Downloaded from https://www.everyspec.com ADS-79D-HDBK 4761 further recommends a Fault Tree Analysis be performed which utilizes the failure conditions from the FHA to systematically determine all credible single faults and failure conditions. Once these conditions are identified, a hardware and software design assurance level (DAL) may be established. Further, the safety hazards should then be assessed IAW MIL-STD-882. Supporting analyses and tests should then be performed to validate the design meets the safety requirements. Documentation of the results should then be consolidated in a Safety Assessment Report. G.7.4.1.3 Software.
Software should be developed IAW RTCA DO-178B to the DAL determined by the Safety Assessment for Software utilized to perform power assurance checks in EMS/EHMS; especially when integrating with engine controls / cockpit flight management systems. Use of RTCA DO-178C and four notable associated documents, DO-330, 331, 332, and 333 is also recommended. A Safety Assessment Report should define the DAL and rationale. Software audits should be performed at critical stages of the software development and verification process. These audits should be performed IAW the FAA Job Aid document: ―Conducting Software Reviews Prior to Certification‖ and be conducted by the Using Service.
However, at the very least, self-audits should be conducted by the EMS/SHMS developer to ensure all required RTCA DO- 178B objectives, for the given DAL, have been met. G.7.4.1.4 Accuracy and Repeatability. An EMS/EHMS power assurance check output should be repeatable, for any given pressure altitude, outside air temperature, power condition, and flight speed. The EMS/EHMS output should agree with the output obtained via any other valid set of conditions for the same airframe and engine installation.
The power assurance check output should also be accurate when the aircraft data, as compared to test cell data (corrected for platform installation losses), are consistent within a predefined tolerance. For off-platform accuracy testing, engine power margin, as determined by the EMS/EHMS, should agree with that determined in a test cell on the same engine to within + 3 percent. Test data should be obtained on both new and deteriorated engines to demonstrate this capability. The power margin should be defined at maximum rated Turbine Gas Temperature (TGT) and a set of ambient conditions agreed upon between the Developer and the Government.
The accuracy should then be assessed on the operational platform using both new and deteriorated engines. The predicted Power Available to the first engine limiter should agree to that observed on-platform for any given pressure altitude, outside air temperature, power condition(s), and flight speed to within + 4 percent. For helicopters, rotor droop should confirm regions of engine control limiting during testing. Accuracy and repeatability of the EMS/EHMS power assurance check should also be tested on the platform using all engine inlet, exhaust, bleed configurations affecting engine performance (i.e. exhaust suppressors, inlet barrier filters, customer bleed variations).
Configuration variations between aircraft models within the fleet should also be considered when implementing a power assurance system. If the data output of EMS/EHMS power assurance checks is provided to ground based stations and these stations perform data manipulation to determine engine health, then accuracy and repeatability of the ground based station should be verified and validated as well. G.7.4.1.5 Verification / Validation. EMS/EMHS system level requirements should be verified and validated IAW SAE ARP 4754, Sections 7 and 8. System integration testing should be performed in both laboratory and operational environments to verify and validate the functional performance of 132