Shades of Helios

A Translation from the Spanish Original at:

http://www.sepla.es/website/seplacms/index.php?option=com_content&task=view&id=532&Item id=1

The Repair of the Spanair MD-82's Final Failure failed to fulfill Boeing's Norms
Friday, 03 October 2008
El Mundo

Marisa RECUERO / Madrid.

Spanair failed to properly diagnose a recurring fault on the plane that crashed in Barajas on August 20 killing 154 people. The maintenance technician isolated the problem identified by the pilot via disconnecting a fuse, but he did not follow through to make a detailed assessment of the effect of his action on other interrelated systems linked to the mechanism that failed, as recommended by Boeing.

A manual is provided to the airline, by the manufacturer, to give instructions on how to interpret the list of items that are the minimum permitted that a plane can still fly with - that is, the MEL as it is known in aviation jargon; it says in paragraph 34 that in the event that the temperature sensor is inoperable, the maintenance technician must check the effect this (and any subsequent fix) could potentially have on systems related to this mechanism. The MEL is laid down in the MD80 Boeing Procedures Manual for, to which this newspaper has had access.

By the same token, there is another globally accessible regulatory manual which recommends the same. In this case, this is the book, namely the so-called Master MMEL that Boeing provides to the airlines so that they know what deferred maintenance items they can fly an aircraft with. In it, the manufacturer warns that other systems should be checked when the Ram Air Temperature (RAT) fails or is rendered inoperative.

The problem was that the maintenance manual that the Spanair technician consulted did not include any procedure to follow to fix an overheating in the probe temperature; this is according to sources close to the airline's own technicians, who confirmed that fact to this newspaper.

The person who isolated the fault had complied with the operating airline's servicing orders. First he consulted Spanair's list of items that spells out the minimum configuration for flying the plane in passenger service and he found that the aircraft could make the flight with the temperature sensor inoperative. Secondly, since the maintenance manual does not stipulate what to do prior to an actual failure of the sensor (i.e. an overheating malfunction short of total failure), the technician should then go to the relevant Wiring Diagram, that is to say, the circuit diagram wirings manual of the airplane. This would've indicated to him that he could simply deactivate the fuse - but wouldn't have elaborated on the other critical ramifications of disabling the system. One such critical system is the aural alerting system that warns pilots if their pre-takeoff configuration is incorrect, namely that the trailing-edge flaps and leading-edge slats are not in the proper position for takeoff.

The crux is that the RAT heater probe failed five times in less than 48 hours, according to the case summary, but no one bothered to consult the

book that explains the procedures to follow to cope with failures that would be induced by disabling the RAT probe's heater. A day before the crash the probe had overheated on four occasions, causing the technicians to reset the mechanism and re-dispatch the aircraft. The day of the accident, the same glitch recurred. Commander Antonio Garcia Luna routinely decided to return to the ramp and the technician removed the system's fuse (#Z29) - but unfortunately did not troubleshoot beyond that point.

Before arriving at his solution to this latest (but recurring) failure, the technician knew that the heater probe should activate only when in the air, and shouldn't heat up on the ground - at least it was so declared and recorded in the summary made up by the person responsible for maintaining the aircraft. This was in an affidavit to judge Javier Perez, who is directing the inquiry into the accident.

The first draft issued by the commission investigating the crash of the Spanair MD-82 confirmed that the flaps were not extended and that the aural alerting system did not sound off..... as it normally would have in such circumstances. Such omissions cause a heavily laden aircraft to rotate into a stalled condition, drop a wing and crash. The DC-9 and MD80 crash record is replete with such instances.

The list of deferred discrepancies (allowable failures or "carry-forwards"), with which the aircraft can fly for a limited period of time, includes the mechanism that inhibits the on-the-ground heating of the RAT Probe's temperature so it is unsurprising that the faulty sensor should have failed so repeatedly, yet not caused any great concern. In fact, at the time of the tragic take-off off, there was allegedly a change in the G/A signal. However, an hour earlier, the commander had detected otherwise (i.e. a repeat failure evidenced by an overheating probe) and that caused the MD82's routine return to the ramp for maintenance. The question then becomes whether the technician's action was in compliance with the MEL, in conflict with the MEL or fell through a loophole in the MEL. Something caused the Take-off warning system to itself fail in its critical duty. The pilots may have erred in not extending flaps and slats, but the fail-safe warning had then assured an accident by itself failing. Was Boeing at fault or was it Spanair or its technician. Or had the latent killer lurked on for years - despite being known to the FAA, NTSB and Spain's CIAIAC. How many times had the passengers been put in harm's way over the period since the malfunction first surfaced - and only escaped a similar fate to JKK5022's pax thanks to their pilots NOT neglecting to extend their flaps and slats? How many other times has this same peril lurked, but not struck, in the lifetime of the MD80 series?

On the 13 of August the nose-gear of the airplane, in the vicinity of the ground-to-air sensor mode relay, was serviced by Spanair technicians, just a week before the accident. The reason for this unscheduled intervention was the resolution of a deferred discrepancy that had occurred three days earlier (on August 10). The technicians swapped out the water and dirt deflectors located in the nose-wheel area. Conjecture, based upon the timeline of subsequent recurring failures, is that this was the triggering event.

There's two items in the MEL referring to RAT Probe
RAT Probe Heater (in Ice & Rain Protection) can be INOP as soon as we don't anticipate icing conditions.
This was the "failing part" that day for JKK5022 (so the one we should make INOP).

RAT/Thrust Rating system (under Autoflight/Navigation) where we must consider only the RAT Sensor (in this case it was fully operative)
The MEL says about this ITEM:

Quote:

The RAT portion may be inoperative provided:

a) A SAT or Standby RAT Indicating System or
PMS SAT readout is available,

b) Other systems affected by the RAT Probe
(DFGS, CADC, Thrust Rating, FMS, PMS) are
considered, and

c) Procedures are established to verify engine
power settings.

...continues with instruction about OM procedure

The MEL tell us about considering systems that are AFFECTED BY the RAT probe, not systems AFFECTING the RAT probe's heating malfunction.

Keep in mind that there is only one circuit breaker called "RAT Probe & Heater".
If we pull out this breaker (thus disconnecting the heater) the RAT will stop working entirely and the TRP will became INOP

Industry sources have advised that subsequently the airplane's strobe lights, that is, brilliant white flashing lights that identify the plane only when it is in the air, were operating on the ground. This should have signified to anyone in Spanair's technical employ that there was a problem with the ground-air sensing relay in the nosewheel well. It should be noted that the relays that switch the air and ground functions ON and OFF are themselves triggered by micro-switches that make and break as a function of nose oleo extension. Oleo gear legs are pneumatic air-oil struts that dampen the shock of ground contact. They extend when the weight of the aircraft is off them - and compress when the aircraft lands. Obviously the micro-switches, although encased in outer covers, are quite exposed to the elements. They are sensitive, and operate over a quite minuscule "throw". In similar fashion, oleos are prone to being over-serviced by having too much "air (i.e. nitrogen) or too little of the dampening oil injected. Pilots are

familiar with the ground-air switching becoming sensitive to the fore-aft weight distribution in the laden airplane. Unload a freighter's cargo nose-first/rear holds last and you can sit the airplane on its tail. Short of that happening pilots can also note that systems normally unpowered on the ground (such as strobes or radar altimeters etc) can suddenly activate..... if the aircraft is tail-heavy/ light upon its nose-gear.

With this clarifying background scenario, it is now clear that the procedure followed by Spanair was probably inadequate. But most importantly, it should be noted that the Directorate General of Civil Aviation is the institution that authorizes the operating and maintenance manuals of the airline companies. Boeing's liability, as usual, will be determined by the courts...... or ultimately settled at the last minute upon the front steps of those litigious institutions.

Relay R2-5 in the nose-wheel leg's WoW (weight-on-wheels) system was the intermittently failing (and ultimately failed) part. It told the RAT heater it was in the air and so should be "ON". Nothing was wrong with the RAT sensor or heater. Facile and incomplete trouble-shooting can be lethal - just as in the Greek crash of the HELIOS 737.

The pragmatic perspective:

Essentially we know and concede that the single WOW signal did not pass through R2-5 to arm the take-off configuration warning system, which in turn would have warned the pilots of their incorrect slats/flaps setting and thus would have avoided the accident.

I wonder why the principle of redundant signals is not being followed for such a crucial warning device. Thanks to the quirks of EASA, my humble old tail-dragger has recently been equipped with a mode S transponder that by regulation must be controlled by an air/ground switch. However, as the gear is always down and welded, the signal is artfully derived from the airspeed pressure difference sensor instead of WOW. If the airspeed is considerably below the stall speed, the transponder is in ground mode. Simple (and as cheap as it comes) for any aircraft installation under the suspicious eyes of EASA and my national aviation grounding office.

It would be easy (would it not?) to include such a sensor somehow into the logic of the warning system as an additional and independent ground mode condition arbiter.

An Interesting side-issue on Spanair and the MD80 series' airworthiness.

The numbers, with all of their complexities are in EASA's CS 25 Large Aircraft, Amendment 5 (US equivalent - FAR 25).
The specific requirement for a TOCWS is in CS 25.703 (Page 71), with practical guidance information in AMC 25.703 (Page 368).

Before considering the ‘numbers’, note the text (page 368) “…the takeoff warning system should serve as "backup for the checklist, particularly in unusual situations, e.g., where the checklist is interrupted or the takeoff delayed." !!!!
This is a major assumption/admission about the crew-system interface which many may have overlooked.

The discussion of system failures considers these systems to have a low level of criticality (page 369)"… because, in themselves, are not considered to create an unsafe condition, reduce the capability of the aeroplane, or reduce the ability of the crew to cope with adverse operating conditions. Other systems which fall into this category include stall warning systems, overspeed warning systems, ground proximity warning systems, and windshear warning systems. ” … but see Sub para (3) below.
This and subsequent items should be read in conjunction with AMC 25.1309 which cover system reliability.
TOCWS … "have a probability of failure (of the ability to adequately give a warning) which is approximately 1.0 x 10-3 or less per flight hour. … Maintenance or preflight checks are relied on to limit the exposure time to undetected failures which would prevent the system from operating adequately.”

Sub para (3) provides an important override, TOCWS are "… not considered to result in an adequate level of safety when the consequence of the combination of failure of the system and a potentially unsafe takeoff configuration could result in a major/catastrophic failure condition. Therefore, these systems should be shown to meet the criteria of AMC 25.1309 pertaining to a major failure condition, including design criteria and in-service maintenance at specified intervals. This will ensure that the risk of the takeoff configuration warning system being unavailable when required to give a warning, if a particular unsafe configuration occurs, will be minimized.”
This presumably assumes the failure to achieve the required configuration (system or crew) and the failure of the crew to detect the incorrect config (gauge/visually) in conjunction with a failure of the warning system – the numbers get larger.
A major/catastrophic failure condition is above 10-3 up to 10-9. However, I am not sure how the above would be applied to a certification – perhaps if loss of control was possible due to both a flapless/slatless takeoff, but not any one item – an aircraft specific issue? It must be said that a "slats only" take off is, however, probably survivable.

At this stage be prepared to be ambushed by ‘Grandfather(ing)’ rights; MD 80 was a DC-9, or pre regulation? This might imply that later aircraft have better protection and different operational assumptions, i.e. an Airbus pilot has a system which meets all aspects of the regulation (and the next two pages of it), including an adequate ‘System Inop’ warning. Thus, MD pilots have to operate with a different standard of equipment and a different set of assumptions about their performance when contributing to the system’s overall reliability, i.e. the crew has to be less susceptible to error. This is an interesting area as there are no regulations about how build or certificate a human, thus no help on how one human vs another can have a lower probability of error (we all have to be vigilant).
CS 25 attempts to contain this problem with relatively new (and lengthy) guidance in AMC 25.1302 (Page 485), i.e. human factors.

An interesting para at the end: “.... No MMEL relief (EASA) is provided for an inoperative takeoff configuration warning. Therefore, design of these systems should include proper system monitoring including immediate annunciation to the flight crew should a failure be identified or if power to the system is interrupted.”

http://www.easa.eu.int/ws_prod/g/doc/Agency_Mesures/Certification_Spec/CS-25%20Amdt%205.pdf

page 71

CS 25.703 Take-off warning system

(See AMC 25.703)

A take-off warning system must be installed and must meet the following requirements:

Spanair MD82's Nose-Gear WoW Relay

THE 26 FUNCTIONS

1. System of crossing of AC voltage (bus-tie?)

2. Wing Leading-edge Deicing

3. Radar

4. Gyroscopes

5. Ground spoilers

6. Ventilator of refrigeration

7. Fuel Heater

8. Reverse thrust Valve

9. Airflow Separation

10. Avionics compartment fans ventilation

11. Warning of loss of (?)

12. Cabin Pressurization

13. Engine power

14. Positioning system

15. Recirculation of conditioned air

16. CVR

17. RAT

18. Flight Recorder parameters of (QAR? DFDR?)

19. Air cleaner

20. Navigation lights

21. Entrance of volume

22. Aural system of warnings (Take-off Configuration Warning System)

23. Instruments Ventilator

24. Cargo-hold Heating

25. Ground lighting

26. System of panels and turbines.

(a) The system must provide to the pilots an aural warning that is automatically activated during the initial portion of the take-off roll if the aeroplane is in a configuration, including any of the following that would not allow a safe take-off:

(1) The wing-flaps or leading edge devices are not within the approved range of take-off positions.

(2) Wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671),speed brakes, or longitudinal trim devices are in a position that would not allow a safe take-off.

(3) The parking brake is unreleased.

(b) The aural warning required by subparagraph

(a) of this paragraph must continue until-

(1) The take-off configuration is changed to allow a safe take-off;

(2) Action is taken by the pilot to terminate the take-off roll;

(3) The aeroplane is rotated for take-off;

(4) The warning is manually silenced by the pilot. The means to silence the warning must not be readily available to the flight crew such

that it could be operated instinctively, inadvertently, or by habitual reflexive action.

Before each take-off, the warning must be rearmed automatically, or manually if the

absence of automatic rearming is clear and unmistakable.

power settings and procedures, and throughout the ranges of take-off weights, altitudes, and temperatures for which certification is requested.

AMC 25.703 (Page 368).

(3) ARINC 726, Flight Warning Computer System. This document can be obtained from the

ARINC, 2551 Riva Road, Annapolis, Maryland 21401.

4. BACKGROUND. A number of aeroplane accidents have occurred because the aeroplane was not

properly configured for takeoff and a warning was not provided to the flight crew by the takeoff

configuration warning system. Investigations of these accidents have indicated a need for guidance

material for design and approval of takeoff configuration warning systems.

5. DISCUSSION.

a. Regulatory Basis.

(1) CS 25.703, "Takeoff warning system," requires that a takeoff configuration warning

system be installed in large aeroplanes. This requirement was introduced with JAR25

Amendment 5

effective 1.1.79. On the FAR side, this was added to Part 25 by Amendment 2542

effective on March 1, 1978. CS 25.703 requires that a takeoff

warning system be installed and provide an aural warning to the flight crew during the initial portion of the take off roll, whenever the aeroplane is not in a

configuration which would allow a safe takeoff.

The intent of this rule is to require that the takeoff configuration warning system cover (a) only those configurations of the required systems which would

be unsafe, and (b) the effects of system failures resulting in wrong surface or system functions if there is not a separate and adequate warning already provided. According to the preamble of Amendment 2542, the takeoff warning system should serve as "backup for the checklist, particularly in unusual situations, e.g., where the checklist is interrupted or the takeoff delayed." Conditions for which warnings are required include wing flaps or leading edge devices not within the approved range of takeoff positions, and wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671), speed brakes, parking brakes, or longitudinal trim devices in a position that would not allow a safe takeoff.

Consideration should also be given to adding rudder trim and aileron (roll) trim if these devices can be placed in a position that would not allow a safe takeoff.

(2) Prior to CS25

Amendment 5 and FAR 25 Amendment 2542,

there was no requirement for a takeoff configuration warning system to be installed in large aeroplanes. Since this amendment is not retroactive, some large aeroplane models in service today may not have takeoff configuration warning systems; however, all large turbojet transports currently in service, even those with a certification basis established prior to 1978, include a takeoff configuration warning system in the basic design. These include the majority of large aeroplanes.

(3) Other general rules such as CS 25.1301, 25.1309, 25.1322, 25.1357 and 25.1431 for electronic system installations also apply to takeoff configuration warning systems.

b. System Criticality.

(1) It has been Aviation Authorities policy to categorize systems designed to alert the flight crew of potentially hazardous operating conditions as being at a level of criticality associated with a probable failure condition. (For a definition of this terminology together with discussions and guidelines on the classification of failure conditions and the probability of failures, see AMC 25.1309). This is because failures of these systems, in themselves, are not considered to create an unsafe condition, reduce the capability of the aeroplane, or reduce the ability of the crew to cope with adverse operating conditions. Other systems which fall into this category include stall warning systems, overspeed warning systems, ground proximity warning systems, and windshear warning systems.

(2) Even though AMC 25.1309 does not define an upper probability limit for probable failure conditions, generally, it can be shown by analysis that such systems have a probability of failure (of the ability to adequately give a warning) which is approximately 1.0 x 10 3 or less per flight hour. This probability does not take into account the likelihood that a warning will be needed. Systems which are designed to meet this requirement are usually single channel systems with limited built-in monitoring.

"I've had this thing happen some 3 times on the virtually identical DC9 series 30.

It is not that rare, it happens and that's what should be taught by the airline to its people, both pilots and mechanics."

I had the nose oleo strut overinflated one night taxiing out for take off with the strobe lights on and idle power at flight idle because of another relay thinking we were in the air. I did not notice the RAT temp being high but am sure it was and did not know the TOWS was inop. Aggressive braking brought the nose oleo switch to ground position and all returned to normal. It must happen regularly so it should be an abiding maintenance concern.

This reminds me of another MEL error. I picked up an MD80 on first flight and saw the previous write up was that on the prior day the APU wouldn't start in the morning. It was MEL'd and flew all day late into the night. Maintenance replaced the battery and faulty battery charger to fix the APU, not the starting problem. So all day and all night they had no emergency power. In this case they had no TOWS.

Maintenance or preflight checks are relied on to limit the exposure time to undetected failures which would prevent the system from operating adequately.

(3) Applying the practice given in subparagraphs b(1) and b(2) above to takeoff configuration warning systems is not considered to result in an adequate level of safety when the consequence of the combination of failure of the system and a potentially unsafe takeoff configuration could result in a major/catastrophic failure condition. Therefore, these systems should be shown to meet the criteria of AMC 25.1309 pertaining to a major failure condition, including design criteria and in-service maintenance at specified intervals. This will ensure that the risk of the takeoff configuration warning system being unavailable when required to give a warning, if a particular unsafe configuration occurs, will be minimized.

(4) If such systems use digital electronic technology, a software level should be used, in accordance with the applicable version of EUROCAE ED12()/ RTCA document DO178(), as recognized by AMC 20115(), which is compatible with the system integrity determined by the AMC 25.1309 analysis.

(5) Since a false warning during the takeoff run at speeds near V1 may result in an unnecessary rejected takeoff (RTO), which could lead to a mishap, the occurrence of a false warning during the takeoff should be remote in accordance with AMC 25.1309.

(6) If the takeoff configuration warning system is integrated with other systems that provide crew alerting functions, the level of criticality of common elements should be commensurate with that of the takeoff configuration warning system unless a higher level is dictated by one or more of the other systems.

c. Design Considerations.

(1) A review of existing takeoff configuration warning systems has shown a trend towards increased sophistication of design, partly due to the transition towards digital electronic technology which is amenable to self-monitoring and simple testing. The net result has been an improvement in reliability, fewer unwanted warnings and enhanced safety.

(2) With the objective of continuing this trend, new systems should be designed using the objectives and criteria of AMC 25.1309. Analysis should include all the remote sensors, transducers and the elements they depend on, as well as any takeoff configuration warning system line replaceable unit (LRU) and the actual visual and aural warning output devices.

(3) Unwanted warnings may be reduced by inhibiting the takeoff configuration warning system where it is safer to do so, e.g., between V1 and VR, so that a hazardous rejected takeoff is not attempted. Hmm? Inhibition of the takeoff configuration warning system at high speeds will also avoid any confusion from the occurrence of a warning during a touch and go landing. This is because the basic message of an alert is to stop because it is unsafe to take off. It may or may not tell the flight crew which surface or system is wrong. A warning may be more hazardous than reliance on the flight crew's skill and training to cope with the situation. (unless it's aerodynamically impossible of course)

(4) Even though CS 25.703 specifies those inputs common to most large aeroplanes that must be included in the design, each aeroplane model should be carefully reviewed to ascertain that any configuration or trim setting that could jeopardize a safe takeoff has an input to the takeoff warning system unless a separate and adequate warning is already provided by another system. There may be aeroplane configurations or electronically positioned lateral or longitudinal trim unique to a particular model that constitute this hazard. In the event that it is necessary to inhibit the warning from

a particular system during the entire takeoff roll, an equivalent level of safety finding would be required.

(5) Automatic volume adjustment should be provided to maintain the aural warning volume at an appropriate level relative to cockpit ambient sound. According to Report No. DOT/FAA/RD81/

38, II entitled "Aircraft Alerting Systems Standardization Study, Volume II Aircraft Alerting System Design Guidelines," aural signals should exceed masked threshold by 8 ± 3 dB.

(6) Of particular importance in the design of takeoff configuration warning systems is the elimination of nuisance warnings. These are warnings generated by a system which is functioning as

designed but which are inappropriate or unnecessary for the particular phase of operation. Attempting to eliminate nuisance warnings cannot be over-emphasized because any indication which could cause

the flight crew to perform a high speed rejected takeoff, or which distracts or adversely affects the flight crew's performance of the takeoff manoeuvre, creates a hazard which could lead to an

accident. In addition, any time there are nuisance warnings generated, there is a possibility that the flight crew will be tempted to eliminate them through system deactivation, and by continually doing this,

the flight crew may be conditioned to ignore a valid warning.

(7) There are a number of operations that could produce nuisance warnings. Specifically, single engine taxi for twin engine aeroplanes, or in the case of 3 and 4 engine aeroplanes, taxi with

fewer than all engines operating is a procedure used by some operators for the purpose of saving fuel. Nuisance warnings have also been caused by trim changes and speed brake handle adjustments.

(8) The means for silencing the aural warning should not be located such that it can be operated instinctively, inadvertently, or by habitual reflexive action. Silencing is defined as the

interruption of the aural warning. When silenced, it is preferred that the system will be capable of rearming itself automatically prior to takeoff

. However, if there is a clear and unmistakable annunciation that the system is silenced, manual rearming is acceptable.

(9) Each aeroplane model has a different means of arming the takeoff configuration warning system, therefore the potential for nuisance warnings varies accordingly. Some existing systems use only a single throttle position, some use position from multiple throttles, some use EPR or N1, and some use a combination of these. When logic from a single operating engine was used, nuisance warnings were common during less than all engine taxi operations because of the higher power settings required to move the aeroplane. These systems were not designed for that type of operation.

Because this procedure is used, inputs that arm the system should be judiciously selected taking into account any likely combination of operating and shutdown engines so that nuisance warnings will not occur if the aeroplane is not in takeoff configuration.

(10) CS 25.703 requires only an aural alert for the takeoff warning system. CS 25.1322 currently specify requirements for visual alerts while related reading material reference 3a(2), 3a(4) and 3b(1) provide guidance for integrated visual and aural annunciations for warnings, cautions and advisory alerting conditions. It has been common industry practice to incorporate the above mentioned references in their aeroplane designs. FAR/CS 25.1322 are planned for revision to incorporate the guidance of these references to reflect current industry practices. Manufacturers may wish to incorporate these alerting concepts to the takeoff warning system. If such is the case , the following guidance is offered:

a) A master warning (red) attention getting alert may be provided in the pilot's primary field of view simultaneously with the aural attention getting alert.

b) In addition to (or instead of) the aural attention getting alert (tone), voice may be used to specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).

c) The visual alert may also specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).

d) A visual cautionary alert associated with the failure of the Takeoff warning system may be provided

e.g. "T/O WARN FAIL".

(11) The EASA Agency approved Master Minimum Equipment List (MMEL) includes those items of equipment related to airworthiness and operating regulations and other items of equipment

which the Agency finds may be inoperative and yet maintain an acceptable level of safety by appropriate conditions and limitations. No MMEL relief is provided for an inoperative takeoff configuration warning. Therefore, design of these systems should include proper system monitoring including immediate annunciation to the flight crew should a failure be identified or if power to the system is interrupted.

d. System Tests and Test Intervals.

(1) When manual tests or checks are required to show compliance with CS 25.1309, by detecting the presence of and limiting the exposure time to a latent failure that would render the warning inoperative, they should be adequate, simple and straight forward in function and interval to allow a quick and proper check by the flight crew and maintenance personnel. Flight crew checks may be specified in the approved Aeroplane Flight Manual (AFM) and, depending on the complexity of the takeoff configuration warning system and the aeroplane, maintenance tasks may be conventional

Maintenance Review Board (MRB) designed tasks or listed as Certification Check Requirements (CCR) where appropriate, as defined in AMC 25.1309, and determined as part of the approval process between the manufacturer and the certification office.

(2) The specified tests/checks established in accordance with subparagraph 5d(1) above should be demonstrated as part of the approval process and should show that each input sensor as well as the control and logic system and its emitters, including the indication system, are individually verified as required to meet subparagraph 5b(3). It should also be demonstrated that the warning self cancels when required to do so, for example by retarding the throttles or correcting the wrong configuration.

e. Test Considerations.

(1) During flight testing it should be shown that the takeoff configuration warning system does not issue nuisance alerts or interfere with other systems. Specific testing should be conducted to ensure that the takeoff configuration warning system works satisfactorily for all sensor inputs to the system. Flight testing should include reconfiguration of the aeroplane during touch and go manoeuvres.

(2) It should be shown by test or analysis that for all requested power settings, feasible weights, taxiway slopes, temperatures and altitudes, there will be no nuisance warnings, nor failure to give a warning when necessary (e.g., cold conditions, derated takeoff), for any reasonable configuration of engines operating or shut down. This is to test or simulate all expected operational configurations. Reasonable pilot technique for applying power should be presumed.

(3) The means for silencing the aural warning by the flight crew will be evaluated to assure that the device is not accessible instinctively and it is properly protected from inadvertent activation.

Automatic or manual rearming of the warning system will be evaluated.

[Amdt. No.:25/2]

Page 485

2. BACKGROUND

Flight crews make a positive contribution to the safety of the air transportation system because of their ability to assess continuously changing conditions and situations, analyse potential actions, and make reasoned decisions. However, even well trained, qualified, healthy, alert flight-crew members make errors. Some of these errors may be influenced by the design of the systems and their flight crew interfaces, even with those that are carefully designed. Most of these errors have no significant safety effects, or are detected and/or mitigated in the normal course of events,. Still, accident analyses have identified flight crew performance and error as significant factors in a majority of accidents involving transport category aeroplanes. Accidents most often result from a sequence or combination of errors and safety related events (e.g., equipment failure and weather conditions). Analyses show that the design of the flight deck and other systems can influence flight crew task performance and the occurrence and effects of some flight crew errors.

Some current regulatory requirements mean to improve aviation safety by requiring that the flight deck and its equipment be designed with certain capabilities and characteristics. Approval of flight deck systems with respect to design-related flight crew error has typically been addressed by referring to system specific or general applicability requirements, such as CS 25.1301(a), CS 25.771(a), and CS 25.1523. However, little or no guidance exists to show how the applicant may address potential crew limitations and errors. That is why CS 25.1302 and this guidance material have been developed.

Often, showing compliance with design requirements that relate to human abilities and limitations is subject to a great deal of interpretation. Findings may vary depending on the novelty, complexity, or degree of integration related to system design. The EASA considers that guidance describing a structured approach to selecting and developing acceptable means of compliance is useful in aiding standardised certification practices.

3. SCOPE AND ASSUMPTIONS

This AMC provides guidance for showing compliance with CS 25.1302 and guidance related to several other requirements associated with installed equipment the flight crew uses in operating the aeroplane. Table 1 below contains a list of requirements related to flight deck design and flight crew interfaces for which this AMC provides guidance. Note that this AMC does not provide a comprehensive means of compliance for any of the requirements beyond CS 25.1302.

This material applies to flight crew interfaces and system behavior for installed systems and equipment used by the flight crew on the flight deck while operating the aeroplane in normal and non-normal conditions.

It applies to those aeroplane and equipment design considerations within the scope of CS-25 for type certificate and supplemental type certificate (STC) projects. It does not apply to flight crew training, qualification, or licensing requirements. Similarly, it does not apply to flight crew procedures, except as required within CS-25.

In showing compliance to the requirements referenced by this AMC, the applicant may assume a qualified flight crew trained in the use of the installed equipment. This means a flight crew that is allowed to fly the aeroplane by meeting the requirements in the operating rules for the relevant Authority.