1 PURPOSE.
2 APPLICABILITY.
AC 20-136C 1 PURPOSE.
1.1 This AC provides you, the applicant, with information and guidance on how you can protect aircraft electrical and electronic systems from the effects of lightning. This AC describes a means, but not the only means, for you to demonstrate compliance with 14 CFR 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, or 29.1316, Electrical and electronic system lightning protection , as they pertain to the type or supplemental type certification of your aircraft.
1.2 This revision incorporates the guidance in the Federal Aviation Administration (FAA) Policy Statement PS-ACE-23-10(), HIRF/Lightning Test Levels and Compliance Methods for 14 CFR Part 23 Class I, II, and III Airplanes . This policy describes an acceptable means to demonstrate compliance with § 23.1306 (amendment 23-61) or § 23.2515. The applicant may also use a means of compliance, which may include consensus standards, accepted by the Administrator under § 23.2010.
Note: FAA accepted means of compliance based on ASTM consensus standards for 14 CFR part 23 airplanes, including any required changes for acceptance, are available at the FAA Small Airplanes Design Approvals website. Reference “Industry Standards.” 2 APPLICABILITY.
2.1 The guidance provided in this AC is for those seeking a new Type Certificate (TC) or a change to an existing TC when the certification basis requires you to address the certification requirements of §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, or § 29.1316.
2.2 This is a guidance document. Its content is not legally binding in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance document is voluntary only. Nonconformity will not affect rights and obligations under existing statutes and regulations.
2.3 The FAA will consider other means of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must”, as used in this AC, only refer to actions necessary to follow this particular means of compliance. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the FAA may require additional substantiation or design changes as a basis for finding compliance.
2.4 The material contained in this AC does not change or create any additional regulatory requirement, nor does it authorize changes in, or permit deviations from, existing regulatory requirements.
3 CANCELLATION.
4 SCOPE.
6 BACKGROUND.
7 STEPS FOR SHOWING COMPLIANCE.
AC 20-136C 6 BACKGROUND.
6.1 Regulatory Applicability.
The standards for aircraft electrical and electronic system lightning protection are based on the aircraft's potential for lightning exposure and the consequences of system failure.
The regulations require lightning protection of aircraft electrical and electronic systems with catastrophic, hazardous, or major failure conditions for aircraft certificated under 14 CFR parts 25, 27 and 29. The requirements also apply to 14 CFR part 23 airplanes approved for operations under instrument flight rules (IFR). Those part 23 (amendment 23-61) airplanes and part 27 rotorcraft, approved solely for operations under visual flight rules (VFR), require lightning protection of electrical or electronic systems that have catastrophic failure conditions.
6.2 Regulatory Requirements.
Protection against the effects of lightning for aircraft electrical and electronic systems, regardless of whether these are ‘indirect’ or ‘direct’ effects of lightning, are addressed under §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, and 29.1316. The terms ‘indirect’ and ‘direct’ are often used to classify the effects of lightning; however, the regulations do not, and are not intended to, differentiate between the effects of lightning. The focus is to protect aircraft electrical and electronic systems from the effects of lightning.
7 STEPS FOR SHOWING COMPLIANCE.
7.1 General.
7.1.1 The following steps describe a method for complying with §§ 23.1306 (amendment 23- 61) 23.2515, 25.1316, 27.1316, and 29.1316 requirements for your aircraft’s electrical and electronic systems. Adherence to the order of activities in the list below is not required.
• Identify the systems to be assessed.
• Perform a lightning safety assessment.
• Determine the lightning strike zones for the aircraft.
• Establish the aircraft lightning environment for each zone.
• Determine the lightning transient environment associated with the systems.
• Establish equipment transient design levels (ETDLs) and aircraft actual transient levels (ATLs).
• Verify compliance with the requirements.
• Take corrective measures, if needed.
Note: The steps above should be performed to address lightning transients induced in electrical and electronic system wiring and equipment, and lightning damage to aircraft external equipment and sensors that are connected to electrical and electronic systems, AC 20-136C such as radio antennas and air data probes. More detailed guidance on lightning protection of systems is provided in SAE ARP5415 / EUROCAE ED-158. Additional guidance on lightning protection against lightning damage for external equipment and sensor installations can be found in SAE ARP5577.
7.2 Identify the Systems to be Assessed.
7.2.1 The aircraft systems requiring a lightning safety assessment should be identified.
Address any electrical or electronic system failure that may cause or contribute to an adverse effect on the aircraft (catastrophic, hazardous, or major failure condition). The effects of a lightning strike, therefore, should be assessed in a manner that allows for the determination of the degree to which the aircraft’s and/or its systems’ safety may be influenced. The lightning safety assessment should cover: • All normal aircraft operating modes, phases of flight, and operating conditions; and • All lightning-related failure conditions and their subsequent effect on aircraft operations and the flightcrew.
• System responses and any required flightcrew actions.
7.3 Lightning Safety Assessment.
7.3.1 A safety assessment related to lightning effects should be performed to establish and classify the system failure conditions. Tables 1 and 2 provide the corresponding failure condition classification and system lightning certification level (LCL) for the appropriate lightning regulations. The failure condition classifications and terms used in this AC are consistent with those used in AC 23.1309-1, AC 25.1309-1, AC 27-1, and AC 29-2, as applicable. Only those systems identified as performing or contributing to functions whose failure would result in catastrophic, hazardous, or major failure conditions are subject to lightning regulations. Based on the failure condition classification established by the safety assessment, the systems should be assigned appropriate LCLs, as shown in Tables 1 and 2. The lightning safety assessment should consider the common cause effects of lightning, particularly for highly integrated systems and systems with redundant elements. Common cause effects due to lightning exposure may simultaneously have an adverse impact on multiple electrical and electronic systems’ functions. The lightning safety assessment determines the consequences of failures for the aircraft functions that the systems perform.
7.3.2 The LCL classification assigned to the system and functions may be different from the development assurance level assigned for equipment redundancy, software, and airborne electronic hardware. This is because the lightning environment may lead to common cause effects. The term “development assurance level” should not be used to describe the LCL because of the potential differences in assigned classifications for software, airborne electronic hardware, and equipment redundancy. The lightning safety Reference ACs 23.1309-1, 25.1309-1, 27-1, or 29-2 for common cause considerations and analysis.
AC 20-136C assessment should include all electrical and electronic equipment, components, and electrical interconnections, and should assume that they are potentially affected by lightning. It is not appropriate to use the lightning immunity data for electrical and electronic equipment, components, and electrical interconnections as information input to the lightning safety assessment. Lightning immunity should only be used to demonstrate compliance with the applicable paragraph of the lightning regulations, after the required LCL for the system and functions are determined by lightning safety assessment.
7.3.3 The lightning safety assessment should have input from and be coordinated between the applicant’s safety specialists, system specialists, and lightning specialists. This process may vary from applicant to applicant. Further guidance on performing a safety assessment can be found in AC 23.1309-1, AC 25.1309-1, AC 27-1, AC 29-2, SAE ARP4754, and ARP4761. More detailed guidance on the lightning safety assessment is provided in SAE ARP5415 / EUROCAE ED-158.
Note: Considering that lightning and HIRF environments may have similar effects on electronic systems (disturbing electrical signals causing upsets or damage to circuits) and that the regulations are similarly structured, the system LCL and HIRF certification level (HCL) may be the same.
AC 20-136C Table 1. Lightning Failure Conditions and Certification Levels LIGHTNING REQUIREMENTS MOST SYSTEM EXCERPTS FROM SEVERE LIGHTNING §§ 23.1306 (amendment 23-61), 25.1316, FAILURE CERTIFICATION CONDITION LEVEL (LCL) 27.1316, and 29.1316 (a) Each electrical and electronic system that performs a function, for which failure would Catastrophic A prevent the continued safe flight and landing of the [aircraft] … (b) Each electrical and electronic system that Hazardous B performs a function, for which failure would Major C reduce the capability of the [aircraft] or the ability of the flightcrew to respond to an adverse operation condition… Note: Paragraph (b) in this table is applicable for normal category airplanes and rotorcraft (part 23 and 27, respectively) approved for instrument flight rules (IFR) operations.
Parts 23 and 25 refer to airplanes, and parts 27 and 29 refer to rotorcraft.
AC 20-136C Table 2. Lightning Failure Conditions and Certification Levels (§ 23.2515) MOST SYSTEM LIGHTNING REQUIREMENTS SEVERE LIGHTNING EXCERPTS FROM FAILURE CERTIFICATION § 23.2515 (Amendment 23-64) CONDITION LEVEL (LCL) (a) Each electrical or electronic system that performs a function, the failure of which Catastrophic A would prevent the continued safe flight and landing of the airplane… (b) Each electrical and electronic system that Hazardous B performs a function, the failure of which would significantly reduce the capability of the airplane or the ability of the flightcrew to respond to an adverse operation condition… Note: Paragraphs (a) and (b) in this table are applicable for normal category airplanes approved for instrument flight rules (IFR) operations unless an applicant shows that exposure to lightning is unlikely.
7.3.3.1 LCL A Systems.
7.3.3.1.1 You must demonstrate compliance with §§ 23.1306(a) (amendment 23- 61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a), for aircraft functions and systems that perform functions whose failure would prevent continued safe flight and landing of the aircraft. Additionally, paragraph (a)(2) of those regulations require the electrical and electronic system to automatically recover normal operation of the functions in a timely manner after an airplane is exposed to lightning, with the exception of § 23.2515(a)(2), which allows manual recovery (flightcrew action) or automatic recovery. If all electrical and electronic equipment, components, and electrical interconnections that are required for normal operation of the Level A functions comply with the requirements of paragraph (a), then all electrical and electronic equipment, components, and electrical interconnections that are only operational in non-normal situations may comply with paragraph (b) of these regulations, unless the FAA determines the failure is catastrophic.
In the context of this AC, refers to a critical function whose failure may be catastrophic (LCL A system).
AC 20-136C 7.3.3.1.2 The lightning safety assessment should consider effects of lightning- related failures or malfunctions on systems with lower failure classification that may affect the function of LCL A systems. You should demonstrate that any system with wiring connections to an LCL A system will not adversely affect the functions with catastrophic failure conditions performed by the LCL A system when the aircraft is exposed to lightning.
Redundancy alone cannot protect against lightning because the lightning- generated electromagnetic fields, conducted currents, and induced currents in the aircraft, can simultaneously induce transients in all electrical wiring on an aircraft.
7.3.3.2 LCL B or C Systems.
You must demonstrate compliance with §§ 23.1306(b) (amendment 23- 61), 23.2515(b), 25.1316(b), 27.1316(b), or § 29.1316(b), for a system that performs a function whose failure would reduce the capability of the aircraft or the ability of the flightcrew to respond to an adverse operating condition. Simultaneous and common cause failures due to lightning exposure generally do not have to be assumed for LCL B or C systems incorporating redundant, spatially separated installations in the aircraft.
This is because aircraft transfer function tests and in-service experience have shown these redundant and spatially separated installations are not simultaneously exposed to the maximum lightning induced transients. For example, redundant systems (internal to the airframe) may mitigate lightning indirect effects, if there is acceptable separation between the equipment to prevent damage to multiple systems, so that the function is maintained. Therefore, simultaneous loss of all of these redundant and spatially separated LCL B or C systems due to lightning exposure does not need to be considered. However, if multiple LCL B or C systems including interface wiring are designed and installed within the same location in the aircraft, or share a common wiring connection, then the combined failure due to lightning exposure should be assessed to determine if the combined failures are catastrophic. If so, these systems should be designated as LCL A systems.
7.3.3.3 Failure Conditions.
The lightning safety assessment should consider all potential adverse effects due to system failures, malfunctions, or misleading information.
The lightning safety assessment may show that a system’s functions have different failure conditions in different phases of flight. Therefore, the system LCL corresponds to phase of flight with the most severe failure condition. For example, an automatic flight control system may have a catastrophic failure condition for autoland, while automatic flight control system operations in cruise may have a hazardous failure condition.
AC 20-136C 7.4 Determine the Lightning Strike Zones for the Aircraft.
The purpose of lightning zoning is to determine those areas of the aircraft likely to experience lightning channel attachment and those structures that may conduct lightning current between lightning attachment points. You should determine the lightning attachment zones for your aircraft configuration, since the zones will be dependent upon the aircraft’s geometry, materials, and operational factors. Lightning attachment zones often vary from one aircraft type to another.
Note: AC 20-155 provides guidance to determine the lightning attachment zones for aircraft.
7.5 Establish the Aircraft Lightning Environment for Each Zone.
Zones 1 and 2 identify where lightning is likely to attach and, as a result, the entrance and exit points for current flow through the aircraft. The appropriate voltage waveforms and current components to apply in those zones should be identified. By definition, Zone 3 areas carry lightning current flow between initial (or swept stroke) attachment points, so they may include contributions from all of the current components. The FAA accepts analysis to estimate Zone 3 current levels that result from the external environment. The external lightning environment is: 7.5.1 Caused by the lightning flash interacting with the exterior of the aircraft.
7.5.2 Represented by combined waveforms of the lightning current components at the aircraft surface.
Note: AC 20-155 provides guidance for selecting the lightning waveforms and their applications.
7.6 Determine the Lightning Transient Environment Associated with the Systems.
7.6.1 The lightning environment, as seen by electrical and electronic systems, consists of voltages and currents produced by lightning current flowing through the aircraft. The voltages and currents that appear at system wiring interfaces result from aperture coupling, structural voltages, or conducted currents resulting from direct attachments to equipment and sensors.
7.6.2 Determine the lightning voltage and current transient waveforms and amplitudes that can appear at the electrical and electronic equipment interface circuits for each system identified in paragraph 7.2. You may determine the lightning transients in terms of the wire bundle current, or the open circuit voltage and the short circuit current appearing at system wiring and equipment interface circuits. Refer to SAE ARP5415 / EUROCAE ED-158 for more detailed guidance. The voltage and current transient waveforms and amplitudes are dependent upon the loop impedances of the system and its interconnecting wiring.
7.7 Establish Equipment Transient Design Levels (ETDLs) and Aircraft Actual Transient Levels (ATLs).
The regulations in §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, AC 20-136C and 29.1316 define requirements in terms of functional effects that are performed by aircraft electrical and electronic systems. From a design point of view, lightning protection for systems is shared between protection incorporated into the aircraft structure and wiring, and protection incorporated into the equipment.
Therefore, requirements for the electrical and electronic system lightning protection can be based on the concept of ETDLs and ATLs.
7.7.1 Determine and specify the ETDLs for the electrical and electronic equipment that make up the systems to be assessed. The ETDLs set qualification test levels for the systems and equipment. They define the voltage and current amplitudes and waveforms that the systems and equipment must withstand without any adverse effects. The ETDLs for a specific system depend on the anticipated system and wiring installation locations on the aircraft, the expected shielding performance of the wire bundles and structure, and the system criticality.
7.7.2 The ATLs are the voltage and current amplitudes and transient waveforms generated on the aircraft wiring when the aircraft is exposed to lightning, as determined by aircraft test, analysis, or similarity. The difference between an ETDL and ATL is the margin.
Figure 1 shows the relationship between the ATL and ETDL. You should evaluate the aircraft, interconnecting wiring, and equipment protection to determine the most effective combination of ATLs and ETDLs that will provide acceptable margin.
Appropriate margins to account for uncertainties in the verification techniques may be required as discussed in paragraph 10.12 of this AC.
Figure 1. Relationships Among Transient Levels 7.7.3 Typically, you specify the ETDLs prior to aircraft certification lightning tests or analyses to determine the aircraft ATLs. Therefore, the expected aircraft transients must be based upon results of lightning tests on existing aircraft, engineering analysis, or AC 20-136C knowledgeable estimates. These expected aircraft lightning transient levels are termed transient control levels (TCL). Specify the TCL’s voltage and current amplitudes and waveforms based upon the expected lightning transients that would be generated on wiring in specific areas of the aircraft. The ATLs should not exceed the aircraft TCLs.
The TCLs for a specific wire bundle depend on the configuration of the aircraft, the wire bundle, and the wire bundle installation. You should design your aircraft lightning protection to meet the specified TCLs.
7.8 Verify Compliance with the Regulations.
7.8.1 You must demonstrate that the systems comply with the applicable requirements of §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, or § 29.1316.
7.8.2 You should demonstrate that the ETDLs exceed the ATLs by the margin established in your certification plan.
7.8.3 Verification may be accomplished by tests, by analysis, or by demonstrating similarity with previously certified aircraft and systems. The certification process for LCL A systems is discussed in paragraph 10. The certification process for LCL B and C systems is discussed in paragraph 11.
7.8.4 Submit your certification plan early in the program to the cognizant certification branch for review. Experience shows, particularly with aircraft using new technology or those that have complex systems, that early agreement on the certification plan benefits both the applicant and the cognizant certification branch. The plan should define acceptable ways to resolve critical issues during the certification process. Analysis and test results during the certification process may warrant modifications in the design or verification methods. When significant changes are necessary, update the certification plan accordingly. The plan may include the items listed in Table 3.
Note: You may refer to paragraph 8.1 for more information.
7.9 Take Corrective Measures.
If tests and analyses show that the system did not meet the pass/fail criteria, review the aircraft, installation, or system design and improve protection against lightning.
7.10 Margins.
Margins account for uncertainty in the verification process. For lightning certification, the margin is the difference between the ETDLs and ATLs. The verification approach should be described in the certification plan with justification for margin, which requires agreement by the respective FAA certification branch. Refer to paragraph 10.12 for additional guidance on margin.
8 LIGHTNING COMPLIANCE.
AC 20-136C Table 3. Items Recommended for a Lightning Certification Plan ITEM DISCUSSION Describe systems’ installation, including unusual or unique features; the system failure condition classifications or initial Description of LCLs; the operational aspects; lightning attachment zones; Systems lightning environment; preliminary estimate of ETDLs and TCLs; and acceptable margins between ETDLs and ATLs.
Describe how to verify compliance. Typically, your verification Description of method includes similarity, analytical procedures, and tests. If Compliance Method using analytical procedures, describe how to verify them. (See paragraph 10.9 of this AC.)
Determine the pass/fail criteria for each system by analyzing how safe the system is; this information may be finalized in the test Acceptance Criteria plan. During this safety analysis, assess the aircraft in its various operational states; account for the failure and disruption modes caused by the effects of lightning.
Plan each test you include as part of your certification process. As an applicant, you can decide if your test plans are separate Test Plans documents or part of the certification plan. Your test plans should state the test sequence.
8 LIGHTNING COMPLIANCE.
8.1 Lightning Certification Plan.
You should establish an overall certification plan to clearly identify and define lightning certification requirements, lightning protection development, and the design, test, and analysis activities intended to be part of the compliance effort. This plan should provide definitions of the aircraft systems, installations, and protective features against which lightning compliance will be assessed. You should discuss the lightning certification plan with, and submit it to, the FAA for approval before initiating lightning compliance activities. If the aircraft, system, or installation design changes after approval, you should submit a revised lightning certification plan to the FAA for approval. The lightning certification plan should include the following: • A lightning certification plan summary; • Identification of the aircraft systems (see section 7.2), with classification based on the safety assessment as it relates to lightning; • The expected lightning environment for the aircraft and installed systems; and • The verification methods, such as test, analysis, or similarity.
AC 20-136C 8.2 Methods of Compliance Verification.
8.2.1 Various methods are available to aid in demonstrating lightning compliance. Paragraphs 10 and 11 of this AC describe methods acceptable to the FAA. Figure 2 outlines the steps to show lightning compliance for LCL A systems. Figure 3 outlines the steps to show lightning compliance for LCL B or C systems. The steps in these figures are not necessarily accomplished sequentially. Wherever a decision point is indicated on these figures, you should complete the steps in that path as described in paragraphs 10 and 11 of this AC.
8.2.2 You may use other lightning compliance techniques to demonstrate system performance in the lightning environment; however, the FAA should approve those techniques before you use them.
8.3 Lightning Verification Test, Analysis, or Similarity Plan.
Test, analysis, and similarity are all acceptable methods for verification. The applicant should choose the most appropriate method for their project. See paragraphs 10 and 11 of this AC, and SAE ARP5415, for additional guidance on selecting the appropriate method. Specific lightning tests, analysis, or similarity plans should be prepared to describe specific verification activities. One or more verification plans may be necessary. For example, there may be several systems or equipment laboratory test plans, an aircraft test plan, and a similarity plan for selected systems on an aircraft.
8.3.1 Test Plan.
A lightning compliance test plan should include the equipment, system, and aircraft test objectives for the acquisition of data to support lightning compliance verification. The plan should provide an overview of the factors being addressed for each system test requirement. The test plan should include: • The purpose of the test; • A description of the aircraft and/or system being tested; • System configuration drawings; • The proposed test setup and methods; • Intended test levels, modes of operation, and monitoring; • Pass/fail criteria; and • The test schedule and test location.
8.3.1.1 The test plan should cover LCL A, B, and C systems and equipment, as appropriate. LCL A systems may need both laboratory integrated systems tests and aircraft tests. LCL B and C systems and equipment need only equipment laboratory testing.
8.3.1.2 The test plan should describe the appropriate aspects of the systems to be tested and their installation. Additionally, the test plan should reflect the AC 20-136C results of any analysis performed in the overall process of the lightning compliance evaluation.
8.3.2 Analysis Plan.
A lightning compliance analysis plan should include the objectives, both at the system and equipment level, for generating data to support lightning compliance verification.
Comprehensive modeling and analysis for voltage and current transients to aircraft systems and structures is an emerging technology; therefore, the analysis plan should be coordinated with the FAA to determine an acceptable scope for the analysis. Aircraft testing may be necessary to support the analysis. The analysis plan should include: • The purpose and scope of the analysis; • A description of the aircraft and/or system addressed by the analysis; • System configuration descriptions; • Proposed analysis methods; • The approach for validating the analysis results; • Pass/fail criteria; and • When data has limited substantiation, a description and justification for margins to account for analysis uncertainty.
8.3.3 Similarity Plan.
A similarity plan should describe the approach undertaken to use the certification data from previously certified systems, equipment, and aircraft in the proposed lightning compliance program. The similarity plan should include: • The purpose and scope of the similarity assessment; • Specific systems addressed by the similarity assessment; • Data used from the previously certified systems, equipment, and aircraft; • Details on differences between the aircraft and system being certified and the similar aircraft and system from which the data will be used; and • A description and justification for margins to account for similarity uncertainty when data has limited substantiation.
8.4 Compliance Reports.
One or more compliance reports may be necessary to document the results of your test, analysis, or similarity assessments. For new or significantly modified aircraft, lightning compliance reports include many system and equipment test reports, aircraft test reports, and lightning vulnerability analysis reports. For these types of lightning certification programs, a compliance summary report may be useful to summarize the results of tests and analysis. For lightning certification programs of relatively simple systems, a single compliance report is adequate.
AC 20-136C 8.4.1 Test Reports.
Comprehensive test reports should be produced at the conclusion of lightning compliance testing. The test reports should include descriptions of the salient aspects of equipment or system performance during the test, details of any area of noncompliance with lightning requirements, actions taken to correct the noncompliance, and any similarity declarations. You should also provide supporting rationale for any deviations from system performance observed during testing.
8.4.2 Analysis Reports.
Analysis reports should describe the details of the analytical model, the methods used to perform the analysis, and the results of the analysis. If applicable, these reports should identify any modeling uncertainty and verify that the margins established in the analysis plan were met.
8.4.3 Similarity Reports.
Similarity reports should document the significant aircraft, system, equipment, and installation features common between the aircraft or system that is the subject of the similarity analysis and the aircraft or system that previously was certified for lightning compliance. You should identify all significant differences encountered, along with an assessment of the impact of these differences on lightning compliance. If applicable, these reports should identify any similarity uncertainty and verify that the margins established in the similarity plan were met.
8.5 Applicability of the Changed Product Rule.
The provisions of 14 CFR 21.101, commonly referred to as the Changed Product Rule, require a proposed change to a type certificate to comply with the latest part 23, 25, 27, or part 29 airworthiness requirements in effect on the date of the application for change.
Applicable exceptions include changes determined not to be significant, areas not affected by the design change, or when the FAA determines compliance would be impractical or not contribute substantially to the level of safety of the product. For proposed installations of electrical and electronic systems with catastrophic failure conditions, the airplane certification basis must include §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, or § 29.1316.
8.5.1 Significant Change per § 21.101.
8.5.1.1 If the existing certification basis includes §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, or § 29.1316, you must comply with paragraphs (a) and (b) of the applicable part 23, 25, 27, or part 29 lightning regulations (latest amendment).
8.5.1.2 If the airplane certification basis does not include §§ 23.1306 (amendment 23-61), 23.2515, 25.1316, 27.1316, or § 29.1316, you must demonstrate compliance with paragraphs (a) and (b) of the applicable part 23, 25, 27, or part 29 lightning regulation (latest amendment), unless an exception to paragraph (b) of the specific lightning regulation is granted in § 21.101.
9 EFFECTS OF TRANSIENTS.
AC 20-136C 8.5.2 Not A Significant Change Exception per § 21.101.
8.5.2.1 If the existing certification basis includes the §§ 23.1306 (amendment 23- 61), 23.2515, 25.1316, 27.1316, or § 29.1316, you must comply with the applicable part 23, 25, 27, or part 29 lightning regulations.
8.5.2.2 For proposed changes to part 25 airplanes originally certified under amendment 25-80 or equivalent lightning special condition, you may propose lightning compliance at amendment 25-80 or, if applicable, part 25 lightning special condition.
8.5.2.3 If the airplane certification basis does not include §§ 23.1306 (amendment 23-61) 23.2515, 25.1316, 27.1316, or § 29.1316, you must demonstrate compliance with paragraph (a) of the applicable part 23, 25, 27, or part 29 lightning regulation (amendment as agreed by the FAA) for electrical and electronic systems with catastrophic failure conditions; compliance with paragraph (b) may be demonstrated, but is not required for electrical and electronic systems with hazardous or major failure conditions.
Note: Applicants should consider whether demonstrated compliance with paragraph (b) of the applicable lightning regulation is required for certification by other civil aviation authorities even if not required by the FAA.
9 EFFECTS OF TRANSIENTS.
Lightning causes voltage and current transients to appear on equipment circuits.
Equipment circuit impedances and configurations will determine whether lightning transients are primarily voltage or current. These transient voltages and currents can degrade system performance permanently or temporarily. The two primary types of degradation are component damage and system functional upset.
9.1 Component Damage .
Component damage is a permanent condition in which transients alter the electrical characteristics of a circuit. Examples of devices that may be susceptible to component damage include— • Active electronic devices, especially high frequency transistors, integrated circuits, microwave diodes, and power supply components; • Passive electrical and electronic components, especially those of very low power or voltage rating; • Electro-explosive devices, such as squibs and detonators; • Electromechanical devices, such as indicators, actuators, relays, and motors; and • Insulating materials (for example, insulating materials in printed circuit boards and connectors) and electrical connections that can burn or melt.
10 STEPS TO LCL A SYSTEM LIGHTNING COMPLIANCE.
AC 20-136C 9.2 System Functional Upset .
9.2.1 Functional upset is mainly a system problem caused by electrical transients. It may permanently or momentarily upset a signal, circuit, or system component, which can adversely affect system performance enough to compromise flight safety. A functional upset is a change in digital or analog state that may or may not require manual reset. In general, functional upset depends on circuit design and operating voltages, signal characteristics and timing, and system and software configuration.
9.2.2 Systems or devices that may be susceptible to functional upset include computers and data/signal processing systems, electronic engine and flight controls, and power generating and distribution systems.
10 STEPS TO LCL A SYSTEM LIGHTNING COMPLIANCE.
Steps 1 through 13 listed below in this section may be used to demonstrate LCL A system compliance with §§ 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a). Figure 2 also depicts these compliance steps. Airplanes certified under part 23 may use steps 1 through 13 to demonstrate compliance with §§ 23.1306(a) (amendment 23-61) or § 23.2515(a), but acceptable compliance for LCL A systems on level 1, 2, and 3 airplanes may also be shown using the method in paragraph 10.14 below.
10.1 Step 1 – Identify LCL A Systems.
10.1.1 Identify your LCL A systems as described in paragraph 7.2. Define the detailed system performance pass/fail criteria. A certification branch should concur with this criteria before you begin testing or analyzing your LCL A system. Identify specific equipment, components, sensors, power systems, and wiring associated with each LCL A system in order to perform the ETDL verification discussed in paragraphs 10.5 and 10.6.
10.1.2 When demonstrating compliance with §§ 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a), the LCL A electrical and electronic system includes all electrical and electronic equipment, components, and electrical interconnections required to perform the intended functions whose failure is catastrophic, i.e. would prevent continued safe flight and landing. This electrical and electronic system must also automatically recover (or manually for § 23.2515) normal operation of the Level A functions in a timely manner to comply with paragraph (a)(2) of these regulations.
10.1.2.1 The LCL A electrical and electronic system is not required to include— • equipment, components, and electrical interconnections required only for non-normal situations; or • equipment, components, and electrical interconnections required only for dispatch under a minimum equipment list.
AC 20-136C Figure 2. Typical Compliance Process for LCL A Systems AC 20-136C 10.1.3 Some systems include mechanical, hydraulic, and/or pneumatic channels as well as electrical and electronic channels that perform functions whose failure is catastrophic (would prevent continued safe flight and landing). The lightning safety assessment for §§ 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a) only applies to functions performed by electrical and electronic systems. However, you should verify the assumptions made for mechanical, hydraulic, and/or pneumatic channel(s) and consider any influence on whether the electrical/electronic or mechanical channel is in fact the active channel during normal operation. The lightning safety assessment should consider electrical or electronic failures that would adversely affect the function of the mechanical, hydraulic, and/or pneumatic channels. If electrical or electronic equipment, components, and electrical interconnections are used to assist, augment, or monitor for control loop feedback the mechanical, hydraulic, and/or pneumatic channels in performing functions with failures that would prevent continued safe flight and landing during normal operation, then the electrical and electronic channel(s) must comply with §§ 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a).
10.1.4 Sections 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), and 29.1316(a) do not require you to assume preexisting failure conditions when classifying the functional failure conditions and the scope of the LCL A systems. You should consider total losses, partial losses, and malfunctions of the systems, including hazardously misleading information presented to the flightcrew during and after the aircraft is exposed to lightning.
10.1.5 Sections 23.1306(a)(2) (amendment 23-61), 25.1316(a)(2), 27.1316(a)(2), and 29.1316(a)(2) require that the LCL A systems automatically recover normal operation of the Level A function in a timely manner after exposure to lightning. Section 23.2515(a)(2) requires that the LCL A systems recover normal operation of the Level A function in a timely manner after exposure to lightning unless the recovery conflicts with other operational or functional requirements of the system. Automatic or manual recovery applies to all redundant active channels of the LCL A system required for normal operation. The exception for recovery conflicts should be based on aircraft operational or functional requirements independent of lightning exposure. The exception should not be a mitigation for LCL A system effects observed after exposure to lightning.
10.1.6 Appendix C, Examples of Lightning Safety Assessment Considerations - LCL A Systems on Transport Airplanes , provides examples of system scope for transport category airplanes based on the guidance above. The lightning safety assessment examples for LCL A systems contained in appendix C may also be applicable to normal category airplanes and rotorcraft.
10.2 Step 2 – Define Aircraft and System Lightning Protection Features .
Define the lightning protection features to be incorporated into the aircraft and system designs based on the lightning environments that are applicable to your aircraft and its LCL A systems. Equipment, system, and aircraft lightning protection design may occur before you perform aircraft-level tests and before you determine the actual internal AC 20-136C lightning environment. Therefore, you should base the equipment, system, and aircraft lightning protection design on an estimate of the expected internal lightning environment.
10.3 Step 3 – Establish System ETDLs.
Establish the aircraft systems ETDLs from an evaluation of expected lightning transient amplitudes and waveforms for the system installation, structure, and wiring configuration on a specific aircraft. You should establish ETDLs that exceed the ATLs by an acceptable margin as discussed in paragraph 10.12 of this AC. In general, the ETDLs for equipment in a complex system will not be the same for all wire bundles connecting them to other equipment in the system. You may use the results of lightning tests on existing similar aircraft, engineering analyses, or knowledgeable estimates to establish appropriate system ETDLs. While specific aircraft configurations and system installations may lead to ETDLs that have amplitudes and waveforms different than those defined in RTCA/DO-160 section 22, ETDLs are often specified using the information from section 22. The ETDLs must exceed the ATLs by an acceptable margin.
10.4 Step 4 – Select the ETDL Verification Method.
Determine whether to perform system qualification tests on the LCL A system or whether to base the system verification on previous system qualification tests performed on a similar system.
10.5 Step 5 – Verify System ETDLs Using System Qualification Tests .
10.5.1 Lightning-induced transient susceptibility laboratory tests (damage tolerance and functional upset) of RTCA/DO-160, section 22, may be used to build confidence in the equipment’s lightning immunity before conducting laboratory integrated system tests.
Equipment tests may be used to augment the integrated system lightning tests where appropriate. For equipment whose lightning immunity is evaluated as part of the integrated system-level qualification tests, the individual equipment’s lightning testing described in this step is optional.
10.5.2 For the integrated system test of an engine control system, you should also refer to the guidance provided in AC 33.28-3. When the engine certification occurs prior to a known specific aircraft installation, the engine manufacturer should make reasonable installation assumptions for engine-to-aircraft electrical interfaces. The engine installation manual or operating instructions should specify wire characteristics, shielding, connector types, shield terminations, and electrical bonding features for lightning protection that are required when the engine is installed. Systems that are part of the engine certification must be installed in accordance with the engine manufacturer’s requirements. The applicant should perform the required lightning tests with the same wiring, shielding, and electrical bonding configuration as specified in the engine installation manual or operating instructions.
10.5.3 You should identify the equipment, components, sensors, power systems, and wiring associated with the LCL A system undergoing ETDL verification tests, specifically AC 20-136C considering the system functions whose failures are catastrophic. For complex LCL A systems, the system configuration may include redundant equipment, multiple power sources, multiple sensors and actuators, and complex wire bundles. Define the system configuration (including airborne electronic hardware and software) used for the ETDL verification tests. You should obtain the cognizant certification branch’s approval of your system configuration for ETDL verification tests.
10.5.4 If the LCL A system consists of multiple similar channels, you may propose using one or more channels in the laboratory test setup for the integrated system instead of using all similar channels. You should demonstrate that the laboratory test setup adequately performs the intended functions to demonstrate compliance with §§ 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a). Ensure that the laboratory test setup represents and monitors any cross-channel interactions, such as cross-channel data links, redundancy management, and system health monitoring.
Note: If pin programming or software is used to identify or configure equipment of similar channels, you should assess whether these differences impact the functions performed.
10.5.5 You should verify the ETDLs using single stroke, multiple stroke, and multiple burst tests on the system wire bundles. Use waveform sets and test levels for the defined ETDLs. Demonstrate that the system operates within the defined pass/fail criteria during these tests. No equipment damage should occur during these system tests or during single stroke pin injection tests using the defined ETDLs. RTCA/DO-160, section 22, provides acceptable test procedures and waveform set definitions. In addition, SAE ARP5416 provides acceptable test methods for complex and integrated systems.
10.5.6 You should evaluate any system effects observed during the qualification tests to ensure they do not adversely affect the system’s continued performance. The LCL A system performance should be evaluated for functions of which failures or malfunctions are catastrophic (would prevent the continued safe flight and landing of the aircraft). Other functions performed by the system of which failures or malfunctions are hazardous or major (would reduce the capability of the aircraft or the ability of the flightcrew to respond to an adverse operating condition) should be evaluated using the guidance in paragraph 11. You should obtain the cognizant certification branch’s approval of your evaluation.
10.6 Step 6 – Verify System ETDLs Using Existing System Data (Similarity).
10.6.1 You may base your ETDL verification on similarity to previously-certified systems without performing more tests. You may do this when: • There are only minor differences between the previously certified system and installation, and the system and installation to be certified; • There are no unresolved in-service system problems related to lightning strikes on the previously certified system; and AC 20-136C • The previously certified system ETDLs were verified by qualification tests.
10.6.2 To use similarity to previously certified systems, you should assess differences between the previously certified system and installation, and the system and installation to be certified that can adversely affect the system susceptibility. The assessment should cover— • System interface circuits; • Wire size, routing, arrangement (parallel or twisted wires), connector types, wire shields, and shield terminations; • Lightning protection devices such as transient suppressors and lightning arrestors; • Grounding and bonding; and • System software and airborne electronic hardware.
10.6.3 If you are unsure how the differences will affect the systems and installations, you should perform more tests and analyses to resolve the open issues.
10.6.4 You should assess every system, even if it uses equipment and installation techniques that have previous certification approval.
10.6.5 You should not use similarity for a new aircraft design with new systems.
10.7 Step 7 – Select Aircraft Verification Method.
10.7.1 LCL A systems should include an aircraft assessment to support compliance with §§ 23.1306(a) (amendment 23-61), 23.2515(a), 25.1316(a), 27.1316(a), or § 29.1316(a).
The aircraft assessment should determine the ATLs where the LCL A systems are installed in the aircraft. You should choose whether you will use either aircraft tests or previous data from similar aircraft types (similarity). For LCL A display systems only, you may select the ETDLs as proposed in Table 4.
10.7.2 If analysis is used to determine the ATLs, you should provide test data to support this analysis. Any analysis results should consider the quality and accuracy of the analysis.
Comprehensive testing, including aircraft level testing, may be required to support the analysis.
10.8 Step 8 – Determine ATLs Using Aircraft Tests.
See SAE ARP5415, User’s Manual for Certification of Aircraft Electrical/Electronic Systems for the Indirect Effects of Lightning , and SAE ARP5416 for guidance on how to determine the ATLs.
10.9 Step 9 – Determine ATLs Using Analysis.
See SAE ARP5415 for guidance on how to analyze aircraft to determine the ATLs.
Acceptance of the analysis method you choose depends on the accuracy of the method. You should confirm your analysis method accuracy using experimental AC 20-136C data and discuss your planned analysis approach with the cognizant certification branch.
10.10 Step 10 – Determine ATLs Using Similarity.
10.10.1 You cannot use similarity as verification for a new aircraft design with new systems.
10.10.2 You may use similarity to determine the ATLs when there are: • Only minor differences between the previously certified aircraft and system installation, and the aircraft and system installation to be certified; and • There is no unresolved in-service history of problems related to lightning strikes to the previously certified aircraft.
10.10.3 If significant differences are found that will affect the aircraft ATLs, you should perform more tests and analyses to resolve the open issues.
10.10.4 To use similarity, you should assess the aircraft, wiring, and system installation differences that can adversely affect the system susceptibility. When assessing a new installation, consider differences affecting the internal lightning environment of the aircraft and its effects on the system. The assessment should cover: • Aircraft type, equipment locations, airframe construction, structural materials, and apertures that could affect attenuation of the external lightning environment; • System wiring size, length, and routing; wire types (whether parallel or twisted wires), connectors, wire shields, and shield terminations; • Lightning protection devices such as transient suppressors and lightning arrestors; and • Grounding and bonding.
10.11 Step 11 – Determine Transient Levels Using RTCA/DO-160 Section 22 Guidance for LCL A Displays Only.
10.11.1 You may select ETDLs for your LCL A display system using guidance in this section, without specific aircraft test or analysis. LCL A displays involve functions for which the pilot will be in the loop through pilot/system information exchange. LCL A display systems typically include the displays; symbol generators; data concentrators; sensors (such as attitude, air data, and heading sensors); interconnecting wiring; and associated control panels.
10.11.2 This approach should not be used for other LCL A systems, such as control systems, because failures and malfunctions of those systems can more directly and abruptly contribute to a catastrophic failure event than display system failures and malfunctions.
Therefore, other LCL A systems require a more rigorous lightning transient compliance verification program.
AC 20-136C 10.11.3 You should use the information in Table 4 to evaluate your aircraft and system installation features to select appropriate ETDLs for your system. Table 4 defines test levels for ETDLs, based on RTCA/DO-160 section 22, Tables 22-2 and 22-3. Provide the cognizant certification branch with a description of your aircraft and display system installation features and compare these to the information in Table 4 to substantiate the ETDL selected for your aircraft and LCL A display system installation. When selecting ETDLs using guidance provided in Table 4, an acceptable margin between anticipated ATLs for display system installations is incorporated in the selected ETDLs.
AC 20-136C Table 4. Equipment Transient Design Level - LCL A Displays RTCA/ DO-160, DISPLAY SYSTEM INSTALLATION LOCATION SECTION 22 LEVEL Use this level when the equipment under consideration, its associated wire bundles, or other components connected by wiring to the equipment, are in aircraft areas exposed to very severe lightning transients. These areas are: • Areas with composite materials whose shielding is not very effective; • Areas where there is no guarantee of structural bonding; and Level 5 • Other open areas where there is little shielding.
You can also use this level to cover a broad range of installations.
You may need higher ETDLs when there are high current density regions on mixed conductivity structures (such as wing tips, engine nacelle fin, and so on) because the system wiring may divert some of the lightning current. If you are the system designer, apply measures to reduce the need for higher ETDLs.
Use this level when the equipment under consideration, its associated wire bundles, or other components connected by wiring to the equipment, are in aircraft areas exposed to severe lightning Level 4 transients. We define these areas as outside the fuselage (such as wings, fairings, wheel wells, pylons, control surfaces, and so on).
Use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment, are entirely in aircraft areas with moderate lightning transients. We define these areas as the inside metal aircraft structure or composite aircraft structure whose shielding is as effective as metal aircraft structure, without measures to reduce lightning coupling to wires. Examples of such areas are avionics bays not enclosed by bulkheads, cockpit areas, and locations with large apertures (that is, doors without electromagnetic interference Level 3 (EMI) gaskets, windows, access panels, and so on).
Current-carrying conductors in these areas (such as hydraulic tubing, control cables, wire bundles, metal wire trays, and so on) are not necessarily electrically grounded at bulkheads. When few wires exit the areas, either use a higher level (that is, Level 4 or 5 ) for these wires or offer more protection for these wires.
Use this level when the equipment under consideration, its associated wire bundles, and other components connected by wiring to the equipment, are entirely in partially protected areas. We define these areas as the inside of a metallic or composite aircraft structure whose shielding is as effective as metal aircraft structure, if you take measures to reduce the lightning coupling to wires.
Wire bundles in these areas pass through bulkheads and have shields that end at the bulkhead Level 2 connector. When a few wires exit these areas, use either a higher level (that is, Level 3 or 4 ) or provide more protection for these wires. Install wire bundles close to the ground plane, to take advantage of other inherent shielding from metallic structures. Current-carrying conductors (such as hydraulic tubing, control cables, metal wire trays, and so on) are electrically grounded at all bulkheads.
Use this level when the equipment under consideration, its associated wire bundles, and other Level 1 components connected by wiring to the equipment are entirely in well-protected aircraft areas. We define these areas as electromagnetically enclosed.
AC 20-136C 10.12 Step 12 – Verify Compliance with the Requirements.
You should compare the verified system ETDLs with the aircraft ATLs and determine if an acceptable margin exists between the ETDLs and ATLs. Margins account for uncertainty in the verification method. As confidence in the verification method increases, the margin can decrease. An ETDL exceeding the ATL by a factor of two is an acceptable margin for LCL A systems if this margin is verified by aircraft test or by analysis supported by aircraft tests. For LCL A display systems where the ETDLs are determined using guidance provided in Table 4, an acceptable margin is already incorporated in the selected ETDLs. For other verification methods, the margin should be agreed upon with the cognizant certification branch.
10.13 Step 13 – Take Corrective Measures.
10.13.1 When your system fails to meet the certification requirements, corrective actions should be selected. The changes or modifications you make to the aircraft, system installation or the equipment may require more testing and analysis.
10.13.2 To meet the certification requirements, you may need to repeat system qualification testing, or aircraft testing and analysis (in whole or in part). You also may need to modify the system or installation to get certification. You should review these changes or modifications with the cognizant certification branch to determine if they are significant. If these changes or modifications are significant, update your lightning certification plan accordingly. The updated certification plan should be resubmitted to the certification branch for review.
10.14 Compliance for LCL A Systems on Level 1, 2, 3, and 4 Airplanes Certified Under Part 23.
10.14.1 Airplane certification levels 1, 2, 3, and 4 are defined in § 23.2005 (established by amendment 23-64). Airplane certification classes I, II, III, and IV are defined in AC 23.1309-1.
10.14.2 The following test levels may be used for LCL A integrated systems on normal category level 1, 2, 3, and 4 airplanes (certification class I, II, III, and IV). Equipment testing may be acceptable if you show that equipment in the LCL A systems can be operated and tested independently, as well as can be effectively monitored to verify no adverse effects to the system and function. Otherwise, you should perform integrated system lightning tests as discussed in step 5 (refer to paragraph 10.5). The system should comprise all equipment and wiring needed to perform the function. One or more of these systems with redundant channels may perform the same function. When there are multiple systems with redundant channels performing the same function, it is only necessary for one of the multiple systems’ redundant channels to meet the requirements in § 23.1306(a) (amendment 23-61) or § 23.2515(a).
10.14.3 Level 1 airplanes certificated under part 23 meet the same requirements for lightning compliance as shown in paragraph 10.14.5 below. Level 2 and 3 airplanes certificated under part 23 meet the requirements for lightning as shown in paragraph 10.14.6 below.
AC 20-136C Level 4 airplanes certified under part 23 meet the requirements for lightning as shown in paragraph 10.5.
10.14.4 The applicant may also use a means of compliance, which may include consensus standards, accepted by the Administrator under § 23.2010.
Note: FAA accepted means of compliance based on ASTM consensus standards for part 23 airplanes, including any required changes for acceptance, are available at the FAA Small Airplanes Design Approvals website (reference “Industry Standards”).
10.14.5 For level 1 airplane LCL A systems, you may perform lightning induced transient tests using RTCA/DO-160, section 22. Test categories include pin injection and cable bundle evaluations with single stroke, multiple stroke, and multiple burst waveform sets: • Primary aluminum structure - refer to RTCA/DO-160G, category A2J2L2 or RTCA/DO-160D, change 3, E, F, category B2K22.
• Primary carbon fiber or fiberglass structure - refer to RTCA/DO-160G, category B2K2L2 or RTCA/DO-160D, change 3, E, F, category B2K22.
10.14.6 For level 2 and 3 airplane LCL A systems, you may perform lightning induced transient tests using RTCA/DO-160, section 22. Test categories include pin injection and cable bundle evaluations with single stroke, multiple stroke, and multiple burst waveform sets: • Primary aluminum structure - refer to RTCA/DO-160G, category A3J3L3 or RTCA/DO-160D, change 3, E, F, category A3J33.
• Primary carbon fiber or fiberglass structure - refer to RTCA/DO-160G, category B3K3L3 or RTCA/DO-160D, change 3, E, F, category B3K33.
10.14.7 The electronic engine control and ignition systems on part 23 airplanes must be classified as LCL A [lightning effects that result in loss of thrust (or power) control should be considered catastrophic]. You may design, test, and install the engine control system using the guidance provided in AC 33.28-3. Develop and install appropriate electrical bonding features for the engine control system using the guidance in AC 33.28-3.
10.14.8 The electronic propeller control system on part 23 airplanes must be classified as LCL A [lightning effects that result in loss of power control should be considered catastrophic]. You may design, test, and install the propeller system using the guidance provided in AC 35.23-1. Develop and install appropriate electrical bonding features for the propeller control system using the guidance in AC 35.23-1.
10.14.9 The airframe should incorporate low impedance electrical conductors for lightning current to flow through the airplane. The low impedance conductors should be incorporated into the basic structure of the airplane.
• For airplanes with primarily aluminum structure, the aluminum skin provides a low impedance electrical conductor. Standard rivets and bolts provide adequate
11 STEPS TO lcl B AND C SYSTEM LIGHTNING COMPLIANCE.
AC 20-136C electrical bonding between permanent structural joints. Electrical bonding straps or jumpers should be installed on moving parts or for removable panels or parts.
• For airplanes with primarily carbon fiber or fiberglass structure, you should incorporate metal mesh, metal foil, or expanded metal foil onto the external surfaces of the airplane composite structure. This mesh or foil should be joined together electrically and provide a continuous electrical conductor between the extremities of the airplane. Use of metallic components internal to the structure of the airplane may also be used to provide similar shielding for equipment and its wiring.
• For airplanes constructed of tube and fabric, the tube skeleton may be considered as the low impedance electrical path through the airplane. Electrical bonding may also be achieved using bonding straps or jumpers where required to electrically bond other metallic sub-structure that might be relied upon to provide bonding for equipment.
10.14.10 Electrical bonding specifications and verifications should be developed and implemented on the production drawings and instructions for continued airworthiness.
11 STEPS TO LCL B AND C SYSTEM LIGHTNING COMPLIANCE.
Steps 1 through 8 listed below in this section may be used to demonstrate compliance for LCL B and C systems with §§ 23.1306(b) (amendment 23-61), 23.2515(b), 25.1316(b), 27.1316(b), or § 29.1316(b). Section 23.2515(b) only applies to LCL B systems with hazardous failure conditions (reference Table 2).
11.1 Step 1 – Identify LCL B and C Systems .
11.1.1 Identify your LCL B and C systems as described in paragraphs 7.2 and 7.3.
11.1.2 Define the detailed system performance pass/fail criteria. You should get certification branch concurrence on this criterion before you start testing or analyzing your LCL B and C systems.
11.1.3 Figure 3 illustrates a process you can use to demonstrate that your LCL B and C systems comply with 14 CFR requirements.
AC 20-136C Figure 3. Typical Compliance Process for LCL B and C Systems AC 20-136C 11.2 Step 2 – Define System Lightning Protection Features .
Define the lightning protection features to be incorporated into the system designs, based on the lightning environments that are applicable to LCL B and C systems.
Equipment and system lightning protection design may occur before you perform aircraft-level tests and before you determine the actual internal lightning environment.
Therefore, you should base the equipment and system lightning protection design on an estimate of the expected internal lightning environment.
11.3 Step 3 – Establish ETDLs .
11.3.1 You may use the ATLs determined during aircraft tests or analyses performed for LCL A systems to establish appropriate ETDLs for LCL B and C systems.
11.3.2 Alternatively, you may use the definitions in RTCA/DO-160, section 22 to select appropriate ETDLs for your LCL B and C systems. The following should be considered when selecting an appropriate level: • Use RTCA/DO-160, section 22, level 3 for most LCL B systems.
• For LCL B systems and associated wiring installed in aircraft areas with more severe lightning transients, use RTCA/DO-160, section 22, level 4 or 5 as appropriate to the environment. Examples of aircraft areas with more severe lightning transients are those external to the fuselage, areas with composite structures showing poor shielding effectiveness, and other open areas.
• Use RTCA/DO-160, section 22, level 2 for most LCL C systems.
• For LCL C systems installed in aircraft areas with more severe lightning transients, use RTCA/DO-160, section 22, level 3. Examples of aircraft areas with more severe lightning transients are those external to the fuselage, areas with composite structures showing poor shielding effectiveness, and other open areas.
• Provide the cognizant certification branch with a description of your aircraft and system installation features to substantiate the RTCA/DO-160, section 22 levels selected for your system.
11.4 Step 4 – Select the ETDL Verification Method .
Determine whether to perform equipment lightning tests on LCL B and C systems, or whether to base compliance on previous equipment qualification tests performed on a similar system.
11.5 Step 5 – Verify System ETDLs Using Equipment Qualification Tests .
11.5.1 You should perform equipment qualification tests using the selected test levels and single stroke, multiple stroke, and multiple burst waveform sets. Demonstrate that the equipment operates within the defined pass/fail criteria during these tests. No equipment damage should occur during these equipment qualification tests or during single stroke pin injection tests using the defined ETDLs. RTCA/DO-160, section 22, provides acceptable test procedures and waveform set definitions.
AC 20-136C 11.5.2 You should evaluate any equipment effects observed during the qualification tests to ensure these do not adversely affect the system’s continued performance. You should obtain the cognizant certification branch’s approval of your evaluation.
11.5.3 Multiple stroke and multiple burst testing is not required if an analysis shows that the equipment is not susceptible to upset, or that the equipment may be susceptible to upset, but a reset capability exists so the system recovers in a timely manner.
11.6 Step 6 – Verify System ETDLs Using Existing Equipment Data (Similarity) .
11.6.1 You may verify ETDLs by similarity to previously certified systems without performing more tests. You may do this when: • There are only minor differences between the previously certified system and installation, and the system and installation to be certified; • There are no unresolved in-service system problems related to lightning strikes on the previously certified system; and • The previously certified system ETDLs were verified by qualification tests.
11.6.2 The assessment should cover: • Equipment interface circuits; • Wire size, routing, arrangement (parallel or twisted wires), connector types, wire shields, and shield terminations; • Lightning protection devices such as transient suppressors and lightning arrestors; • Grounding and bonding; and • Equipment software, firmware, and hardware.
11.6.3 If significant differences are found that will affect the systems and installations, you should perform more tests and analyses to resolve the open issues.
11.7 Step 7 – Verify Compliance with the Requirements .
You should demonstrate that the LCL B and C systems meet their defined acceptance criteria during the qualification tests at the selected system ETDLs.
11.8 Step 8 – Take Corrective Measures .
When your system fails to meet the certification requirements, you should decide on corrective actions. If you change or modify the system or installation, you may need to repeat equipment qualification testing. You should review these changes or modifications with the cognizant certification branch to determine if they are significant. If these changes or modifications are significant, update your lightning certification plan accordingly. The updated certification plan should be resubmitted to the certification branch for review.
12 MAINTENANCE, PROTECTION ASSURANCE, AND MODIFICATIONS.
AC 20-136C 12 MAINTENANCE, PROTECTION ASSURANCE, AND MODIFICATIONS.
12.1 The minimum maintenance necessary to support lightning certification must be identified in the instructions for continued airworthiness (ICA) as required by §§ 23.1529, 25.1529, 25.1729, 26.11, 27.1529, or § 29.1529.
12.2 Dedicated devices or specific features may be needed to provide lightning protection for an equipment or system installation. You should define appropriate maintenance procedures for these devices and features to ensure in-service protection integrity. The maintenance procedures should address the effects of corrosion, fretting, flexing cycles, or other causes that could degrade these lightning protection devices. Whenever applicable, you should identify specific replacement times of these devices and features.
12.3 A lightning protection assurance program may be necessary to verify that the maintenance procedures are adequate. This assurance program may propose a surveillance program based on a sampling of the fleet for monitoring the effectiveness of the protection features and/or maintenance procedures. See SAE ARP5415 for more information on these topics.
12.4 Aircraft or system modifications should be assessed for the impact any changes will have on the lightning protection. You should base this assessment on analysis and/or measurement.
AC 20-136C Appendix A Appendix A. Definitions The following definitions apply to this AC: Adverse Effect A response that results in an unexpected and unacceptable operation of an aircraft system, or in an unexpected and unacceptable operation of a function performed by the system.
Actual Transient Level (ATL) The level of transient voltage or current that appears at the equipment interface circuits because of the external environment. This level may be less than or equal to the transient control level but should not be greater.
Aperture An electromagnetically transparent opening.
Attachment Point A point where the lightning flash contacts the aircraft.
Automatically Recover To return to normal operations without flightcrew action.
Channel A subset of a system consisting of equipment, components, and interconnections, which performs an aircraft function provided by the system. A system could be composed of redundant similar or dissimilar channels in order to maintain the function at the aircraft level in case of failure on one or several channels.
Component Damage A condition in which transients permanently alter the electrical characteristics of a circuit. Because of this, the component can no longer perform to its specifications.
Continued Safe Flight and Landing Capability for continued controlled flight and landing at a suitable location, possibly using emergency procedures, but without requiring exceptional pilot skill or strength. Some aircraft damage may occur as a result of the failure condition during flight or upon landing.
Direct Effects A-1 AC 20-136C Appendix A Physical damage to the aircraft or electrical and electronic systems. Direct attachment of lightning to the system’s hardware or components causes the damage. Examples of direct effects include tearing, bending, burning, vaporization, or blasting of aircraft surfaces and structures, and damage to electrical and electronic systems.
Electrical and Electronic System An electrical and electronic system means all electrical and electronic equipment, components, and the electrical interconnections that are required to perform a particular function.
Electrical Interface A location on electrical and electronic equipment where an electrical connection is established. The electrical interface may include individual wires or wire bundles which connect the equipment.
Equipment Component of an electrical or electronic system with interconnecting electrical conductors.
Equipment Transient Design Level (ETDL) The peak voltage and current amplitudes and transient waveforms that the equipment should withstand without any adverse effects during qualification testing.
External Environment The natural lightning environment, outside the aircraft, for design and certification purposes. See AC 20-155, which references documents that provide additional guidance on aircraft lightning environment and related waveforms.
Function The specific action of a system, equipment, and flight crew performance aboard the aircraft that, by itself, provides a completely recognizable operational capability. For example, “display aircraft heading to the pilots” is a function. One or more systems may perform a specific function, or one system may perform multiple functions.
Immunity Capacity of a system or piece of equipment to continue to perform its intended function, in an acceptable manner, in the presence of lightning currents.
Indirect Effects Electrical transients induced by lightning in aircraft electrical or electronic circuits.
A-2 AC 20-136C Appendix A Internal Environment The potential fields and structural voltages inside the aircraft produced by the external environment.
Lightning Flash The total lightning event. It may occur in a cloud, among clouds, or between a cloud and the ground.
It can consist of one or more return strokes, plus intermediate or continuing currents.
Lightning Strike Attachment of the lightning flash to the aircraft.
Lightning Strike Zones Aircraft surface areas and structures that are susceptible to lightning attachment, dwell time, and current conduction. See AC 20-155, which references documents that provide additional guidance on aircraft lightning zoning.
Lightning Stroke (Return Stroke) A lightning current surge that occurs when the lightning leader (the initial current charge) makes contact with the ground or another charge center. A charge center is an area of high potential of opposite charge.
Margin The difference between the equipment transient design levels and the actual transient level.
Multiple Burst A randomly spaced series of bursts of short duration, low amplitude current pulses, with each pulse characterized by rapidly changing currents. These bursts may result as the lightning leader progresses or branches and are associated with the cloud-to-cloud and intra-cloud flashes. The multiple bursts appear most intense when the initial leader attaches to the aircraft. See AC 20-155.
Multiple Stroke Two or more lightning return strokes during a single lightning flash. See AC 20-155.
Non-Normal Situation An event, condition, or situation that requires non-normal, abnormal, emergency, or unusual procedures or configurations for operating the aircraft.
A-3 AC 20-136C Appendix A Normal Operation The status where the system is performing its intended function.
Note: When addressing compliance with §§ 23.1306(a)(2) (amendment 23-61), 23.2515(a)(2), 25.1316(a)(2), 27.1316(a)(2), or § 29.1316(a)(2), the function whose failure is catastrophic (would prevent the continued safe flight and landing) should be in the same undisturbed state as before exposure to the lightning environment.
Timely Manner The maximum allowable period for a system to reconfigure safely after a disruption.
Note : Timely recovery has been introduced to account for this period. The meaning of ‘in a timely manner’ depends on the function performed by the system being evaluated, the specific system design, the interactions between the system and the flight crew, and the phase of flight. The definition of ‘in a timely manner’ should be determined for each system and for the specific functions performed by the system. The applicable definition may be included in the lightning certification plan.
Transient Control Level (TCL) The maximum allowable level of transients that appear at the equipment interface circuits because of the defined external environment.
Upset Impairment of system operation, either permanent or momentary. For example, a change of digital or analog state that may or may not require a manual reset.
A-4 AC 20-136C Appendix B Appendix B. Acronyms The following acronyms are referenced in this AC: 14 CFR Title 14 of the Code of Federal Regulations AC Advisory Circular ARP Aerospace Recommended Practice ATL Actual Transient Level EASA European Union Aviation Safety Agency ETDL Equipment Transient Design Level EUROCAE European Organization for Civil Aviation Equipment FAA Federal Aviation Administration HIRF High-intensity Radiated Fields ICA Instructions for Continued Airworthiness IFR Instrument Flight Rules LCL Lightning Certification Level SAE Society of Automotive Engineers TCL Transient Control Level VFR Visual Flight Rule B-1 AC 20-136C Appendix C Appendix C. Examples of Lightning Safety Assessment Considerations - LCL A Systems on Transport Category Airplanes C.1 EXAMPLES OF LIGHTNING SAFETY ASSESSMENT CONSIDERATIONS C.1.1 This appendix contains examples of lightning safety assessment considerations for LCL A systems on transport category airplanes. These lightning safety assessment considerations for LCL A systems may be applicable to normal category airplanes and rotorcraft. Establishing appropriate pass-fail criteria for complying with § 25.1316(a) should be achieved through a comprehensive review of the system design using an acceptable lightning functional hazard assessment process to determine the system’s LCL. The following paragraphs summarize approaches whereby pass-fail criteria for compliance with § 25.1316(a) may depend on the specific system architecture attributes (for example, system with similar redundant channels, dissimilar redundant channels, combination of similar and dissimilar redundant channels).
C.1.2 For evaluation of the examples in paragraph C.1.3 of this appendix, consider the specific system architecture attributes. Systems are typically categorized with the following architectures: C.1.2.1 Similar Redundant Channels.
The multiple channels consist of equipment, components, electrical interconnections, and configurations that are similar, typically with equipment that have identical part numbers. The channels should be independent. They may be configured in active, active-backup, and passive-backup modes.
C.1.2.2 Dissimilar Redundant Channels.
Each channel is independent of the others and unique (comprises different equipment, components, electrical interconnections, and configurations).
They may be configured in active, active-backup, and passive-backup modes.
C.1.2.3 Combination of Similar and Dissimilar Redundant Channels.
The combination of similar redundant channels and dissimilar redundant channels, as defined above, with independence between channels. They may be configured in active, active-backup, and passive-backup modes.
Note 1: Active mode means the channel is performing the aircraft function during normal operation.
Note 2: Active-backup mode means the channel is operational (in the ready state), but not used to perform the aircraft function until switched to active mode, either automatically or by flightcrew action.
C-1 AC 20-136C Appendix C Note 3: Passive-backup mode means the channel is not operational (not in the ready state). Switching to active mode is either automatic or by flightcrew action upon failure recognition.
C.1.2.4 Combination of Electrical and Electronic and Mechanical, Hydraulic, and/or Pneumatic Channels. Certain architectures combine electrical and electronic channels with mechanical, hydraulic, and/or pneumatic channels. These combinations of channels may be configured in active, active-backup, and passive-backup modes.
Note: The examples in paragraph C.1.3 of this appendix are theoretical and do not account for all possible configurations but instead represent common system architectures or those that present unique challenges.
C.1.3 This appendix illustrates the following examples (Example C-1 through Example C-8) of aircraft systems with multiple independent and redundant channels performing a function whose failure would prevent continued safe flight and landing of the aircraft.
C-2 AC 20-136C Appendix C Example C-1 Information Essential to Continued Safe Flight and Landing System System Function System Channel Channel Channel Display of attitude, altitude, and Active Active Active-backup airspeed information to the pilots (pilot displays (co-pilot (dissimilar standby during operation under IFR (e.g., and associated displays and display and primary display system and sensors). associated associated sensors).
associated sensors, with dissimilar sensors).
standby display system and sensors).
Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (b) Discussion: This example illustrates the requirement in § 25.1333 for the instruments at each pilot station to independently display information essential to the safety of flight. The standby display is necessary for the system to comply with § 25.1309. Either the pilot or co-pilot can be the pilot flying or pilot monitoring during normal operations, so both the pilot and co-pilot display system could be the active system.
Compliance with § 25.1316(a)(1) and (2) should demonstrate that each pilot instrument display of aircraft attitude, altitude, and airspeed is not adversely affected when the aircraft is exposed to lightning and recovers normal operation after the aircraft is exposed to lightning. The dissimilar standby display should comply with § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B). Adverse effects include both loss of, and hazardously misleading, attitude, altitude, and airspeed information.
C-3 AC 20-136C Appendix C Example C-2 Electronic Flight Control System Function System Channel System Channel System Channel Full authority control of pitch, Active or active- Active or active- Active or active- yaw, and roll using electrical and backup backup backup electronic flight control systems (flight control (flight control (flight control system #1) system #2) system #3) Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (a)(1) and (2) Discussion: This example illustrates an electronic flight control system comprising three independent channels to comply with § 25.1309. At any time, any one of the three channels can operate as the active channel. This may be necessary to achieve the safety intent or maintain reliability, priority scheme, voting logic, etc.
Only one channel operates in active mode while others are in active-backup mode. Any channel can perform the control function at any one time; therefore, all channels must comply with § 25.1316(a)(1) and (2).
C-4 AC 20-136C Appendix C Example C-3 Engine Over-Speed Protection Function System Channel System Channel System Channel Provide engine over-speed Active Active or active- Active protection. backup (electronic engine (independent control system) (electronic engine mechanical over- control system) speed protection) (normal speed control) (over-speed protection) Applicable paragraph in § 25.1316 (b) (b) None Discussion: This example illustrates the function of engine over-speed protection performed by a combination of active electrical and electronic control and mechanical system control. The mechanical channel should provide over-speed protection during normal operations and be independent of the active electronic control channels. The mechanical channel should not rely on electrical or electronic components to assist, augment, or monitor the over-speed protection. If the mechanical channel is independent of the electronic engine control speed control and over- speed protection, and has no electrical or electronic components, then the engine over-speed protection function is not adversely affected when the aircraft is exposed to lightning. The system therefore is not subject to § 25.1316(a). The electronic engine control channels should comply with § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
This example only addresses the over-speed protection feature implemented by the system. Other functions whose failure may be classified as catastrophic, like the loss of thrust (or power) control where the function may be implemented by electronic control channels, must comply with § 25.1316(a).
C-5 AC 20-136C Appendix C Example C-4 Electrical Power Generation System including Ram Air Turbine (RAT) Function System Channel System Channel System Channel Provide electrical power for Active Active Passive-backup electrical and electronic systems (left engine (right engine (emergency including those with catastrophic generator generator power supply failure conditions.
system) system) system driven by ram air turbine) Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (b) Discussion: This example illustrates a typical transport category airplane electrical system on a two-engine airplane where two or more independent sources of electrical power are required by § 25.1307(b) and a ram air turbine is necessary to comply with the requirements in §§ 25.1309 and 25.1351(d).
For this example, the electrical system consists of two active channels provided by a single main engine driven generator on each engine with the associated distribution and controls, and a third passive-backup channel provided by a ram air turbine electrical power system. The ram air turbine electrical power system is stowed during normal operation and deployed either automatically or manually when power from the two main engine driven generators is lost.
The active engine generator system channels must not be adversely affected when the aircraft is exposed to lightning and must comply with § 25.1316(a)(1) and (2). The passive-backup ram air turbine electrical power system does not mitigate adverse effects for compliance with § 25.1316(a). The ram air turbine electrical power system must comply with § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
C-6 AC 20-136C Appendix C Example C-5 Electrical Power Generation System including Auxiliary Power Unit (APU) and RAT Function System System System Channel System Channel Channel Channel Provide electrical power for Active Active Active-Backup Passive-Backup electrical and electronic (left (right (APU driven (emergency systems including those with engine engine generator system power supply catastrophic failure conditions.
generator generator required for system driven by system). system). extended ram air turbine).
operations (ETOPS) flight beyond 180 minutes).
Applicable paragraph in (a)(1) and (a)(1) and Based on (b) § 25.1316 (2) (2) specific aircraft safety assessment.
Discussion: This example illustrates a two-engine transport category airplane electrical system where two or more independent sources of electrical power are required by § 25.1307(b) and an alternate source (driven by ram air turbine) is necessary to comply with §§ 25.1309 and 25.1351(d). This configuration includes a third electrical power source driven by an APU. This third source (active-backup channel) is required for ETOPS beyond 180 minutes. As in example 4, the emergency power source is a passive-backup channel provided by a ram air turbine that remains stowed during normal flight and deployed either automatically or manually when power from all other channels is lost.
All active electrical power generation channels should comply with § 25.1316(a)(1) and (2). The active-backup electrical power generation channel LCL should be determined based on the specific aircraft safety assessment. The passive-backup electrical power generation channel does not mitigate adverse effects due to lightning exposure to meet the intent of § 25.1316. The passive backup channel must be evaluated under § 25.1316(b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
Note : For airplanes without ETOPS type design approval or with ETOPS type design approval for up to 180 minutes, the APU LCL should be defined based on a specific aircraft safety assessment.
C-7 AC 20-136C Appendix C Example C-6 Independent Systems Performing an Aircraft Function System System System System Function Channel Channel Channel Channel Reduce aircraft speed on Active Active Active Active ground in a controlled manner main brake (electronic (electronic (independent using thrust reverser control system (electro- engine thrust spoiler mechanical system, spoiler deployment mechanical) reverse control deployment wheel braking) system, wheel braking system.
with associated control with sensors) associated sensors) Applicable paragraph in (a)(1) and (2) Based on Based on None § 25.1316 specific aircraft specific safety aircraft safety assessment. assessment.
Discussion: This example illustrates an aircraft level function that is performed by a combination of independent systems, each contributing to the function in part during a specific phase of flight.
Each system implements a very distinct aircraft level function that serves in a complementary manner to decelerate the aircraft during the landing roll. The mechanical wheel braking system is assumed to be independent of the other channels, with no associated electrical or electronic equipment to assist, augment, or monitor the mechanical wheel braking system.
In this example, it is assumed that the main brake system includes failure conditions that are catastrophic. For the electronic engine thrust reverser control and the electronic spoiler control systems, the applicable paragraphs in § 25.1316 would depend on the specific failure conditions.
The effectiveness, authority, and malfunctions associated with each system should be addressed.
Additionally, the interaction between the systems should be addressed. Issues such as unsymmetrical thrust reverser activation or spoiler deployment could adversely affect the main brake and mechanical wheel braking functions and could affect the safety classification for the thrust reverser and spoiler controls.
An aircraft safety assessment should be conducted for each of these systems performing a specific aircraft level function to identify and classify their failure conditions. The failure hazard classifications and the decomposition of each system into the constituent channels would then dictate which paragraphs of § 25.1316 must be complied with.
C-8 AC 20-136C Appendix C Example C-7 Altitude Information from Multiple Sources Function System Channel System Channel System Channel Provide altitude information to display Active Active Active-backup in IFR using air data computer (pneumatic (air data computer 1 (air data computer connected to the primary flight display, standby with static port) 2 with static port) and pneumatic standby instrument with altimeter with alternate static port. alternate static port) Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) None Discussion: This example illustrates the function of providing altitude information. The main sources are obtained from two air data computers coupled to static ports and a backup source from a standby pneumatic altimeter coupled to an alternate static port independent from the main static ports.
The pneumatic standby altimeter (active-backup channel) has no associated electrical or electronic equipment to assist, augment, or monitor the pneumatic standby altimeter system.
In this example, the standby altimeter does not mitigate the hazardously misleading altitude information from the active air data computer channels to comply with § 25.1316(a).
C-9 AC 20-136C Appendix C Example C-8 LCL Comparison to Development Assurance Level (DAL) Function System System Function System Channel Channel Channel Control and protection of the Active Active Passive Back-up aircraft pneumatic (bleed) system (pneumatic (pneumatic (high pressure (top-level failure condition system system switch + valve) classification: catastrophic). controller #1) controller #2) FDAL C Functional DAL FDAL B (FDAL) B Applicable paragraph in § 25.1316 (a)(1) and (2) (a)(1) and (2) (b) Discussion: This is a generic example to show that the LCL of a given system may be different from the FDAL and item development assurance level (IDAL), as defined in SAE ARP4754A. Therefore, it is important to use the proper nomenclature and avoid using ARP4754A “DAL” or similar terms when referring to the LCL.
In this example, the pneumatic control system is composed of two main active controllers and a simpler passive back-up channel that can perform the function, preventing a catastrophic event should both controllers fail.
The FDAL for each channel or member (ARP4754A nomenclature) in this example was determined for a catastrophic top-level failure condition based on the “Option 2” column of Table 3 “DEVELOPMENT ASSURANCE LEVEL ASSIGNMENT TO MEMBERS OF A FUNCTIONAL FAILURE SET” in ARP4754A, which allows the combination of FDAL B+B+C for independent channels. In contrast, the respective LCLs would be A+A+B.
Considering that lightning can simultaneously affect all channels, the considerations used for FDAL assignment are not sufficient. Compliance with § 25.1316(a) is required for both active channels performing a function with a catastrophic top-level failure condition.
The FDAL for the passive back-up channel may be C in this example. However, for lightning, the applicable paragraph in § 25.1316 is (b) based on the aircraft safety assessment identifying a hazardous failure condition (LCL B).
C-10 OMB Control Number: 2120-0746 Expiration Date: 12/31/2027 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering, and maintaining the data needed, completing, and reviewing the collection of information.
All responses to this collection of information are voluntary. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.
If you find an error in this Advisory Circular, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by emailing this form to 9-avs-air-directives- management-officer@faa.gov or faxing it to the attention of at .
Subject: Date: Mark all appropriate line items: on page .
An error (procedural or typographical) has been noted in paragraph Recommend paragraph on page be changed as follows: In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)
Other comments: I would like to discuss the above. Please contact me using the information below.
Submitted by: Date: FAA 1320-73 (01/25) SUPERSEDES PREVIOUS EDITIONS