[Federal Register Volume 79, Number 160 (Tuesday, August 19, 2014)]
[Rules and Regulations]
[Pages 48946-48949]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2014-19539]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 27

[Docket No. FAA-2014-0596; Special Conditions No. 27-035-SC]


Special Conditions: Robinson Model R66 Helicopter, Sec.  27.1309, 
Installation of HeliSAS Autopilot and Stabilization Augmentation System 
(AP/SAS)

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final special conditions; request for comments.

-----------------------------------------------------------------------

SUMMARY: These special conditions are issued for the modification of 
the Robinson Helicopter Company Model R66 helicopter. This model 
helicopter will have a novel or unusual design feature after 
installation of the HeliSAS helicopter autopilot/stabilization 
augmentation system (AP/SAS) that has potential failure conditions with 
more severe adverse consequences than those envisioned by the existing 
applicable airworthiness regulations. These special conditions contain 
the added safety standards the Administrator considers necessary to 
ensure the failures and their effects are sufficiently analyzed and 
contained.

DATES: The effective date of these special conditions is August 7, 
2014. We must receive your comments on or before October 3, 2014.

ADDRESSES: Send comments identified by docket number [FAA-2014-0596] 
using any of the following methods:
     Federal eRegulations Portal: Go to http://www.regulations.gov and follow the online instructions for sending your 
comments electronically.
     Mail: Send comments to Docket Operations, M-30, U.S. 
Department of Transportation (DOT), 1200 New Jersey Avenue SE., Room 
W12-140, West Building Ground Floor, Washington, DC 20590-0001.
     Hand Delivery of Courier: Deliver comments to the Docket 
Operations, in Room W12-140 of the West Building Ground Floor at 1200 
New Jersey Avenue SE., Washington, DC between 9 a.m., and 5 p.m., 
Monday through Friday, except federal holidays.
     Fax: Fax comments to Docket Operations at 202-493-2251.
    Privacy: The FAA will post all comments it receives, without 
change, to http://regulations.gov, including any personal information 
the commenter provides. Using the search function of the docket Web 
site, anyone can find and read the electronic form of all comments 
received into any FAA docket, including the name of the individual 
sending the comment (or signing the comment for an association, 
business, labor union, etc.). DOT's complete Privacy Act Statement can 
be found in the Federal Register published on April 11, 2000 (65 FR 
19477-19478), as well as at http://DocketsInfo.dot.gov.
    Docket: Background documents or comments received may be read at 
http://www.regulations.gov. Follow the online instructions for 
accessing the docket or go to the Docket Operations in Room W12-140 of 
the West Building Ground Floor at 1200 New Jersey Avenue SE., 
Washington, DC, between 9 a.m., and 5 p.m., Monday through Friday, 
except Federal holidays.

FOR FURTHER INFORMATION CONTACT: Mark Wiley, Aviation Safety Engineer, 
FAA, Rotorcraft Directorate, Regulations and Policy Group (ASW-111), 
2601 Meacham Blvd., Fort Worth, Texas 76137; telephone (817) 222-5134; 
facsimile (817) 222-5961; or email to [email protected].

SUPPLEMENTARY INFORMATION: 

[[Page 48947]]

Reason for No Prior Notice and Comment Before Adoption

    The FAA has determined that notice and opportunity for public 
comment are unnecessary because the substance of these special 
conditions has been subjected to the notice and comment period 
previously and has been derived without substantive change from those 
previously issued. As it is unlikely that we will receive new comments, 
the FAA finds that good cause exists for making these special 
conditions effective upon issuance.

Comments Invited

    While we did not precede this with a notice of proposed special 
conditions, we invite interested people to take part in this action by 
sending written comments, data, or views. The most helpful comments 
reference a specific portion of the special conditions, explain the 
reason for any recommended change, and include supporting data.
    We will consider all comments we receive by the closing date for 
comments. We will consider comments filed late if it is possible to do 
so without incurring expense or delay. We may change these special 
conditions based on the comments we receive.
    If you want us to let you know we received your mailed comments on 
these special conditions, send us a pre-addressed, stamped postcard on 
which the docket number appears. We will stamp the date on the postcard 
and mail it back to you.

Background

    On July 11, 2014, the Robinson Helicopter Company applied to amend 
type certificate (TC) Number R00015LA to install a HeliSAS AP/SAS on 
the Robinson Helicopter Company model R66 helicopter. The Robinson 
Helicopter Company model R66 helicopter is a 14 CFR part 27 normal 
category, single turbine engine, conventional helicopter designed for 
civil operation. This helicopter model is capable of carrying up to 
four passengers with one pilot, and has a maximum gross weight of up to 
2,700 pounds, depending on the model configuration. The major design 
features include a 2-blade, fully articulated main rotor, an anti-
torque tail rotor system, a skid landing gear, and a visual flight rule 
basic avionics configuration. Robinson Helicopter Company proposes to 
modify this model helicopter by installing a two-axis HeliSAS AP/SAS.

Type Certification Basis

    Under 14 CFR 21.101, the Robinson Helicopter Company must show that 
the model R66 helicopter, as modified by the installed HeliSAS AP/SAS, 
continues to meet the applicable regulations in effect on the date of 
application for the change to the type certificate. The baseline of the 
certification basis for the unmodified Robinson Helicopter Company 
model R66 helicopter is listed in TC Number R00015LA. Additionally, 
compliance must be shown to any applicable equivalent level of safety 
findings, exemptions, and special conditions prescribed by the 
Administrator as part of the certification basis.
    The Administrator has determined the applicable airworthiness 
regulations (that is, 14 CFR part 27), as they pertain to this amended 
TC, do not contain adequate or appropriate safety standards for the 
Robinson Helicopter Company model R66 helicopter because of a novel or 
unusual design feature. Therefore, special conditions are prescribed 
under Sec.  21.16.
    In addition to the applicable airworthiness regulations and special 
conditions, the Robinson Helicopter Company must show compliance of the 
HeliSAS AP/SAS amended TC altered model R66 helicopter with the noise 
certification requirements of 14 CFR part 36.
    The FAA issues special conditions, as defined in Sec.  11.19, in 
accordance with Sec.  11.38 and they become part of the type 
certification basis under Sec.  21.101(d).

Novel or Unusual Design Features

    The HeliSAS AP/SAS incorporates novel or unusual design features 
for installation in a Robinson Helicopter Company model R66 helicopter, 
TC Number R00015LA. This HeliSAS AP/SAS performs non-critical control 
functions. However, the possible failure conditions for this system, 
and their effect on the continued safe flight and landing of the 
helicopter, are more severe than those envisioned by the present rules.

Discussion

    The effect on safety is not adequately covered under Sec.  27.1309 
for the application of new technology and new application of standard 
technology. Specifically, the present provisions of Sec.  27.1309(c) do 
not adequately address the safety requirements for systems whose 
failures could result in catastrophic or hazardous/severe-major failure 
conditions, or for complex systems whose failures could result in major 
failure conditions. The current regulations are inadequate because when 
Sec.  27.1309(c) were promulgated, it was not envisioned that this type 
of rotorcraft would use systems that are complex or whose failure could 
result in ``catastrophic'' or ``hazardous/severe-major'' effects on the 
rotorcraft. This is particularly true with the application of new 
technology, new application of standard technology, or other 
applications not envisioned by the rule that affect safety.
    To comply with the provisions of the special conditions, we require 
that Robinson Helicopter Company provide the FAA with a systems safety 
assessment (SSA) for the final HeliSAS AP/SAS installation 
configuration that will adequately address the safety objectives 
established by a functional hazard assessment (FHA) and a preliminary 
system safety assessment (PSSA), including the fault tree analysis 
(FTA). This will ensure that all failure conditions and their resulting 
effects are adequately addressed for the installed HeliSAS AP/SAS. The 
SSA process, FHA, PSSA, and FTA are all parts of the overall safety 
assessment process discussed in FAA Advisory Circular 27-1B 
(Certification of Normal Category Rotorcraft) and Society of Automotive 
Engineers document Aerospace Recommended Practice 4761 (Guidelines and 
Methods for Conducting the Safety Assessment Process on Civil Airborne 
Systems and Equipment).
    These special conditions require that the HeliSAS AP/SAS installed 
on Robinson Helicopter Company model R66 helicopter meet the 
requirements to adequately address the failure effects identified by 
the FHA, and subsequently verified by the SSA, within the defined 
design integrity requirements.
    Failure Condition Categories. Failure conditions are classified, 
according to the severity of their effects on the rotorcraft, into one 
of the following categories:
    1. No Effect. Failure conditions that would have no effect on 
safety. For example, failure conditions that would not affect the 
operational capability of the rotorcraft or increase crew workload; 
however, could result in an inconvenience to the occupants, excluding 
the flight crew.
    2. Minor. Failure conditions which would not significantly reduce 
rotorcraft safety, and which would involve crew actions that are well 
within their capabilities. Minor failure conditions would include, for 
example, a slight reduction in safety margins or functional 
capabilities, a slight increase in crew workload such as routine flight 
plan changes or result in some physical discomfort to occupants.
    3. Major. Failure conditions which would reduce the capability of 
the rotorcraft or the ability of the crew to

[[Page 48948]]

cope with adverse operating conditions to the extent that there would 
be, for example, a significant reduction in safety margins or 
functional capabilities, a significant increase in crew workload or 
result in impairing crew efficiency, physical distress to occupants, 
including injuries, or physical discomfort to the flight crew.
    4. Hazardous/Severe-Major.
    a. Failure conditions which would reduce the capability of the 
rotorcraft or the ability of the crew to cope with adverse operating 
conditions to the extent that there would be:
    (1) a large reduction in safety margins or functional capabilities;
    (2) physical distress or excessive workload that would impair the 
flight crew's ability to the extent that they could not be relied on to 
perform their tasks accurately or completely; or
    (3) possible serious or fatal injury to a passenger or a cabin 
crewmember, excluding the flight crew.
    b. ``Hazardous/severe-major'' failure conditions can include events 
that are manageable by the crew by the use of proper procedures, which, 
if not implemented correctly or in a timely manner, may result in a 
catastrophic event.
    5. Catastrophic--Failure conditions which would result in multiple 
fatalities to occupants, fatalities or incapacitation to the flight 
crew, or result in loss of the rotorcraft.
    Radio Technical Commission for Aeronautics, Inc. (RTCA) Document 
DO-178C (Software Considerations in Airborne Systems And Equipment 
Certification) provides software design assurance levels most commonly 
used for the major, hazardous/severe-major, and catastrophic failure 
condition categories. The HeliSAS AP/SAS system equipment must be 
qualified for the expected installation environment. The test 
procedures prescribed in RTCA Document DO-160G (Environmental 
Conditions and Test Procedures for Airborne Equipment) are recognized 
by the FAA as acceptable methodologies for finding compliance with the 
environmental requirements. Equivalent environment test standards may 
also be acceptable. This is to show that the HeliSAS AP/SAS system 
performs its intended function under any foreseeable operating 
condition, which includes the expected environment in which the HeliSAS 
AP/SAS is intended to operate. Some of the main considerations for 
environmental concerns are installation locations and the resulting 
exposure to environmental conditions for the HeliSAS AP/SAS system 
equipment, including considerations for other equipment that may be 
affected environmentally by the HeliSAS AP/SAS equipment installation. 
The level of environmental qualification must be related to the 
severity of the considered failure conditions and effects on the 
rotorcraft.

Applicability

    These special conditions are applicable to the HeliSAS AP/SAS 
installed as an amended TC approval in Robinson Helicopter Company 
model R66 helicopter, TC Number R00015LA.

Conclusion

    This action affects only certain novel or unusual design features 
for a HeliSAS AP/SAS amended TC installed on one model helicopter. It 
is not a rule of general applicability and affects only the applicant 
who applied to the FAA for approval of these features.

List of Subjects in 14 CFR Part 27

    Aircraft, Aviation safety.
    The authority citation for these special conditions is as follows:

    Authority:  42 U.S.C. 7572, 49 U.S.C. 106(g), 40105, 40113, 
44701-44702, 44704, 44709, 44711, 44713, 44715, 45303.

The Special Conditions

    Accordingly, pursuant to the authority delegated to me by the 
Administrator, the following special conditions are issued as part of 
the Robinson Helicopter Company amended type certificate basis for the 
installation of a HeliSAS helicopter autopilot/stabilization 
augmentation system (AP/SAS) on the model R66 helicopter, Type 
Certificate Number R00015LA. In addition to the requirements of Sec.  
27.1309(c), HeliSAS AP/SAS installations on Robinson Helicopter company 
model R66 helicopter must be designed and installed so that the failure 
conditions identified in the functional hazard assessment (FHA) and 
verified by the system safety assessment (SSA), after design 
completion, are adequately addressed in accordance with the following 
requirements.

Requirements

    The Robinson Helicopter Company must comply with the existing 
requirements of Sec.  27.1309 for all applicable design and operational 
aspects of the HeliSAS AP/SAS with the failure condition categories of 
``no effect,'' and ``minor,'' and for non-complex systems whose failure 
condition category is classified as ``major.'' The Robinson Helicopter 
Company must comply with the requirements of these special conditions 
for all applicable design and operational aspects of the HeliSAS AP/SAS 
with the failure condition categories of ``catastrophic'' and 
``hazardous severe/major,'' and for complex systems whose failure 
condition category is classified as ``major.'' A complex system is a 
system whose operations, failure conditions, or failure effects are 
difficult to comprehend without the aid of analytical methods (for 
example, FTA, Failure Modes and Effect Analysis, FHA).

System Design Integrity Requirements

    Each of the failure condition categories defined in these special 
conditions relate to the corresponding aircraft system integrity 
requirements. The system design integrity requirements for the HeliSAS 
AP/SAS, as they relate to the allowed probability of occurrence for 
each failure condition category and the proposed software design 
assurance level, are as follows:
    1. ``Major''--For systems with ``major'' failure conditions, 
failures resulting in these major effects must be shown to be remote, a 
probability of occurrence on the order of between 1 x 10-\5\ 
to 1 x 10-\7\ failures/hour, and associated software must be 
developed, at a minimum, to the Level C software design assurance 
level.
    2. ``Hazardous/Severe-Major''--For systems with ``hazardous/severe-
major'' failure conditions, failures resulting in these hazardous/
severe-major effects must be shown to be extremely remote, a 
probability of occurrence on the order of between 1 x 10-\7\ 
to 1 x 10-\9\ failures/hour, and associated software must be 
developed, at a minimum, to the Level B software design assurance 
level.
    3. ``Catastrophic''--For systems with ``catastrophic'' failure 
conditions, failures resulting in these catastrophic effects must be 
shown to be extremely improbable, a probability of occurrence on the 
order of 1 x 10-\9\ failures/hour or less, and associated 
software must be developed, at a minimum, to the Level A design 
assurance level.

System Design Environmental Requirements

    The HeliSAS AP/SAS system equipment must be qualified to the 
appropriate environmental level for all relevant aspects to show that 
it performs its intended function under any foreseeable operating 
condition, including the expected environment in which the HeliSAS AP/
SAS is intended to operate. Some of the main considerations for 
environmental concerns are installation locations and the resulting 
exposure to environmental conditions for the HeliSAS AP/SAS system 
equipment, including

[[Page 48949]]

considerations for other equipment that may be affected environmentally 
by the HeliSAS AP/SAS equipment installation. The level of 
environmental qualification must be related to the severity of the 
considered failure conditions and effects on the rotorcraft.

Test and Analysis Requirements

    Compliance with the requirements of these special conditions may be 
shown by a variety of methods, which typically consist of analysis, 
flight tests, ground tests, and simulation, as a minimum. Compliance 
methodology is related to the associated failure condition category. If 
the HeliSAS AP/SAS is a complex system, compliance with the 
requirements for failure conditions classified as ``major'' may be 
shown by analysis, in combination with appropriate testing to validate 
the analysis. Compliance with the requirements for failure conditions 
classified as ``hazardous/severe-major'' may be shown by flight-testing 
in combination with analysis and simulation, and the appropriate 
testing to validate the analysis. Flight tests may be limited for 
``hazardous/severe-major'' failure conditions and effects due to safety 
considerations. Compliance with the requirements for failure conditions 
classified as ``catastrophic'' may be shown by analysis, and 
appropriate testing in combination with simulation to validate the 
analysis. Very limited flight tests in combination with simulation are 
used as a part of a showing of compliance for ``catastrophic'' failure 
conditions. Flight tests are performed only in circumstances that use 
operational variations, or extrapolations from other flight performance 
aspects to address flight safety.
    These special conditions require that the HeliSAS AP/SAS system 
installed on a Robinson Helicopter Company model R66 helicopter, Type 
Certificate Number R00015LA, meet these requirements to adequately 
address the failure effects identified by the FHA, and subsequently 
verified by the SSA, within the defined design system integrity 
requirements.

    Issued in Fort Worth, Texas on August 7, 2014.
Lance T. Gant,
Acting Manager, Rotorcraft Directorate, Aircraft Certification Service.
[FR Doc. 2014-19539 Filed 8-18-14; 8:45 am]
BILLING CODE 4910-13-P