AMC-20 - wtc-solutions.com

660 Pages·2014·5.98 MB·English

by  Markus Willisch

EASA
AMC-20
WTC Solutions GmbH
Switzerland
www.wtc-solutions.com
Includes
ED Decision 2015/017/R
Amendment 13
Content
20-115C Software Considerations for Certification of Airborne Systems and Equipment
20-128A Design Considerations for Minimizing Hazards Caused by Uncontained Turbine
Engine and Auxiliary Power Unit Rotor Failure
20-1 Certification of Aircraft Propulsion Systems Equipped with Electronic Control
Systems
20-2A Certification of Essential APU Equipped with Electronic Controls
20-3A Certification of Engines Equipped with Electronic Engine Control Systems
20-4A Airworthiness Approval and Operational Criteria For the Use of Navigation
Systems in European Airspace Designated For Basic RNAV Operations
20-5 Airworthiness Approval and Operational Criteria for the use of the Navstar Global
Positioning System (GPS)
20-6 Extended Range Operation with Two-Engine Aeroplanes ETOPS Certification and
Operation
20-8 Occurrence Reporting
20-9 Acceptable Means of Compliance for the Approval of Departure Clearance via
Data Communications over ACARS
20-12 Recognition Of FAA Order 8400.12a For RNP-10 Operations.
20-15 Airworthiness Certification Considerations for the Airborne Collision Avoidance
System (ACAS II) with optional Hybrid Surveillance
20-20 Continuing Structural Integrity Programme
20-21 Programme to enhance aeroplane Electrical Wiring Interconnection System
(EWIS) maintenance
20-22 Aeroplane Electrical Wiring Interconnection System Training Programme
20-23 Development of Electrical Standard Wiring Practices documentation
20-24 Certification Considerations for the Enhanced ATS in Non-Radar Areas using ADS-
B Surveillance (ADS-B-NRA) Application via 1090 MHZ Extended Squitter.
20-25 Airworthiness and operational consideration for Electronic Flight Bags (EFBs)
20-26 Airworthiness Approval and Operational Criteria for RNP Authorisation Required
(RNP AR) Operations
20-27A Airworthiness Approval and Operational Criteria for RNP APPROACH (RNP APCH)
Operations Including APV BARO-VNAV Operations
20-28 Airworthiness Approval and Operational Criteria related to Area Navigation for
Global Navigation Satellite System approach operation to Localiser Performance
with Vertical guidance minima using Satellite Based Augmentation System
20-29 Composite Aircraft Structure
ED Decision 2013/026/R
12/09/2013
Annex II
AMC 20-115C

AMC 20-115C
Software Considerations for Certification of Airborne Systems and Equipment
1 PURPOSE

This Acceptable Means of Compliance (AMC) provides a means that can be used to
demonstrate that the safety aspects of software hosted on airborne systems and
equipment comply with requirements for initial airworthiness in order to obtain an
airworthiness approval.

Compliance with this AMC is not mandatory and hence an applicant may elect to use an
alternative means of compliance. However, those alternative means of compliance must
meet the relevant requirements, ensure an equivalent level of software safety and be
approved by the European Aviation Safety Agency on a product basis.

In particular, the purpose of this AMC is to provide guidelines for the production of
software for airborne systems and equipment that performs its intended function with a
level of confidence in safety that complies with airworthiness requirements.

2 SCOPE

This AMC discusses those aspects of airworthiness certification that pertain to the
production of software for airborne systems and equipment used on aircraft, engines,
propellers, APU or others parts.

In discussing those aspects, the system life cycle and its relationship with the software
life cycle are considered to aid in the understanding of the certification process.

Other system and software life cycle processes are out of scope of the present AMC. For
instance, out of scope are:

 system safety assessment and validation processes at product level, in the context
of initial airworthiness certification of aircraft and engines;
 software considerations for the verification of ground and space systems and
constituents of Air Traffic Management (ATM)/Air Navigation Services (ANS);
 software considerations for services consisting of the origination and processing of
data and formatting and delivering data to general air traffic for the purpose of
safety-critical air navigation;

Since certification issues for initial airworthiness are discussed only in relation to the
software life cycle, the operational aspects of the resulting software are not discussed.
For example, the certification, approval and management aspects of user-modifiable data
are beyond the scope of this AMC.

This AMC does not provide guidelines concerning the structure of the applicant's
organisation, the relationships between the applicant and its suppliers, or how the
responsibilities are divided.

Personnel qualification criteria are also beyond the scope of this AMC.

3 PROCEDURES, METHODS AND TOOLS FOR SOFTWARE CONSIDERATIONS

This AMC recognises that the European Organisation for Civil Aviation Equipment
(EUROCAE) document ED-12C, ‘Software Considerations in Airborne Systems and
Equipment Certification’, issued in January 2012, related guidance documents and
supplements or equivalent RTCA Inc. documents, constitute an acceptable means of
compliance for software (SW).
AMC 20-115C
Aspects of certification that pertain to the production of software for airborne systems
and equipment used on aircraft, engines, propellers and, by region, auxiliary power units.
It discusses how the document may be applied to certification programmes administered
by the European Aviation Safety Agency.

4 RELATED DOCUMENTS

4.1 EUROCAE document ED-12C, ‘Software Considerations in Airborne Systems and
Equipment Certification’, describes the acceptable processes to develop and verify SW for
airborne systems and equipment.
4.2 EUROCAE document ED-12C is technically equivalent to RTCA Inc. document DO-
178C. A reference to one document, at the same revision level, may be interpreted to
mean either document.
4.3 ED-12C/DO-178C guidance is extended with the following related documents and
supplements:
 ED-94C/DO-248C ‘Supporting Information for ED-12C and ED-109A’ ;
 ED-215/DO-330 ‘Software Tool Qualification Considerations’;
 ED-216/DO-333 ‘Formal Methods Supplement to ED-12C and ED-109A’;
 ED-217/DO-332 ‘Object-Oriented Technology and Related Techniques Supplement
to ED-12C and ED-109A’; and
 ED-218/DO-331 ‘Model-based Development and Verification Supplement to ED-12C
and ED-109A’.
4.4 The technical content of this AMC is as far as practicable harmonised with the latest
edition of FAA AC 20-1151, equally based on ED-12/DO-178.

5 RELATED CERTIFICATION SPECIFICATIONS (CSs)

Part 21, CS-22, CS-23, CS-25, CS-27, CS-29, CS-AWO, CS-E, CS-P, CS-APU, CS-ETSO
and CS-VLA. Existing references to ED-12/DO-178, ED-12A/DO-178A and ED-12B/DO-
178B in the above CSs will be replaced by reference to this AMC to provide a single
source of regulatory material on airborne software development for airborne systems
and, equipment used on aircraft, engines, propellers and auxiliary power units.

6 BACKGROUND

EUROCAE document ED-12C was developed to establish software considerations for
aircraft system or equipment developers when the aircraft system and equipment design
is developed using software based techniques. Current and future avionics designs make
extensive use of this technology. The EUROCAE document provides guidance for
establishing software life cycle planning, development, verification, configuration
management, quality assurance and certification liaison processes to be used in software
based systems.

1 AC 20-115C of 19 July 2013:
http://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.infor
mation/documentID/1021710

Page 2 of 4
AMC 20-115C

The guidance provided in ED-12C is in the form of:

 objectives for software life-cycle processes;
 descriptions of activities and design considerations for achieving those objectives;
and
 descriptions of the evidence that indicates that the objectives have been satisfied.

ED-94C document was developed to provide supporting information and clarification of
ED-12C.
ED-215 is a document that was developed to provide tool qualification guidance. ED-215
is invoked in ED-12C (section 12.2.3 Tool Qualification Process) and provides the
objectives, activities, guidance, and life cycle data required for each Tool Qualification
Level.
ED-216 is a supplement to ED-12C that was developed to provide specific guidance
regarding Formal Methods.
ED-217 is a supplement to ED-12C that was developed to provide specific guidance
regarding Object-Oriented Technology and Related Techniques.
ED-218 is a supplement to ED-12C that was developed to provide specific guidance
regarding the techniques of Model-based Development and Verification.
Whenever one or more of the techniques addressed by these last three supplements is
used in software based systems, the corresponding supplement or supplements to ED-
12C should be applied in addition to ED-12C itself.

ED-12C and its related supplements specify the information to be made available and/or
delivered to the Agency. Guidance is also provided for dealing with software developed to
earlier standards, tool qualification and alternative methods that may be used.

7 USE OF EUROCAE ED-12C AND RELATED DOCUMENTS AND SUPPLEMENTS

An applicant to EASA for product certification or ETSO authorisation for any software-
based equipment or system may use the considerations outlined in EUROCAE document
ED-12C and its related documents and applicable supplements, as a means, but not the
only means, to secure approval. The Agency may publish acceptable means of
compliance for specific CSs, stating the required relationship between the criticality of the
software based systems and the software levels as defined in EUROCAE document ED-
12C. Such acceptable means of compliance will take precedence over the application of
EUROCAE document ED-12C.

8 USE OF PREVIOUS VERSIONS

8.1 Previous ED-12 versions may continue to be accepted for modifications to the
software of already approved systems and equipment or for reuse of already approved
software components in new application for certification of products or part and
appliances.

8.2 Paragraph 8.1 applies, provided that:
 The software level is not higher;
 The techniques described in the ED-12C supplements (MBD, OOTRT, Formal
Methods) are not introduced into the new project; otherwise, ED-216 and/or ED-
217 and/or ED-218 should be applied;
 the change to the ETSO authorized article is minor (see 21A.611);
 No new software criteria 1 or 2 tool qualification is needed; otherwise ED-215
should be applied only on the new software criteria 1 or 2 tools if the existing tools
are not significantly changed;

Page 3 of 4
AMC 20-115C
 No new Parameter Data Item files are introduced, otherwise ED-12C should only be
applied on the new Parameter Data Item files if the existing PDIs are not
significantly changed and it should be demonstrated that software using the new
Parameter Data Item files is compliant with the ED-12C sections related to
Parameter Data Item;
 Software plans, processes, and life cycle environment, including process
improvements have been maintained;
8.3 Where a modification is made to an existing software-based equipment or system,
and the criteria in this section indicate the use of ED-12C and related supplements, they
may apply, under justification, only to the software components affected by the
modification.

For major changes to ETSO authorised articles, a previous version of ED-12 may continue
to be accepted under justification.

Early coordination with EASA is strongly recommended to validate the above
assumptions.

9 AVAILABILITY OF EUROCAE DOCUMENTS

Copies may be purchased from EUROCAE, 102 rue Étienne Dolet, 92240 Malakoff,
France, (Fax : [phone]).

Page 4 of 4
AMC 20-128A

AMC 20–128A

Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and
Auxiliary Power Unit Rotor Failure

1 PURPOSE. This acceptable means of compliance (AMC) sets forth a method of compliance
with the requirements of CS 23.901(f), 23.903(b)(1), 25.903(d)(1) and 25A903(d)(1)of the EASA
Certification Specifications (CS) pertaining to design precautions taken to minimise the hazards to an
aeroplane in the event of uncontained engine or auxiliary power unit (APU) rotor failures. The
guidance provided within this AMC is harmonised with that of the Federal Aviation Administration (FAA)
and is intended to provide a method of compliance that has been found acceptable. As with all AMC
material, it is not mandatory and does not constitute a regulation.

2 RESERVED

3 APPLICABILITY. This AMC applies to CS–23 and CS–25 aeroplanes.

4 RELATED DOCUMENTS. Paragraphs 23.903, and 25.903 of the CS and other paragraphs
relating to uncontained engine failures.

a. Related Joint Aviation Requirements. Sections which prescribe requirements for the design,
substantiation and certification relating to uncontained engine debris include:

§ 23.863, 25.863 Flammable fluid fire protection

§ 25.365 Pressurised compartment loads

§ 25.571 Damage-tolerance and fatigue evaluation of structure

§ 25.963 Fuel tanks: general

§ 25.1189 Shut-off means

§ 25.1461 Equipment containing high energy rotors

CS–APU Auxiliary Power Units

NOTE: The provisions of § 25.1461 have occasionally been used in the approval of APU installations regardless of
protection from high energy rotor disintegration. However, the more specific requirements of CS 25.903(d)(1) and
associated guidance described within this AMC take precedence over the requirements of CS 25.1461.

b. Other Documents

ISO 2685:1992 Aircraft – Environmental conditions and test procedures for airborne
equipment – Resistance to fire in designated fire zones

AC 20–135 Powerplant Installation and Propulsion System Component Fire Protection
Test Methods, Standards, and Criteria.

1
AMC 20-128A
c. Society of Automotive Engineers (SAE) Documents.

AIR1537 Report on Aircraft Engine Containment, October, 1977.

AIR4003 Uncontained Turbine Rotor Events Data Period 1976 through 1983.

AIR4770 Uncontained Turbine Rotor Events Data Period 1984 (Draft) through 1989.

These documents can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth
Drive, Warrendale, Pennsylvania, 15096.

5 BACKGROUND. Although turbine engine and APU manufacturers are making efforts to
reduce the probability of uncontained rotor failures, service experience shows that uncontained
compressor and turbine rotor failures continue to occur. Turbine engine failures have resulted in high
velocity fragment penetration of adjacent structures, fuel tanks, fuselage, system components and
other engines on the aeroplane. While APU uncontained rotor failures do occur, and to date the
impact damage to the aeroplane has been minimal, some rotor failures do produce fragments that
should be considered. Since it is unlikely that uncontained rotor failures can be completely eliminated,
CS–23 and CS–25 require that aeroplane design precautions be taken to minimise the hazard from
such events.

a. Uncontained gas turbine engine rotor failure statistics are presented in the Society of
Automotive Engineers (SAE) reports covering time periods and number of uncontained events
listed in the table shown below. The following statistics summarise 28 years of service
experience for fixed wing aeroplanes and do not include data for rotorcraft and APUs:

No. of Events
Report No. Period Total Category 3 Category 4
AIR1537 1962–75 275 44 5
AIR4003 1976–83 237 27 3
AIR4770 (Draft) 1984–89 164 22 7
TOTAL 676 93 15

The total of 676 uncontained events includes 93 events classified in Category 3 and 15 events
classified in Category 4 damage to the aeroplane. Category 3 damage is defined as significant
aeroplane damage with the aeroplane capable of continuing flight and making a safe landing.
Category 4 damage is defined as severe aeroplane damage involving a crash landing, critical injuries,
fatalities or hull loss.

During this 28 year period there were 1,089.6 million engine operating hours on commercial transports.
The events were caused by a wide variety of influences classed as environmental (bird ingestion,
corrosion/erosion, foreign object damage (FOD)), manufacturing and material defects, mechanical, and
human factors (maintenance and overhaul, inspection error and operational procedures).

b. Uncontained APU rotor failure statistics covering 1962 through 1993 indicate that there have
been several uncontained failures in at least 250 million hours of operation on transport category
aeroplanes. No Category 3 or 4 events were reported and all failures occurred during ground
operation. These events were caused by a wide variety of influences such as corrosion, ingestion of
de-icing fluid, manufacturing and material defects, mechanical, and human factors (maintenance and
overhaul, inspection error and operational procedures).

2
AMC 20-128A
c. The statistics in the SAE studies indicate the existence of many different causes of failures not
readily apparent or predictable by failure analysis methods. Because of the variety of causes of
uncontained rotor failures, it is difficult to anticipate all possible causes of failure and to provide
protection to all areas. However, design considerations outlined in this AMC provide guidelines for
achieving the desired objective of minimising the hazard to an aeroplane from uncontained rotor
failures. These guidelines, therefore, assume a rotor failure will occur and that analysis of the effects
of this failure is necessary. These guidelines are based on service experience and tests but are not
necessarily the only means available to the designer.

6 TERMINOILOGY.

a. Rotor. Rotor means the rotating components of the engine and APU that analysis, test, and/or
experience has shown can be released during uncontained failure. The engine or APU manufacturer
should define those components that constitute the rotor for each engine and APU type design.
Typically rotors have included, as a minimum, discs, hubs, drums, seals, impellers, blades and
spacers.

b. Blade. The airfoil sections (excluding platform and root) of the fan, compressor and turbine.

c. Uncontained Failure. For the purpose of aeroplane evaluations in accordance with this AMC,
uncontained failure of a turbine engine is any failure which results in the escape of rotor fragments
from the engine or APU that could result in a hazard. Rotor failures which are of concern are those
where released fragments have sufficient energy to create a hazard to the aeroplane.

d. Critical Component. A critical component is any component whose failure would contribute to
or cause a failure condition which would prevent the continued safe flight and landing of the aeroplane.
These components should be considered on an individual basis and in relation to other components
which could be damaged by the same fragment or by other fragments from the same uncontained
event.

e. Continued Safe Flight and Landing. Continued safe flight and landing means that the
aeroplane is capable of continued controlled flight and landing, possibly using emergency procedures
and without exceptional pilot skill or strength, with conditions of considerably increased flightcrew
workload and degraded flight characteristics of the aeroplane.

f. Fragment Spread Angle. The fragment spread angle is the angle measured, fore and aft from
the centre of the plane of rotation of an individual rotor stage, initiating at the engine or APU shaft
centreline (see Figure 1).

INTENTIONALLY LEFT BLANK
3