type impairing crew efficiency, physical
Helitrak AP. The SSA process, FHA, certification basis for Robinson distress to occupants, including injuries,
PSSA, and FTA are all parts of the Helicopter Company (Robinson) Model or physical discomfort to the flight
overall safety assessment process R22 BETA helicopters as modified by crew. The potential for a failure to result
discussed in FAA Advisory Circular 27– Helitrak, Incorporated. in a condition characterized as major
1B, Certification of Normal Category In addition to the requirement of should be remote with a probability of
Rotorcraft, and Society of Automotive § 27.1309(c), the Helitrak autopilot (AP) occurrence between 1 × 10¥3 to 1 ×
Engineers document Aerospace system installation on Robinson Model 10¥5 failures/flight hour.
Recommended Practice 4761, R22 BETA helicopters must be designed 4. Hazardous/Severe-Major.
Guidelines and Methods for Conducting and installed so that the failure a. Failure conditions reduce the
the Safety Assessment Process on Civil conditions identified in the functional capability of the rotorcraft or the ability
Airborne Systems and Equipment. hazard assessment (FHA) and verified of the crew to cope with adverse
These special conditions require that by the system safety assessment (SSA) operating conditions to the extent that
the Helitrak AP installed on a Robinson are adequately addressed in accordance there would be:
Model R22 BETA helicopter meets the with the following requirements. (1) A large reduction in safety margins
requirements to adequately address the Helitrak, Incorporated must provide or functional capabilities;
failure effects identified by the FHA, the FAA with a SSA for the final (2) physical distress or excessive
and subsequently verified by the SSA, Helitrak AP installation configuration workload that would impair the flight
within the defined design integrity that will adequately address the safety crew’s ability to the extent that they
requirements. objectives established by the FHA and could not be relied on to perform their
the preliminary system safety tasks accurately or completely; or
Applicability assessment (PSSA), including the fault (3) possible serious or fatal injury to
jstallworth on DSK7TPTVN1PROD with RULES

These special conditions are tree analysis (FTA). This will show that a passenger or a cabin crewmember,
applicable to the Robinson Model R22 all failure conditions and their resulting excluding the flight crew. The potential
BETA helicopter. Should Helitrak apply effects are adequately addressed for the that a failure results in a condition
at a later date for an STC to modify any installed Helitrak AP. characterized as hazardous/severe-major
other model included on Type Note 1: The SSA process, FHA, PSSA, should be extremely remote with a
Certificate No. H10WE to incorporate and FTA are all parts of the overall probability of occurrence between 1 ×
the same novel or unusual design safety assessment (SA) process 10¥5 to 1 × 10¥7 failures/flight hour.

VerDate Sep<11>2014 14:18 Mar 15, 2017 Jkt 241001 PO 00000 Frm 00004 Fmt 4700 Sfmt 4700 E:\FR\FM\16MRR1.SGM 16MRR1
Federal Register / Vol. 82, No. 50 / Thursday, March 16, 2017 / Rules and Regulations 13965

b. ‘‘Hazardous/severe-major’’ failure Systems with failures that may result the requirements for failure conditions
conditions can include events that are in ‘‘hazardous/severe-major’’ effects classified as ‘‘hazardous/severe-major’’
manageable by the crew by the use of must be shown to be extremely remote may be shown by flight-testing in
proper procedures, which, if not must develop software to the RTCA combination with analysis and
implemented correctly or in a timely Document DO–178B, Software simulation, and the appropriate testing
manner, may result in a catastrophic Considerations in Airborne Systems and to validate the analysis. Flight tests may
event. Equipment Certification, Level B be limited for ‘‘hazardous/severe-major’’
5. Catastrophic. Failure conditions software design assurance level and failure conditions and effects due to
result in multiple fatalities to occupants, must develop complex hardware to the safety considerations. Compliance with
fatalities or incapacitation to the flight Radio Technical Commission for the requirements for failure conditions
crew, or result in loss of the rotorcraft. Aeronautics (RTCA) Document DO–254, classified as ‘‘catastrophic’’ may be
The potential that a failure results in a Design Assurance Guidance for shown by analysis and appropriate
condition characterized as catastrophic Airborne Electronic Hardware, Level B testing in combination with simulation
should be extremely improbable with hardware design assurance level. to validate the analysis. Very limited
probability of occurrence 1 × 10¥9 Systems with failures that may result flight tests in combination with
failures/flight hour or less. in ‘‘catastrophic’’ effects must be shown simulation are used as a part of a
to be extremely improbable, and showing of compliance for
Requirements develop software to the RTCA ‘‘catastrophic’’ failure conditions. Flight
Helitrak must comply with the Document DO–178B, Software tests are performed only in
existing requirements of § 27.1309 for Considerations in Airborne Systems and circumstances that use operational
all applicable design and operational Equipment Certification, Level A design variations, or extrapolations from other
aspects of the Helitrak AP with the assurance level and must develop flight performance aspects to address
failure condition categories of ‘‘no complex hardware to the Radio flight safety.
effect’’ and ‘‘minor,’’ and for non- Technical Commission for Aeronautics These special conditions require that
complex systems whose failure (RTCA) Document DO–254, Design the Helitrak AP system installed on a
condition category is classified as Assurance Guidance for Airborne Robinson Model R22 BETA helicopter,
‘‘major.’’ Helitrak must comply with the Electronic Hardware, Level A hardware Type Certificate No. H10WE, meet these
requirements of these special conditions design assurance level. requirements to adequately address the
for all applicable design and operational System Design Environmental failure effects identified by the FHA,
aspects of the Helitrak AP with the Requirements and subsequently verified by the SSA,
failure condition categories of within the defined design system
The AP system equipment must be
‘‘catastrophic’’ and ‘‘hazardous severe/ integrity requirements.
qualified to the appropriate
major,’’ and for complex systems whose environmental level per RTCA Issued in Fort Worth, Texas, on March 10,
failure condition category is classified Document DO–160F, Environmental 2017.
as ‘‘major.’’ A complex system is a Conditions and Test Procedures for Lance Gant,
system whose operations, failure Airborne Equipment, for all relevant Manager Rotorcraft Standard Staff, Aircraft
conditions, or failure effects are difficult aspects. This is to show that the AP Certification Service.
to comprehend without the aid of system performs its intended function [FR Doc. 2017–05268 Filed 3–15–17; 8:45 am]
analytical methods (for example, FTA, under any foreseeable operating BILLING CODE 4910–13–P
Failure Modes and Effect Analysis, condition, including the expected
FHA). environment in which the AP is
System Design Integrity Requirements intended to operate. Some of the main DEPARTMENT OF HOMELAND
considerations for environmental SECURITY
Each of the failure condition concerns are installation locations and
categories defined in these special the resulting exposure to environmental Coast Guard
conditions relate to the corresponding conditions for the AP system
aircraft system integrity requirements. equipment, including considerations for 33 CFR Part 165
The system design integrity other equipment that may be affected [Docket Number USCG–2016–0032]
requirements for the Helitrak AP, as environmentally by the AP equipment
they relate to the allowed probability of installation. The level of environmental RIN 1625–AA11
occurrence for each failure condition qualification must be related to the
category and the proposed software Regulated Navigation Areas; Escorted
severity of the considered failure
design assurance level, are as follows: Submarines Sector Jacksonville
conditions and effects on the rotorcraft.
Systems with failures that may result Captain of the Port Zone
in a ‘‘major’’ effect must be shown to be Test & Analysis Requirements
AGENCY: Coast Guard, DHS.
remote and develop software to the Compliance with the requirements of ACTION: Final rule.
Radio Technical Commission for these special conditions may be shown
Aeronautics (RTCA) Document DO– by a variety of methods, which typically SUMMARY: The Coast Guard is
178B, Software Considerations in consist of analysis, flight tests, ground establishing regulated navigation areas
Airborne Systems and Equipment tests, and simulation, at a minimum. (RNA) covering the St. Marys Entrance
Certification, Level C software design Compliance methodology is related to Channel, portions of the Cumberland
jstallworth on DSK7TPTVN1PROD with RULES

assurance level and must develop the associated failure condition Sound, and the Atlantic Ocean that will
complex hardware to the Radio category. If the AP is a complex system, be in effect whenever any Navy
Technical Commission for Aeronautics compliance with the requirements for submarine (foreign or domestic) is
(RTCA) Document DO–254, Design failure conditions classified as ‘‘major’’ escorted by the Coast Guard and
Assurance Guidance for Airborne may be shown by analysis, in operating within the jurisdictional
Electronic Hardware, Level C hardware combination with appropriate testing, to waters of the Sector Jacksonville
design assurance level. validate the analysis. Compliance with Captain of the Port Zone. These RNAs

VerDate Sep<11>2014 14:18 Mar 15, 2017 Jkt 241001 PO 00000 Frm 00005 Fmt 4700 Sfmt 4700 E:\FR\FM\16MRR1.SGM 16MRR1
Document Created: 2017-03-16 02:18:54
Document Modified: 2017-03-16 02:18:54
Category		Regulatory Information
Collection		Federal Register
sudoc Class		AE 2.7: GS 4.107: AE 2.106:
Publisher		Office of the Federal Register, National Archives and Records Administration
Section		Rules and Regulations
Action		Final special conditions; request for comments.
Dates		The effective date of these special conditions is March 16, 2017. We must receive your comments by May 15, 2017.
Contact		Mark Wiley, Aviation Safety Engineer, FAA, Rotorcraft Directorate, Regulations and Policy Group (ASW-111), 10101 Hillwood Parkway, Fort Worth, TX 76177; telephone (817) 222-5134; or email to [email protected]
FR Citation		82 FR 13962
CFR Associated		Aircraft and Aviation Safety
82 FR 13962 - Special Conditions: Robinson Helicopter Company Model R22 BETA Helicopter; Installation of Helitrak Autopilot System

DEPARTMENT OF TRANSPORTATIONFederal Aviation Administration

Federal Register Volume 82, Issue 50 (March 16, 2017)

DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
