Appendix 1 - Computerized Aeroplane Flight Manual
1.0 Purpose
This appendix presents guidelines for obtaining approval of a computerized version of an AFM that would replace or supplement parts of the conventional paper AFM. These guidelines also apply to computerized AFM appendices and supplements. The criteria provided in the main body of this AMJ remain applicable except where modified by this appendix. These guidelines do not cover:
- (a) Systems used on board the aeroplane during flight.
- (b) Systems that provide direct input to other aeroplane systems or equipment.
- (c) Supplementary software or software functions used to prepare documentation suitable for use in the operation of the aeroplane under the applicable operating rules (e.g., airport analysis software).
2.0 Applicability
This appendix applies to aeroplanes eligible to be certificated to JAR 25. The guidelines contained herein pertain to generating and presenting AFM performance information required by JAR 25 by means of computer software. This appendix may be amended to include relevant aspects for other J M approved information that is stored and presented through computer software.
3.0 Definitions
- (a) Computerized AFM - The computerized AFM software application used in conjunction with the hardware and software environment in which it is installed to generate computerized AFM information.
- (b) Computerized AFM Software Application - The computer programs and data installation information, and operating guide that are used in generating computerized AFM information.
- (c) Computerized AFM Information - The information generated by the J M approved computerized AFM in lieu of or supplementing parts of the conventional paper AFM.
- (d) Software Environment - The additional computer programs (e.g., operating system) that provide services to the computerized AFM software application to input, process, and output the information to the user.
- (e) Hardware Environment - The equipment (e.g., terminal, printer, keyboard, math co-processor, central processing unit, etc.) that enables the operation of the software environment and the computerized AFM software application to input, process, and output the information to the user.
- (f) Commercial-Off-the-Shelf (COTS) Computer - A multi-purpose computer (e.g., a standard personal computer) that is available, or can be made available, to all potential users of the respective computerized AFM.
- (g) Calculation - Data generation by means of combination of table-lookup or arithmetic operations.
- (h) First Principles Calculation - A Calculation using basic parameters such as lift, drag, thrust, etc. with the equations of motion.
4.0 General Guidelines
The holder of the type certificate (TC) is responsible for obtaining approval of new and revised computerized AFMs. An applicant seeking a supplemental type certificate (STC) based on a computerized AFM must comply with the same guidelines as the TC holder. The criteria herein do not affect the status of computerized AFMs that have previously been JAA approved. When such manuals are amended in the future, the concepts of this appendix should be applied, where practicable.
- (a) Official Reference
- (i) The conventional paper portion of the AFM should contain appropriate references about applicability of the JAA approved computerized AFM software application. This reference should be revised each time the JAA approved computerized AFM software application is changed (see paragraph 6.d of this appendix).
- (ii) The AFM should contain a statement similar to the following:
- The computerized AFM replaces or supplements portions of the paper AFM, and is a JAA approved source for that AFM information. Any modification to the JAA approved computerized AFM software application, or subsequent alteration to the generated output, will cancel the airworthiness approval of the information, unless this change was approved by the appropriate airworthiness authority. This statement applies regardless of any approval notation printed on a generated output.
- (i) The conventional paper portion of the AFM should contain appropriate references about applicability of the JAA approved computerized AFM software application. This reference should be revised each time the JAA approved computerized AFM software application is changed (see paragraph 6.d of this appendix).
- (b) Approved and Unapproved Information - Section 25.1581 of the JAR requires that the JAA approved information be segregated, identified, and clearly distinguished from any unapproved information in the AFM. Therefore, the approval status of generated output should be clearly indicated on the screen and printed on each printout page of any calculated results by indication of:
- (i) Approved program version.
- (ii) Approved data version, if applicable.
- (iii) Approval status of results with respect to requirement basis of the computation (e.g., FAR/Joint Aviation Requirements (JAR)).
- (iv) Applicable certification basis, if the program is capable of generating results for more than one certification basis (e.g., FAR/Joint Aviation Requirements (JAR)).
- (v) Date of output data generation.
- (i) Approved program version.
- (c) Software Usage Aspects - The applicant should substantiate that the computerized AFM is designed to:
- (i) Provide a generated output containing all the information required to be in the conventional paper AFM by JAR 25 for the part that is replaced or supplemented by the computerized for a specific condition) to determine operating condition and applicability of the generated output.
- (ii) Provide equivalent or conservative results to that obtained by direct of a first principles calculation using certified baseline parameters. (e.g., lift, drag, thrust).
- (iii) Preclude calculations that would generate results identified as JAA approved by:
- 1) Extrapolating data beyond computational bounds agreed to by the JAA and the applicant; or
- 2) Using unapproved flight test analysis or AFM expansion methods.
- 1) Extrapolating data beyond computational bounds agreed to by the JAA and the applicant; or
- (iv) Provide at lease the standard of transparency (e.g., understanding of performance relations and limitations) that is available from a conventional paper AFM presentation.
- (v) Minimise mistakes or misunderstanding by a trained user during data input and interpretation of output.
- (i) Provide a generated output containing all the information required to be in the conventional paper AFM by JAR 25 for the part that is replaced or supplemented by the computerized for a specific condition) to determine operating condition and applicability of the generated output.
5.0 Computerized Aeroplane Flight Manual Contents
- (a) General. (Reserved.)
- (b) Limitations Section. (Reserved.)
- (c) Procedures Sections. (Reserved.)
- (d) Performance Section.
- (i) The computerized AFM may be used to generate all of the JAA approved performance information required to be in the AFM.
- (ii) The operating rules require operators to carry, in each transport category aeroplane, either the AFM or an operator-prepared manual that contains all of the information required to be in the AFM. The computerized AFM is not intended for use on board the aeroplane. Thus, any portions of the AFM that are provided only in computerized (i.e., electronic) form may not be used to satisfy these operating requirements. This does not preclude printing out information calculated by the JAA approved computerized AFM and subsequently using the paper printout on board the aeroplane.
- (iii) Configuration Deviation List (CDL) and Master Minimum Equipment List (MMEL) effects on performance may be included if they are JAA approved and applications are clearly identified on the generated output.
- (iv) Although the output from the computerized AFM should be usable without adjustment, applying corrective factors that are provided in the paper AFM may be acceptable in the following cases:
- 1) CDL or MMEL information.
- 2) Urgent temporary JAA approved revisions made mandatory for safety reasons.
- 3) Any case in which the appropriate data are unavailable from the computerized AFM and it is clear to the user that corrective factors must be applied.
- 4) Supplements produced by STC applicants.
- 1) CDL or MMEL information.
- (v) Supplementary performance information may be included in accordance with paragraph 4.b of this appendix (e.g., for operation on runways contaminated with standing water, slush, snow, or ice).
- (vi) The applicant may request JAA approval of supplementary computerized AFM applications (e.g., optimized runway performance). This supplementary software application will not be required by the JAA for type ratification.
- (i) The computerized AFM may be used to generate all of the JAA approved performance information required to be in the AFM.
6.0 Software Integrity, Development, And Documentation Requirements
The computerized AFM consists of the AFM software application used in conjunction with the hardware and software environment in which it is installed. This section provides guidelines that address the integrity, development process, and documentation requirements of the software.
- (a) Software Integrity
- (i) The computation of hazardously misleading primary information such as take-off speeds, landing approach speeds, engine thrust or power, engine limit data or other related aeroplane performance data, should be improbable (as defined in JAR 25.1309). The AFM software application should, as far as practicable, be protected from inadvertent, deliberate, or unauthorised alterations. For example, self-check features could be used to provide software verification and protection against deliberate or inadvertent alteration.
- (ii) The level of integrity established for the computerized AFM is the basis for the software development process and should be addressed in the plan for software aspects of certification see paragraph 6.b of this appendix).
- (iii) Each part of the JAA approved AFM software application (e.g., program, data) should bear a unique notation, a unique date, or a revision number.
- (iv) A means to check the programs and data to avoid undetected failures should be provided (e.g., a checksum routine, tabular data to verify a check case, or provisions for a line-by-line file comparison).
- (v) Commercially available software, such as operating systems (e.g., MS-DOS), word processors, and spreadsheets, will not be approved by the JAA. However, this software can be used to run the computerize AFH software application or process (i.e., edit, format, manipulate, etc.) AFH data to produce approved AFM information if:
- 1) The applicant demonstrates that the unapproved software does not interfere with the correct functioning of the JAA approved computerized AFM software application;
- 2) The applicant demonstrates that the unapproved software produces reliable results when used with the specified hardware environment and the computerized AFM software application; and
- 3) The applicant specifies, in the paper AFM or a user's guide, the title, manufacturer, and version number of such software. The version number may refer to future versions-of the software (e.g., *Version XX and later*) if the verification check performed under paragraph 6. (i) of this appendix is designed such that improper operation of these later software versions would be detected.
- 1) The applicant demonstrates that the unapproved software does not interfere with the correct functioning of the JAA approved computerized AFM software application;
- (i) The computation of hazardously misleading primary information such as take-off speeds, landing approach speeds, engine thrust or power, engine limit data or other related aeroplane performance data, should be improbable (as defined in JAR 25.1309). The AFM software application should, as far as practicable, be protected from inadvertent, deliberate, or unauthorised alterations. For example, self-check features could be used to provide software verification and protection against deliberate or inadvertent alteration.
- (b) Software Development - The integrity of the software components of the computerized AFM is achieved through the software development processes used.
- (i) The applicant should propose the software development process in the plan for software aspects of certification. The applicant should document the methods, parameters, and allowable range of conditions contained in the computerized AFM. The results obtained from the computerized AFM should be shown to meet all applicable JAR 25 requirements. This compliance may be shown using substantiation documentation, demonstrations, or other means Murielle agreed to by the JAA and the applicant. The software development process described in AC 20-115B (RTCA DO-178B) is valid, in general, for developing either airborne or ground based software. It represents one acceptable approach, but not the only acceptable approach, for developing software for the computerized AFM. Some of the specific guidance provided in AC 20-115B however, may not apply to the computerized AFM.
- (ii) The applicant should submit a description of the computerized AFM and the plan for software aspects of certification to the JAA for review early in the certification process. This plan proposes the schedule and means by which compliance with the requirements will be achieved and the means by which certification data and supporting records will be made available to the JAA for review.
- (i) The applicant should propose the software development process in the plan for software aspects of certification. The applicant should document the methods, parameters, and allowable range of conditions contained in the computerized AFM. The results obtained from the computerized AFM should be shown to meet all applicable JAR 25 requirements. This compliance may be shown using substantiation documentation, demonstrations, or other means Murielle agreed to by the JAA and the applicant. The software development process described in AC 20-115B (RTCA DO-178B) is valid, in general, for developing either airborne or ground based software. It represents one acceptable approach, but not the only acceptable approach, for developing software for the computerized AFM. Some of the specific guidance provided in AC 20-115B however, may not apply to the computerized AFM.
- (c) Hardware and Software Environment - The computerized AFM software application may be JAA approved independent of the hardware and software environment in which it is installed. A common example of this would be the development of a computerized AFM software application to be run in a commercial-off-the-shelf (COTS) hardware and software environment. The applicant should provide for item (i) as follows, plus either item (ii) or (iii), as appropriate:
- (i) A mechanism, such as an installation utility function or test set, that verifies the proper functioning of the computerized AFM software application in the target software and hardware environment. The verification check should include, but not be limited to, proper functioning with hardware specified in the AFM, including input and output devices, and with resident software, including terminate-to-stay-resident or other control programs such as Microsoft Windows, and with any operating system calls made by the AFM software.
- (ii) If the computerized AFM is intended for a COTS hardware and software environment, installation information that describes the minimum requirements, including limitations and constraints, for the software and hardware environment.
- (iii) If the computerized AFM is intended for a specific hardware/software system. Installation information that describes the specific hardware and software environment in which the computerized AFM software application must be installed. Additionally, the applicant should provide a configuration management scheme that ensures the hardware and software environment that will be used in service is identical to the environment specified in the JAA approved installation data.
- (i) A mechanism, such as an installation utility function or test set, that verifies the proper functioning of the computerized AFM software application in the target software and hardware environment. The verification check should include, but not be limited to, proper functioning with hardware specified in the AFM, including input and output devices, and with resident software, including terminate-to-stay-resident or other control programs such as Microsoft Windows, and with any operating system calls made by the AFM software.
- (d) Revisions to a Computerized AFM Software Application
- (i) Revisions to a JAA approved computerized AFM should be submitted for evaluation and JAA approval in accordance with software development methodology established in paragraph 6.(b) of this appendix. A log of JAA approved AFM software application parts should be furnished by the applicant. For historical purposes, the applicant should maintain records from which the information from any approved revision level of the computerized AFM can be reproduced, unless none of the affected aeroplanes remain in operational service.
- (ii) The applicant should submit a description of the proposed changes and an updated plan for software aspects of certification. In addition, the applicant should:
- 1) Re-assess the software integrity level (paragraph 6.a of this appendix) of the revised computerized AFM;
- 2) Demonstrate that revisions do not affect any of the unrevised portions of the computerized AFM; and
- 3) Demonstrate that the revisions are compatible with the hardware and software environment intended for the computerized AFM software application.
- 1) Re-assess the software integrity level (paragraph 6.a of this appendix) of the revised computerized AFM;
- (iii) Revisions to a computerized AFM can be made only by the TC or STC holder of that computerized AFM. The STC applicant may supplement but not revise a TC holder's computerized AFM.
- (iv) When revisions are incorporated, a means (e.g., document) of indicating those parts of the software that have been changed should be provided.
- (v) Each revised software element should be identified in the same manner as the original, with the exception of the new date or revision notation (see paragraph 6.a(iii) of this appendix).
- (i) Revisions to a JAA approved computerized AFM should be submitted for evaluation and JAA approval in accordance with software development methodology established in paragraph 6.(b) of this appendix. A log of JAA approved AFM software application parts should be furnished by the applicant. For historical purposes, the applicant should maintain records from which the information from any approved revision level of the computerized AFM can be reproduced, unless none of the affected aeroplanes remain in operational service.
- (e) Submittal and JAA Approval of Software
- (i) The applicant will be considered the responsible party for all matters pertaining to the computerized AFM software application, including submittal to the JAA and obtaining JAA approval.
- (ii) The applicant and the JAA shall discuss and agree on the data structures and calculation models.
- (iii) The applicant should provide any part of the hardware environment necessary for operating the computerized AFM that is not readily available to the JAA.
- (i) The applicant will be considered the responsible party for all matters pertaining to the computerized AFM software application, including submittal to the JAA and obtaining JAA approval.
- (f) Documentation Requirements - Documentation containing the following information should be provided by the applicant to the JAA.
- (i) Approval plan that describes the software aspects of certification, including time schedules, an outline of the desired applications, and design objectives for software and data integrity.
- (ii) Software development plan, including the methods used to accomplish the design objectives.
- (iii) Software descriptions, including justifications that program structures and calculation models are appropriate to their intended function.
- (iv) Data verification document, including a description of the scope and depth of the review, analysis, and tests used to determine that the developed software and generated output accurately reflect the aeroplane performance characteristics. This description should include the purpose of each test case and the set of inputs, expected results, test environment, and calculated results.
- (v) Operating instructions, including all information for proper use of the computerized AFM, installation instructions and identification of the suitable hardware and software environment.
- (vi) Software configuration reference, including a log of the approved software elements and a statement that design objectives of the approval plan and compliance with the guidelines of this appendix have been demonstrated.
- (i) Approval plan that describes the software aspects of certification, including time schedules, an outline of the desired applications, and design objectives for software and data integrity.
7.0 Provisions For JAA Post Certification Access To Computerized AFM
In the plan for software aspects of certification, the applicant should propose which components of the computerized AFM will be submitted to the JM. In cases where the AFM software application can be installed on JAA equipment, the applicant need only provide the computerized guide. However, if the computerized AFM software application requires a hardware and software environment that is not available to the JAA, the applicant should also provide the appropriate JAA certification offices with the necessary components to access the AFM software application.
8.0 Not required for JAR