AMC1 29.1465 Vibration health monitoring

(a) Introduction

(1) VHM systems are typically intended at increasing the likelihood of detection of dynamic component incipient faults in the rotors and rotor drive systems whose progression, if undetected, could prevent continued safe flight or safe landing.

(2) A VHM system typically features airborne and ground segments which, depending on the design and intended functions of the system, may include vibration sensors and the associated wiring, airborne electronic hardware for data acquisition and processing, and means for the storage, transfer and display of data. For the purpose of this AMC, the associated instructions for operation of the system should also be considered as part of the VHM system.

(3) A VHM system may be used to fulfil a number of functions (VHM applications), each including a range of components and their associated kinds of damage or degradation being monitored, which may eventually, if undetected, lead to a failure. The three main VHM system purposes or kinds of VHM applications considered within the scope of this AMC are the following:

(i) Supplementary information (‘no hazard/no credit basis’)

VHM system applications providing ‘supplementary information’ are considered those that monitor rotorcraft components whose failure is adequately mitigated by other compensating provisions specified and evaluated as part of the certification of the product. Therefore, they are not required as part of the minimum type design definition to be certified in accordance with CS-29. When such VHM system is installed, approval of the installation with applicable certification specifications is required, nonetheless.

(ii) In support of compliance with an operational regulation (i.e. currently referring to Regulation (EU) No 965/2012)

VHM system applications in support of compliance with an operational regulation also monitor rotorcraft components whose failure is adequately mitigated by other compensating provisions. However, they provide an additional safety benefit that is required for certain kinds of rotorcraft operations that typically entail greater risk (e.g. offshore operations). Following the approach described in this AMC is intended to ensure that such VHM applications ensure such additional safety benefit by means of an increased likelihood of early detection of incipient failures.

(iii) Airworthiness-related purposes (credit applications)

VHM systems with airworthiness-related purposes, also referred to as credit applications or VHM applications for credit, are also addressed in this AMC and in GM1 29.1465. Such VHM system applications may be relied upon:

(A) to minimise the likelihood of occurrence of hazardous or catastrophic failures of the rotor and/or rotor drive systems components, as identified in the design assessments of CS 29.547(b) and/or CS 29.917(b),

(B) to complement or replace continuing airworthiness tasks[17] or flight manual procedures[18] required to ensure safe operation of the rotorcraft, and/or

(C) used as approved equivalent means, in accordance with CS 29.571/573, to prevent catastrophic failures as a result of fatigue cracking.

The applicant should specify the applications to be covered by the VHM system and the components involved in each application.

(4) The purpose of this AMC is to provide an acceptable means of compliance for the design and certification of VHM applications. Designing a VHM system and demonstrating its compliance with CS 29.1465 in accordance with this AMC is expected to achieve the required performance together with acceptable levels of system integrity and reliability for the system to adequately fulfil its intended functions.

Note: FAA AC 29-2C Miscellaneous Guidance (MG)15, which addresses the use of health and usage monitoring systems (HUMS) in maintenance, is no longer recognised for the purpose of VHM system certification within the EASA framework. The scope of MG 15 for what refers to VHM systems is now addressed by this AMC. For HUMS other than VHM, applicants should consider this AMC as relevant guidance, although sections may require adaptations.

(b) Explanation

(1) CS 29.1465 does not mandate the fitment of VHM systems. However, if a VHM system is installed in one of the following scenarios, then compliance with CS 29.1465 is required when:

(i) as per (a)(3)(iii), the VHM system is required to perform specific functions relevant to ensure the airworthiness of the rotorcraft (i.e. credit applications);

(ii) as per (a)(3)(ii), the VHM system is used as a means of demonstrating compliance with an operational regulation requiring helicopters to be fitted with a VHM system and operators of such helicopters to implement procedures covering data collection, analysis and determination of condition.

(2) Systems installed for supplementary information purposes, described in (a)(3)(i) above, do not need to comply with CS 29.1465. In addition, the VHM system’s documentation for operators, including the ICA (if any) or other maintenance instructions, should clearly:

(i) state the purposes for which use of the system is approved,

(ii) specify that no safety benefit is obtained from the installation of the system, and

(iii) ensure that no complete or partial replacement of other existing continuing airworthiness tasks, upon which the airworthiness of the rotorcraft depends, may result.

However, the applicant may request compliance with CS 29.1465 on a voluntary basis; for example, to meet a customer requirement or a company objective. This is a recommended approach in order to ensure a minimum standard and state of the art in VHM systems.

In any case, the applicant should ensure that the installation of any VHM system does not significantly interfere with the air operations and/or continuing airworthiness of the rotorcraft.

(3) CS 29.1465(a) specifies that the design and performance of a VHM system should be appropriate in order to provide reliable means of early detection for the identified failure modes being monitored for the intended applications of the system. This specification applies to any VHM system for which compliance with CS 29.1465 is requested. This AMC provides specific objectives and considerations for VHM systems to be approved in support of compliance with an operational regulation and for systems with credit applications.

(4) In addition, where a VHM system is used as a means of demonstrating compliance with an operational regulation, CS 29.1465(b) is also applicable. This paragraph aims to ensure that the scope of the monitoring performed by the VHM system, and the monitoring techniques used provide an increased likelihood of early detection of incipient failures.

(5) The safety analysis required by CS 29.1465(b)(1) is limited to the mechanical systems being monitored by VHM. Since rotors and/or rotor drive systems are typically addressed, the design assessments performed in compliance with CS 29.547(b) and CS 29.917(b), respectively, can be used as a basis for this purpose. All component failure modes that could prevent continued safe flight or safe landing (catastrophic and hazardous failures) and for which VHM could provide a reliable means of early detection must be identified. Previous experience together with the guidance in this AMC and GM1 29.1465 should be used to determine failure modes that could benefit from VHM and the applicable techniques that can produce reliable indications in case of damage or degradation.

(6) CS 29.1465(b)(2) requires the design and performance of the VHM system to consider indicators and processing techniques used on typical existing VHM applications for similar components. A non-exhaustive list is provided in Table 1 of GM1 29.1465. Applicants choosing to comply with CS 29.1465 for VHM systems installed on a ‘no hazard/no credit basis’ are recommended to take this subparagraph into consideration as part of their compliance demonstration.

(7) CS 29.1465(b)(3) states that VHM must be provided as identified in subparagraphs (b)(1) and (b)(2) unless other means of health monitoring can be substantiated. For many failure modes there may be other compensating provisions which can provide protection against the risk of premature failure. In such cases, it is expected that VHM will provide an added benefit by increasing the likelihood of early detection. However, the implementation of VHM for a given component or failure mode will not be necessary if no safety benefit may be established from it. For the purpose of establishing the safety benefit of implementing VHM, the applicant should also consider the capability that the system may achieve after introduction into service through the gathering of data from the fleet and the development of improved indicators and alerting criteria.

(c) Procedure

Any VHM system to be installed in a rotorcraft must, regardless of its intended applications, comply with the applicable certification basis. In accordance with CS 29.1301, the VHM system must be of a kind and design appropriate to its intended function and must function properly when installed. For this purpose, the design considerations listed in GM1 29.1465(b) may be taken into account.

In addition, for any VHM system to be approved in support of compliance with an operational regulation and/or to fulfil an airworthiness-related function, as stated in (b)(1) above, compliance with CS 29.1465 is required.

This AMC addresses the compliance demonstration for VHM systems installed for these purposes as described in Figure 1 below.

Figure 1 Structure of AMC1 29.1465 grouped by compliance demonstration aspects

(d) VHM system safety objectives

(1) Scope

This section describes an acceptable approach to determine the VHM system failure severity and the identification of its corresponding safety objectives, complementing CS 29.1309 and associated guidance. As previously stated, VHM systems typically consist of airborne and ground segments, and this section shall be considered as applicable for the end-to-end system for the purpose of establishing its safety objectives. The compliance demonstration should then be completed in accordance with the following:

(i) The compliance demonstration activities to be followed as part of the VHM system compliance demonstration for airborne equipment and the associated installation are the same as for any other airborne equipment.

(ii) For the ground segment, paragraph (i) of this AMC provides details regarding the determination of compliance with the corresponding system safety objectives considering that CS-29 certification specifications are not directly applicable. This section also considers that the ground segment of VHM systems typically contains COTS hardware and software.

(2) Evaluation of the VHM system

Safety assessment methods should be applied to identify the potential failures of the components being monitored and of the VHM system functions and determine their severity. Since establishing the severity of VHM system failures may be subject to interpretation, the following considerations[19] are provided in support of the evaluation of the severity of the VHM system failures. These considerations apply to any loss of function and/or malfunction of the VHM system that may prevent detection of a potential incipient failure before it progresses to its ultimate failure consequences:

(i) Based on the intended function of the VHM system, the applicant should consider that, for the purpose of establishing the safety objectives to be achieved, the severity of any such VHM system failure impacting applications for credit or in support of compliance with an operational regulation should not be lower than minor.

(ii) When the VHM system features applications for credit, the applicant should:

— identify possible degraded conditions (i.e. types of damage or degradation) to be monitored,

— evaluate the severity of their ultimate failure consequences, when undetected, and

— assign to the VHM system adequate safety objectives.

When assigning the VHM system safety objectives, the applicant may consider alleviating factors, described in (3) below. These are elements that reduce the extent of reliance on the VHM system towards ensuring the airworthiness of the rotorcraft, which typically include:

— mitigating actions, described in (3)(i) below, and/or

— the probability of occurrence of any possible preceding degraded conditions, described in (3)(ii) below.

Following the evaluation of these alleviating factors, the applicant may propose system safety objectives for VHM systems featuring applications for credit in accordance with the process described in (4) below.

(3) Alleviating factors

(i) Mitigating actions

This term refers to continuing airworthiness tasks including maintenance tasks, and inspections, as well as alternative means of monitoring that are fully independent from VHM. These may be implemented and demonstrated to adequately monitor the affected part(s) in parallel with VHM monitoring in support of preventing the mechanical failure addressed by the credit application.

Any mitigating action implemented in parallel to a VHM application for credit should be demonstrated to be capable of detecting the mechanical conditions that may indicate the presence of damage or degradation. The applicant should consider the detection capability, the time between possible detection and ultimate failure; as well as, when applicable, the periodicity of the mitigating actions. It should be demonstrated that:

(A) the minimum mitigating actions provide a minimum of one opportunity to detect the degrading condition of the part. This should be understood as the completion of one inspection or one review of any indications from alternative monitoring means, within an interval in which they are justified to clearly detect the incipient failure;

(B) alternatively, extended mitigating actions, which should ensure two or more opportunities of detection, may be demonstrated to justify a greater alleviation.

For this evaluation, the applicant should consider:

— failure progression characteristics taking into account the considerations provided in (g)(2)(i)(A); and

— the detection capability of the mitigating action in question, derived from service data and/or test results, to establish the point at which the incipient failure will be detected.

(ii) The probability of occurrence of any possible preceding degraded conditions

Typically, VHM systems rely on the principle of a degraded condition preceding the failure generating a mechanical response, which can be detected by the vibration signals acquired and processed. These early signs of damage or degradation typically initiate naturally due to the normal operation of dynamic components and particularly in the presence of minor defects (e.g. indents, micropits, etc.) or slightly altered operating conditions (e.g. misalignment, wear, etc.). Such preceding degraded conditions usually develops by means of continuous operation, potentially becoming detectable at a certain point, while, if not detected, it may eventually lead to an ultimate failure.

The applicant may choose to justify that the likelihood of initiation of any possible degraded condition that may progress and ultimately lead to a failure is sufficiently low to support an alleviation of the VHM system safety objectives. For this purpose, the applicant should establish that the probability of occurrence of any preceding degraded condition is no greater than:

— 1E-05 per flight hour for catastrophic failures,

— 1E-04 per flight hour for hazardous failures, and

— 1E-03 per flight hour for major failures.

(A) As part of the determination of the probability of occurrence, the applicant should:

(a) identify the degraded conditions from which it is considered probable that such a failure may develop within the exposure time of the affected parts to operation. For this purpose, the applicant should rely on all available data, including but not limited to service experience, incidents and accidents, literature review and applicable test data. In addition, the applicant should consider that dedicated testing may be needed in support of confirming whether specific degraded conditions are likely to lead to a failure;

(b) determine whether a safety factor should be taken into account for uncertainties and/or to compensate for limited data. Uncertainties may include instances where service experience from similar designs is used or when there is a need to improve the confidence in the applicability of the probability of occurrence determined for the complete life of the product. Compensation for limited data may be needed when directly applicable service experience is only just enough to demonstrate the target probability of occurrence or when not all environments/types of operation are covered by the available data;

(c) consider the effects of intrinsic flaws that may be present in the part or assembly. Only those flaws that would not be detected by quality controls and/or acceptance tests need to be taken into account;

(d) detail the parameters and controls (including design, manufacturing, quality, assembly, handling, and maintenance practices) of the affected part that support the determination of the low probability of occurrence of any preceding degraded condition demonstrated at the time of the approval. This should confirm that this probability is valid and that it will not increase during the life of the product. The applicant should describe these parameters and controls and justify their adequacy based on service experience, state-of-the-art practices and safety margins;

(e) take into consideration any changes to the replacement, inspection or overhaul intervals of the affected components that may be implemented within the period used to gather the necessary service experience for this demonstration. This should verify that none of these changes may impact the validity of the probability of occurrence justified. For example, the affected part may be replaced at a certain interval, which in turn would affect its exposure to operation in the presence of defects. As a result, the data being considered for this evaluation may not be conservative if the affected part is planned to be replaced at a greater interval following introduction of VHM.

(B) In order to determine the level of alleviation that may be proposed, the applicant should evaluate the data supporting the determination of this low probability of occurrence and identify whether:

(a) it relies on directly applicable service experience. This would require sufficient operating time to be accumulated and the necessary inspections, investigations and analyses to be performed on the in-service fleet. This approach would generally result in high confidence in the probability of occurrence derived;

(b) alternatively, it mainly uses service experience from similar designs. The use of service experience from similar designs should be justified as applicable considering the design characteristics, manufacturing and quality controls, and operating conditions. This approach would generally result in lower confidence in the probability of occurrence derived.

(4) Identification of the VHM system safety objectives

As described in (2) the applicant may take into consideration alleviating factors from those described in (3) to determine the VHM system safety objectives. When this approach is taken, the process described in this section supports the identification of the corresponding safety objectives.

The applicant should assess the complete set of alleviating factors featured by the VHM application for credit, as described in (3). Based on this, the applicant may identify which case from those described in Figure 2 below corresponds to the VHM system for which approval is sought.

Based on the case identified in Figure 2 and the severity of the undetected mechanical failure, the applicant should identify the safety objectives. The quantitative (numerical probabilities) and qualitative (FDAL) objectives are provided in Figures 3 and 4, respectively. Examples of the use of Figures 2, 3 and 4 below are provided in GM1 29.1465(c).

Figure 2: Identification of cases for alleviation of the VHM system safety objectives based on mitigating actions and probability of occurrence of any possible preceding degraded condition

Figure 3: Quantitative safety objectives identified as a function of the severity of the undetected mechanical failure and the case for alleviation of the VHM system safety objectives from Figure 2

When the alleviating factors identified for a particular VHM application fall between cases (i.e. between Cases 1 and 2 or between Cases 2 and 3), the applicant may propose quantitative safety objectives commensurate with the Cases between which it sits. For example, this occurs when the probability of occurrence is established with high confidence (as specified in (3)(ii)(B)(a)), but at a probability below the values specified in (3)(ii) (i.e. equivalent to something in between Cases 2 and 3). Examples of how this can be approached are provided in Figures 4 to 6 in GM1 29.1465(c).

Figure 4: Qualitative safety objectives (FDAL) identified as a function of the severity of the undetected mechanical failure and the case for alleviation of the VHM system safety objectives from Figure 2

The safety objectives specified in Figures 3 and 4 should be allocated to any loss of function and/or malfunction of the VHM system that may prevent detection of a potential incipient failure before it progresses to its ultimate failure consequences. This typically includes failures such as undetected loss of monitoring and/or undetected erroneous data, which may remain dormant for intervals that could preclude at least one opportunity of detection by VHM.

(5) Implementation of safety requirements

The safety objectives to be met by the VHM system should establish the confidence that development errors have been minimised with an appropriate level of rigour, and system failure rates have been reduced to acceptable levels in accordance with CS 29.1309. EUROCAE ED-79B / SAE ARP 4754B is recognised as providing additional guidelines for establishing both safety assessment and development assurance processes. Further guidance regarding expected validation and verification activities are provided in paragraphs (f), (g), (h) and (i).

(e) Monitoring approach

The monitoring approach of a VHM application includes all the elements of the VHM system that ensure that its objectives are fulfilled. It encompasses any element of the VHM system design, installation and documentation which are defined in support of achieving the demonstrated fault detection performance.

The signal processing techniques, condition indicators and alerting criteria represent key elements of the monitoring approach, whose suitability is to be substantiated as part of the fault detection performance demonstration. In addition, other relevant elements focus on ensuring that VHM data is acquired, and indications are provided at appropriate intervals, as well as on allowing for the management of these indications to determine the condition of the monitored components. These are also important to ensure that the targeted fault detection performance is achieved. To ensure that a robust monitoring approach is defined in support of consistently achieving the necessary performance, the following elements should be considered:

(1) Signal acquisition

The acquisition cycle should be designed in such a way that all selected components and their failures are adequately monitored at an appropriate frequency irrespective of any interruptions in the cycle due to the operational profile. For this purpose, the sensitivity, dynamic range and bandwidth needs of the signal acquisition of each monitored component should be taken into consideration. Furthermore, the applicant should minimise the impact on the indicator values from the operating conditions in which the vibration signals are acquired.

The acquisition cycle should be justified as appropriate for each of the intended VHM applications of the system. Based on the acquisition cycle and the requirements of the applications of the VHM system, the applicant should define a recommended and a minimum frequency of data collection.

Whenever possible, the applicant should target a VHM system design capable of producing complete and reliable diagnostics in every flight with a defined duration in stabilised conditions that allow for signal acquisition. As general good practice, at least one data set for all components should be obtained on each flight of greater than 30 minutes in stabilised conditions without the need for in-flight pilot action.

For every VHM system application, but especially for those requiring more data than one full acquisition cycle, the acquisition cycle, minimum frequency of data collection and associated ICA should ensure that sufficient acquisitions are available at least at each maximum data review interval.

(2) Data storage

All the data sets acquired should be stored at least until successfully transferred to the ground-based system or until any indications have been provided and acted upon, as applicable.

The storage capacity should be sufficient to support the needs of the intended VHM applications. For VHM systems for which the storage capability may be exceeded, an indication should be provided before the maximum storage capacity is reached to prevent the loss or overwriting of VHM data.

In addition, the applicant should consider defining VHM data record-keeping means to support fault isolation processes, CSI data gathering and VHM system performance monitoring and improvement, as required.

Additionally, best practices addressing VHM data storage are provided in GM1 29.1465(d)(3).

(3) Data transfer and review

The applicant should define a recommended and a maximum interval between VHM data reviews (MIDR) that ensure that the objective of each application of the VHM system is fulfilled. The interval at which the VHM data is reviewed should be adequate to support the objectives of the applications of the VHM system. The necessary means and procedures should be defined to ensure that the VHM data is available and reviewed, and any alert acted upon within this interval. The design of the system and the associated procedures should ensure that sufficient data is available at every MIDR to process any alert and perform a complete VHM data analysis that may be required in support of fault isolation.

When the VHM system relies on downloading the VHM data to a ground-based system, the applicant should, in addition, define a recommended and a maximum interval between data downloads that ensure that sufficient data is available at the MIDR. The download intervals defined should ensure that the system memory capacity is not exceeded considering the maximum data points that may be accumulated.

In addition, the applicant should minimise the impact from VHM system data downloads and uploads on flight operations. The applicant may choose to add to the VHM system the capability to allow for a complete VHM data review during rotors running turnarounds to fulfil this purpose or customer objectives.

If a complete data set is not recorded, and unless indicated in an alternative way, the data transfer process should be capable of downloading a partial data set to the ground-based system and highlight it as such to the user. The necessary procedures to be followed should be provided in the ICA.

Additionally, best practices addressing VHM data transfer and review are provided in GM1 29.1465(d)(3).

(4) VHM alert generation

VHM indicators and associated alerting criteria should be provided for every monitored component to ensure that the identified applications of the VHM system meet their intended objectives. For this purpose, VHM systems generally rely on their ground segment as the means to provide the necessary alerts. When cockpit indications are included as part of the intended system applications, the applicant should also take into account the considerations provided in paragraph (m) of this AMC.

The applicant should design the VHM system to produce the necessary alerts when an anomalous behaviour indicating that damage or degradation may be present on any monitored component to ensure that this condition is timely identified, and the monitored system restored to a serviceable condition within an acceptable interval. In order to ensure that alerts are also reliable, the applicant should consider whether different alerting criteria need to be set, e.g. as a function of the operating conditions in which the signals are acquired.

The applicant should establish the role for each of the VHM indicators computed by the VHM system regarding the need to produce alerts. In general, it is expected that the VHM indicators may be used for alerting purposes or in support of VHM data analysis as part of fault isolation procedures following an alert produced by a different indicator.

When defining the alerting criteria, the applicant should determine the conditions that need to be fulfilled to raise an alert considering:

(i) the characteristics of the failure mode to be prevented and of the part/assembly monitored;

(ii) the characteristics of the vibration signal that may be produced as the failure progresses; and

(iii) the objective of the VHM system application and the associated proposed monitoring approach.

Additional details regarding the aspects the applicant may rely on for the definition of alerting criteria and considerations for categorisation of alerts are provided in GM1 29.1465(d).

(5) VHM alert management

For each alert generated by the VHM system, the applicant should ensure that:

(i) the information needed to isolate and address the fault through the instructions included in the ICA (see paragraph (j)

(A) identification of the part or assembly concerned,

(B) establishment of the priority of the alert (see GM1 29.1465(d)(2) for additional details), and

(C) determination of how to proceed, which may include further VHM data analysis as well as instructions necessary for fault-finding and restoring the affected components to a serviceable condition;

(ii) an indication is clearly prompted upon to the crew and/or personnel involved in the continuing airworthiness any time an alert is generated;

(iii) this indication is readily and easily accessible and intelligible; and

(iv) it can be removed when the alerting conditions no longer exist and there is no need to keep it active (e.g. for tracking past indications).

(f) Demonstration of performance

(1) Fault detection performance

The applicant should design the VHM system and define a monitoring approach that achieves adequate fault detection performance for each of the intended system applications.

The fault detection performance should be demonstrated for each VHM application by appropriate means, as defined in (2) below, addressing the following aspects:

(i) The progression of the degraded condition (failure progression) to be detected by the VHM system is well understood and justified to feature a detectable stage of damage or degradation that will systematically precede the failure.

(ii) This degraded condition will produce a mechanical response, whose signal(s) may be acquired and processed into indicators that are capable of highlighting an abnormal behaviour in case of damage or degradation by means of the proposed monitoring approach.

(iii) The VHM system will provide indications that are capable, in combination with the associated alert management procedures, of detecting and isolating the fault.

(iv) The computed indicators are reliable and representative of the condition of the elements monitored providing a high probability of distinguishing between ‘healthy’ and ‘degraded’ elements (i.e. likelihood of fault detection).

(v) The capability of the monitoring approach to, in addition, deliver a false alarm rate that does not impair or compromise the operability and maintainability of the rotorcraft (further guidance may be found in Table 2 in GM1 29.1465(g)).

(vi) The reliability of the end-to-end process.

(2) Performance demonstration process and means

The applicant should demonstrate how the monitoring approach provides acceptable performance for each of its intended applications. This section provides details regarding means and methodologies to be used to complete this demonstration prior to its approval by the Agency.

(i) Performance demonstration methodology

The applicant should define a demonstration methodology based on an adequate combination of performance evaluation means, which are described in (ii)(A) and (B) below. The performance demonstration methodology may identify data from the CSI in support of confirming the performance of the VHM system; this is described in more detail in paragraphs (g) and (h). This methodology should define the means proposed for the demonstration of performance and justify that it is adequate considering its intended applications.

Given the nature and configurations of parts and assemblies monitored by VHM and the complexity of the mechanical signals being monitored, it is typically not practical to fully verify the performance of the VHM system for all parts or assemblies and associated degraded conditions by means of representative tests or in-service data. As a result, the demonstration of the VHM system performance may rely on certain assumptions involving aspects such as the characteristics of the failure progression or the variability and/or scatter of the acquired signals. The applicant should ensure that these assumptions are conservative and well supported by experience from tests or service experience, as well as defined, validated and verified as per the objectives under 4.2 of Appendix A to SAE ARP 4754B/EUROCAE ED-79B. In addition, the applicant should ensure that these assumptions are confirmed within the CSI phase as described in paragraph (k) of this AMC.

The demonstration of performance should be commensurate with the applications of the VHM system. Thus, approval of VHM systems that do not fulfil an airworthiness-related function may be granted, in accordance with the approach described in this AMC, with limited or no supporting data from service and/or dedicated tests.

For applications for credit, given that these applications are relied upon to ensure the airworthiness of the rotorcraft, a minimum set of data from dedicated tests and/or directly applicable service experience is expected for certification. Further details are provided in paragraph (g) of this AMC.

Considering this, the performance demonstration methodology should focus on providing evidence substantiating that:

(A) a degraded condition producing a repeatable and detectable vibratory response will systematically precede the failure; and

(B) the processing of the signals acquired will generate appropriate indicators capable of indicating the presence of damage or degradation, at an acceptable point prior to the failure.

Additionally, consideration should be given to the need to collect and evaluate in-flight data to address more complex aspects of the demonstration of performance. These aspects include impact from parameters such as rotorcraft to rotorcraft variability, operating conditions, assembly variations or maintenance on the vibratory responses from monitored components and the evaluation of any possible effects on the performance.

(ii) Means used for the performance demonstration

The following means should be used to substantiate the performance of a VHM system by generating evidence demonstrating that the monitoring approach meets the required fault detection performance for the intended applications of the system:

(A) Direct evidence

— Actual service experience on VHM-equipped rotorcraft of the same or of similar type and configuration, including information from overhauled assemblies, component removals, inspections and other investigations.

— Results from tests in which the failure being monitored is naturally developed or simulated through seeded defects.

— Rotorcraft trials, investigating cause and effect (for example, introducing degrees of imbalance or misalignment and calibrating the techniques response).

(B) Indirect evidence

— Evidence as to the provenance of the technology, the monitoring principles and capabilities provided and their suitability for the intended application.

— Reference to adequate performance in other applications and justification of the applicability of those conclusions for the intended application.

— Modelling of the processes involved in the generation of the vibration signal and analytical evaluation of the VHM system processing used for the computation of the indicators.

(g) VHM applications for credit — Demonstration of performance

(1) Definition of the airworthiness-related purpose (credit)

As an initial step, the applicant should clearly define the airworthiness-related purpose (credit) intended for the VHM system for which approval is sought. The information provided should support the determination of the adequacy of the VHM system safety objectives allocated and of the proposed methodology for the demonstration of performance. The information provided should include the following:

(i) parts/assemblies being monitored and those for which the credit approval is sought;

(ii) failure modes of the corresponding parts/assemblies being monitored and associated severity;

(iii) degraded condition(s) and associated mechanical response(s) of the part/assembly that will be monitored to detect the incipient failure identified as per (ii) above;

(iv) description of the credit sought, including the kind of credit (i.e. as described in paragraph (a)(3)(iii) of this AMC);

(v) in addition, when possible, any additional information that may be defined during demonstration of compliance or depend on its outcome, but for which the applicant may have set specific targets for the development of the VHM application. This may include:

(A) extent of the credit sought (e.g. increase of an inspection interval from 10 to 100 flight hours);

(B) description of the proposed monitoring approach including any mitigating actions; and

(C) preliminary rationale for the proposed monitoring approach as an adequate means for the intended credit application and basis for the demonstration of performance.

(2) Performance demonstration methodology

The applicant should define a performance demonstration methodology featuring an adequate set of direct evidence. The methodology should consider the severity of the mechanical failure being prevented, the characteristics of the degraded condition as it progresses, the targeted likelihood of detecting potential incipient failures and any other aspects of the VHM application that may affect the demonstration of performance.

Direct evidence should be defined, developed and analysed to evaluate the fault detection performance aspects described in (i) below. The set of direct evidence data points provided should substantiate that adequate performance objectives are met (references are specified in (ii)). In addition, (iii), (iv) and (v) provide guidance on the kind of and how to determine the number of the direct evidence data points for a specific application. Figure 5 below summarises the structure of the guidance provided regarding the performance demonstration methodology for applications for credit.

Figure 5: Structure of the AMC sections addressing the performance demonstration methodology for VHM applications for credit

(i) Performance demonstration aspects

(A) Characteristics of the failure progression

The applicant should demonstrate that the failures to be prevented by a VHM application for credit have acceptable characteristics for the intended credit application.

Sufficient time should be demonstrated between the point at which the damage or degradation associated with potential incipient failures becomes clearly detectable by VHM and the ultimate failure consequences (i.e. prognostic interval (PI)). For this purpose, the applicant may investigate the failure progression up to its ultimate consequences or simply demonstrate that within a specified period of operation the detected incipient failure will not progress to ultimate consequences. This demonstration should consider how the failure may progress, evaluate the variability and scatter it may be subject to, and quantify their impact.

For this demonstration the applicant may already have well defined and established processes (e.g. for applications addressing the fatigue tolerance evaluation in compliance with CS 29.571/573). In such cases the applicant may propose to follow these. Alternatively, in case no established process is available, the following should be considered:

(a) Conservative test conditions should be defined based on the available understanding of the failure progression.

(b) Possible impacts of the progressing damage or degradation on surrounding elements should be considered.

(c) Additional tests should be considered to assess parameters affecting the variability of the failure progression. These may include any operating-, assembly-, manufacturing-, or environmental-related aspect that may impact the rate and way in which the failure progresses. Other aspects may include the characteristics (e.g. type, size, shape, orientation, etc.) of the damage or degradation.

(d) When it is not practical or technically feasible to evaluate all parameters that may impact the failure progression and/or when significant scatter is established, additional measures of conservatism may be needed. These measures may include additional conservatism applied to testing conditions and/or safety factors applied on conclusions from test results and service data.

(e) In cases where the failure progression is evaluated up to ultimate failure consequences, it should be established whether the failure progression reaches a condition from which further damage or degradation may no longer be reliably understood or conservatively evaluated, or from which the probability of detection reduces. In such cases, this point should be considered as the condition in which ultimate failure is reached.

(B) Likelihood of fault detection of the proposed monitoring approach

The likelihood of fault detection should be understood as a qualitative evaluation of the probability of the proposed monitoring approach to indicate the presence of damage or degradation at a specific point in the failure progression. In order to perform this evaluation and establish its adequacy for the intended VHM application, the applicant should pursue the following objectives:

(a) It should be demonstrated that the acquired and processed signal(s) produce consistent and reliable indicators that enable detection of the degraded condition. This should be achieved through the physical understanding of the mechanical response of the failure progression on the components being monitored and the characteristics of the VHM system. This detectable mechanical response should be demonstrated to occur systematically at some point within the failure progression and provide adequate likelihood of fault detection for the demonstrated PI.

(b) An adequate likelihood of fault detection should be ensured even for the worst foreseeable scenario from a detection point of view. This worst foreseeable scenario should be considered as a hypothetical failure progression with characteristics that result in the lowest likelihood of detection by the proposed monitoring approach. To establish this worst foreseeable scenario, the applicant should:

(1) consider the possible scenarios of failure progression, including the range of characteristics of the associated degraded conditions that may be present, how they may evolve and how they may affect the likelihood of detection;

(2) determine the maximum expected variability and scatter of the mechanical responses on the computed indicator values.

(c) For objectives (a) and (b) listed directly above, the following apply:

(1) Direct evidence data should be justified to simulate degraded conditions covering an adequate range of the possible mechanical responses generated by the failure progression.

(2) Sources of variability affecting the monitored signal(s) such as rotorcraft-to-rotorcraft, assembly, maintenance, and operating conditions should be considered. The applicant may justify that these do not significantly affect the likelihood of detection of the incipient failure. Alternatively, any sources of variability that may have a significant impact should be adequately characterised, which may require additional testing.

(3) The applicant should also consider the impact from scatter and noise signals that may be present on the rotorcraft.

(4) Only limited data from tests and/or in-service events is typically available or developed for the evaluation of the fault detection performance. Therefore, the applicant should consider service data from similar VHM applications, additional testing and/or safety factors to establish a conservative measure of the variability and scatter at the different stages of the failure progression.

(ii) Specific performance objectives

Note: The reference values provided in (A) and (B) below are approximate standards to be generally considered for VHM systems featuring credit applications. However, the applicant should consider that these may not be adequate for every application. For example, the applicant may need to fulfil more demanding objectives in cases where these reference values are not enough to meet the safety objective of a particular application. In addition, the applicant may also propose less demanding objectives in cases where, for example, mitigating actions are used in parallel to the VHM application for credit.

(A) Prognostic interval

The shortest PI expected to be experienced should be evaluated in accordance with (i)(A) above.

This PI should be demonstrated to ensure a minimum of three opportunities of detection when compared with the MIDR.

PI ≥ 3 * MIDR

(B) Likelihood of fault detection

The likelihood of fault detection should be evaluated in accordance with (i)(B) above.

The applicant should demonstrate that, from the point the degraded condition is considered clearly detectable in any failure progression scenario, there will be very high chances of triggering an alert at each opportunity at which the condition indicators are assessed against the alerting criteria. An example of such demonstration is provided in GM1 29.1465(e).

(iii) Considerations regarding the direct evidence used for the demonstration of performance

(A) Direct evidence data points

The applicant should define adequate and sufficient direct evidence to complete the demonstration of performance for the aspects described in (i)(A) and (i)(B) above. Each individual element of direct evidence (i.e. test, in-service event, etc.) should be considered as a single data point.

The number of direct evidence data points needed for the demonstration of performance would typically depend on characteristics of the application such as the variability and/or the scatter exhibited by the failure progression and the likelihood of detection. The sufficiency of the direct evidence data points used may only be confirmed at the end of demonstration of performance. At this point, it should be verified that the performance demonstration aspects have been adequately addressed (see (i)(A) and (B)) and the performance objectives are met.

Nevertheless, it would typically be relevant for the applicant to be able to estimate the number of direct evidence data points at the beginning of the design and development of a VHM application for credit. In order to establish and justify the number of direct evidence data points initially planned for each performance demonstration aspect, the applicant may choose to:

— rely on established methods,

— follow the process described in Figure 6 below, or

— propose an alternative approach.

Established methods are expected to already be in place to assess the failure progression characteristics for at least certain kinds of failure mechanisms (e.g. fatigue cracking failures addressed by CS 29.571/573). In addition, when a VHM application for credit is introduced to replace other means of monitoring or continuing airworthiness task(s), the applicant may already possess data characterising the failure progression. In these cases, the applicant should evaluate whether the available data is adequate and sufficient to complete the demonstration without further testing.

In the absence of established methods, Figure 6 below, summarises the process described in (iv) to identify the ‘class’ of an application for credit and, based on this, the number of direct evidence data points, as specified in (v).

The applicant may choose to follow this process to determine the number of direct evidence data points which are considered to provide a reasonable level of understanding. This level of understanding should be sufficient to determine whether the performance demonstration aspects are sufficiently understood or, instead, additional evaluations are needed. In case this process is used, the applicant should consider GM1 29.1465(f) when evaluating whether the process is well suited to the specific characteristics of the VHM application for credit.

As a third option, the applicant may also propose a new alternative approach. The process described in Figure 6 below is considered generally suitable. Nevertheless, other approaches may also be adequate or even needed (see GM1 29.1465(f) for more details).

Figure 6: Proposed process for establishing a reference number of direct evidence data points for the evaluation of (i)(A) or (i)(B) performance demonstration aspects of a VHM application for credit

(B) Use of service experience as direct evidence data points

From the direct evidence means listed in (f)(2)(ii)(A) of this AMC, the applicant should generally consider each data point to correspond to one dedicated test (including bench tests and rotorcraft trials).

Tests should be considered unless service experience (data from in-service events detected by means of VHM monitoring) can be justified to be relevant for the VHM application and to provide comparable levels of information relative to a test optimised for this purpose. For example, testing makes possible the clear correlation of the kind and level of damage or degradation with the resulting vibration signals and indicator values, as well as the characterisation of the operating time to failure. In cases where this information can be adequately extracted from the available data or its absence is adequately mitigated by other tests, one test result may be considered replaced by the data from such in-service event.

(iv) Performance demonstration ‘class’ of a VHM application for credit

This section supports (v) below in providing an acceptable approach to establish the number of direct evidence data points to be used in the performance demonstration of a VHM application. This approach is conceived with a focus on the evaluation of the likelihood of detection considering that this aspect requires further guidance but is also considered adequate for establishing the number of data points for evaluating the characteristics of the failure progression, if needed (see note immediately after Table 2 in (v) below). In principle, this number should be established independently for the evaluation of the failure progressions characteristics and the likelihood of detection.

When determining the direct evidence data points required for each performance demonstration aspect (i.e. (i)(A) and (i)(B) above), the applicant should establish the performance demonstration ‘class’. The performance demonstration ‘class’ reflects the potential impact on safety as well as the likelihood of an incorrect assumption as part of the compliance demonstration for CS 29.1465. It takes into consideration the complexity of the application, the safety margins and any mitigating actions. ‘Class 1’ reflects the highest potential impact on safety, while higher ‘class’ numbers are used as this potential impact reduces.

To determine the performance demonstration ‘class’ of a VHM application for credit, the following points should be taken into consideration:

(A) The ‘complexity’ of the VHM application, which effectively represents the difficulty to adequately characterise the performance demonstration aspects considering the variability and scatter they are subject to, as well as the number of parameters that have an influence.

(a) ‘Complexity’ from a failure progression characteristics point of view

The applicant should evaluate the repeatability and capability to reach a good understanding of the failure progression characteristics. In order to support this demonstration for ‘non-complex’ VHM applications, it should be demonstrated that the variability can be understood and that the scatter is limited. For this purpose, the applicant should consider the following:

(1) Test results at similar conservative operating conditions and comparable parameters should be assessed.

(2) The maximum scatter (i.e. obtained from comparable data) for a ‘non-complex’ system should be limited to a factor of 10 between the maximum and the minimum operating times to failure.

(3) When a limited scatter of the rate of failure progression cannot be demonstrated or the variability and/or scatter evaluation are not performed in sufficient detail, the VHM application should be considered as ‘complex’ regarding its failure progression characteristics.

(b) ‘Complexity’ from a likelihood of detection point of view

In order to justify a VHM application for credit as ‘non-complex’, it should be clearly established that the indicator(s) for the degraded and healthy conditions result in clearly differentiated distributions. For this purpose, the applicant should:

(1) identify and quantify any significant source of variability impacting the likelihood of fault detection;

(2) consider that the application should be considered as ‘complex’ when:

— a high number of sources of variability are identified;

— some sources whose impact may be significant are not evaluated; and/or

— substantial scatter in the likelihood of detection is observed;

(3) consider that a ‘non-complex’ VHM application typically features:

— simple and industry proven system architecture and sensors;

— standard and industry proven processing techniques;

— vibration signals that are directly attainable with limited noise or interfering signals;

— vibrations signals that are understood to be a consequence of the damage or degradation and which can be translated into condition indicators; and

— a clear increase of the likelihood of detection as the failure progresses.

(B) The ‘category’ of the VHM application defines whether ‘standard’ or ‘enhanced’ performance objectives are achieved. An application of ‘standard category’ corresponds to one that meets the minimum performance objectives for an application for credit defined above in (ii). Alternatively, the applicant may choose to demonstrate higher performance objectives (i.e. for an ‘enhanced’ VHM application). The applicant should consider the following objectives as the minimum standard for a VHM application of ‘enhanced category’:

(1) Failure progression characteristics

An ‘enhanced’ VHM application should support the determination of a PI of no less than 6 times the MIDR.

PI ≥ 6 * MIDR

(2) Likelihood of fault detection

The performance of an ‘enhanced’ application should be justified, based on the available data, to ensure that, at each opportunity at which the condition indicators are assessed against the alerting criteria following the degraded condition becoming clearly detectable, a missed detection of a damaged or degraded component is extremely unlikely.

In addition, the applicant may choose to demonstrate objectives higher than those for ‘enhanced’ applications in order to justify a greater reduction in the number of direct evidence data points.

(C) Mitigating actions used in support of or in parallel to the VHM application, if any. The applicant should consider whether any mitigating actions defined as part of the monitoring approach would be sufficient, on their own, to detect an incipient failure, given their associated detection capability and periodicity in accordance with (d)(3)(i). When this is the case, the VHM application in question may be considered of a reduced ‘class’ (i.e. ‘Class 1’ would become ‘Class 2’).

Based on these criteria, the performance demonstration ‘class’ of a VHM application can be identified as follows:

Table 1: Determination of the performance demonstration ‘class’ for VHM applications for credit

This assessment may result in a different performance demonstration ‘class’ being identified for each of the aspects considered (i.e. failure mode characteristics and likelihood of detection) and, therefore, different expectations regarding the number of direct evidence data points for each.

(v) Definition of the number of direct evidence data points

The number of direct evidence data points should be established independently for the evaluation of the failure progression characteristics and the likelihood of detection.

In accordance with the considerations from (iii) above, each direct evidence data point should correspond to an independent test, unless it can be justified otherwise. Following the identification of the performance validation ‘class’ as described in (iv) above, the applicant may propose a number of direct evidence data points in accordance with Table 2 below. Additional considerations regarding the numbers specified in Table 2 and when they may need to be adjusted are listed in GM1 29.1465(f).

Table 2: Number of direct evidence points for the evaluation of each performance demonstration aspect for VHM applications for credit according to their ‘class’ classification

Note: The nature of the evaluation and the feasibility to ensure conservative results for certain kinds of failure may support alternative numbers of direct evidence data points relative to those provided in Table 2 above for the evaluation of the characteristics of the failure progression. Thus, when the applicant chooses to follow this process to establish the number of direct evidence data points to be used for this performance demonstration aspect, reduced numbers may be proposed provided that they are adequately justified. This should be based on the use of relevant testing conditions and safety factors, which should be proven by experience to render conservative results for the kind of failure being evaluated.

(3) Purpose of the controlled service introduction (CSI)

When defining the CSI plan for VHM applications for credit, the applicant should typically take into consideration the following:

(i) The performance demonstration methodology should identify the assumptions involved in the demonstration of performance requiring confirmation by means of evaluation of in-service data.

(ii) The in-service data necessary for confirmation of these assumptions should be specified accordingly and used in the preparation of the CSI plan (see paragraph (k) of this AMC for further details).

(iii) Unless otherwise agreed at the time of the approval, implementation of an approved VHM application for credit will not be subject to completion of the CSI. Thus, sufficient confidence in these assumptions should be provided for the certification of the VHM application for credit.

(iv) In case the applicant chooses to rely on information from the CSI phase to complete or complement the demonstration of performance for an application for credit, the following should be considered:

(A) This option may be of interest, for example, in cases where certain parameters affecting the characteristics of the failure progression and/or the likelihood of detection require significant testing on the rotorcraft. Thus, the understanding of their impact would be limited at certification, pending data from the CSI.

(B) It should be clearly established at the time of approval whether no credit or only partial credit is granted.

(C) In case partial credit is granted, this should be supported by means of appropriate safety factors in the demonstration of performance.

(D) The CSI plan may be used to record the preliminarily agreed activities to achieve granting of the full credit.

(E) Typically, implementation of the full credit will require a separate approval following gathering and evaluation of the in-service data.

(h) VHM applications in support of compliance with an operational regulation

This paragraph provides specific Acceptable Means of Compliance for VHM systems that are relied upon to support compliance with an operational regulation. These are expected to provide a minimum level of additional safety by increasing the likelihood of early detection of incipient failures. Nevertheless, applicants developing VHM systems on a ‘no hazard/no credit basis’ are advised to follow the content of this AMC, including subparagraph (2) of this section as guidance for establishing adequate system performance.

(1) Monitoring scope

In order to substantiate that the VHM system provides the aforementioned additional safety, the applicant should demonstrate that the scope of components being monitored is in line with that defined in the operational regulation that the system is intended to support compliance with.

For point SPA.HOFO.155 of Regulation (EU) No 965/2012, the scope is defined as ‘critical rotor and rotor drive systems’ and further clarified in associated AMC as ‘rotating critical components’. This should be understood as parts of the rotors and rotor drive systems, the failure of which could prevent continued safe flight or safe landing, or whose failure could have catastrophic and/or hazardous consequences.

As specified in CS 29.1465(b)(3), VHM may not be required for some of these parts, provided that alternative means of monitoring are provided. For many failure modes, there may be other compensating provisions which can provide protection against the risk of premature failure. Nevertheless, the purpose of operational regulations that mandate the fitment of VHM systems is typically an additional safety benefit by means of an increased likelihood of early detection of incipient failures. However, it will not be necessary to implement VHM for a given failure mode if no safety benefit may be established. For establishing the safety benefit of implementing VHM, the applicant should consider the capability that the system may achieve after introduction into service through the gathering of data from the fleet and the development of improved indicators and alerting criteria.

In addition, CS 29.1465(b)(3) also states that other means of health monitoring need to be substantiated when VHM monitoring is not provided for components within the scope of the operational regulation requirements. Such other means of health monitoring may be any alternative system (e.g. chip detection, temperature monitoring, etc.) or continuing airworthiness tasks which are demonstrated to adequately identify the presence of damage or degradation on these components.

(2) Demonstration of performance

Adequate performance should be demonstrated in accordance with paragraph (f) of this AMC. Additional considerations are listed below taking into account that the demonstration of performance is to be commensurate with the role of the VHM system from an airworthiness perspective:

(i) The applicant should define the necessary indicators and alerting criteria to ensure that all components specified in the scope defined in (1) above are adequately monitored taking into account the failures to be prevented as identified in the safety analysis required by CS 29.1465(b)(1). When doing this, the applicant may experience difficulties to ensure that the defined criteria are effective to prevent premature failure while maintaining acceptable false alarm rates without applicable and representative direct evidence. This may be the case of, for example, rotor or rotor drive system components whose condition indicators are too low or too scattered, preventing the definition of appropriate learnt thresholds, and for which representative computed indicators from healthy and eventually also degraded components are required to define effective and reliable fixed thresholds or threshold learning algorithms.

Therefore, in support of the definition of alerting criteria for VHM applications for compliance with an operational regulation, the applicant should consider the following:

(A) For those components for which experience has shown that thresholds defined in the absence of applicable test or in-service data of a component subject to damage or degradation are not reliable and/or effective, the applicant may propose to approve the system without defined alerting criteria for those components (see (3) below for further guidance on establishing alerting criteria during the CSI).

(B) Data gathered from service should be statistically analysed to ensure that the alerting criteria are adequately set to indicate the presence of damage or degradation. This may require the evaluation of components replaced or repaired due to a VHM alert to verify that their condition was in line with the VHM indication.

(C) VHM data from components identified through other means as damaged or degraded and whose condition should have been indicated by the VHM system should be investigated. If deemed necessary, the alerting criteria should be amended.

(ii) It is not expected that direct evidence is developed to support the performance demonstration for this kind of VHM system applications.

(iii) Nevertheless, it should be demonstrated that the VHM system design and the implemented monitoring approach are expected to provide an adequate fault detection performance at the time of the approval. This should be achieved by justifying that the monitoring approach relied upon for each monitored component provides reasonable chances of early detection against the risk of premature failure. For this purpose, indirect evidence means from those listed in (f)(2)(ii)(B), as well as service experience from existing systems, where available, should be used to:

(A) justify the adequacy of the mechanical response(s) targeted as a reliable indication of damage or degradation associated with incipient failures for each monitored component;

(B) detail why the sensor location, signal(s) acquired and subsequent processing are considered appropriate for early detection;

(C) justify that the initial alerting criteria and the processes used to adjust them in service provide adequate detection capability, while ensuring acceptable false alarm rates. This justification should consider the VHM system design characteristics and the proposed ICA to be followed in the event of an indication from the system;

(D) include in the design assessment required by CS 29.1465(b)(1) consideration of the characteristics of the failure progression for each part to support the existence of an adequate PI prior to ultimate failure. These characteristics should be derived from the applicant’s experience and industry know-how. This consideration should be taken into account at the time of defining the recommended and maximum intervals of VHM data acquisition and review defined in accordance with points (e)(1) and (2) of this AMC. It should be ensured that these intervals maximise the possibilities of early detection wherever it is deemed feasible and practical.

Note: When showing compliance with CS 29.1465(b)(2), the applicant may choose to use Table 1 of GM1 29.1465 for reference. However, it is not always necessary for the VHM system to cover the complete capability defined in this table. If alternative methods are proposed, which can be shown to be effective and reliable and which are to the satisfaction of the Agency, then these can also be accepted.

(3) Purpose of the controlled service introduction (CSI)

As a result of the limited or no supporting direct evidence for these VHM applications, the performance demonstration should be subject to validation in service through the completion of a CSI, as detailed in paragraph (k) of this AMC. When defining the CSI plan for VHM applications for compliance with an operational regulation, the applicant should typically take into consideration the following:

(i) The demonstration of performance would rely significantly on assumptions, which may include the read-across of data from similar applications or the use of engineering judgement. Therefore, the applicant should carefully identify the characteristics of VHM system and/or aspects of its implementation that require evaluation in service and plan the CSI accordingly.

(ii) The applicant should also ensure that appropriate data is gathered during the CSI to confirm, set and/or adjust alerting criteria as required. When no initial alerting criteria are defined for certain components at the time of approval because of insufficient data, the applicant should ensure that the necessary data to define the missing alerting criteria is gathered within the minimum interval possible.

(iii) A VHM system approved in support of compliance with an operational regulation should be clearly recorded as such in the TCDS, and its implementation for this purpose should not be dependent upon completion of the CSI.

(i) Ground-based system

(1) General considerations

The ground-based system may include COTS hardware and software as part of the platform on which the application software is running. Qualification of such hardware and software might not be practicable given the range of set-ups and configurations available. However, for VHM system applications for which qualitative safety objectives higher than DAL C have been identified in accordance with paragraph (d) of this AMC, the use of non-qualified hardware and software platforms should be limited in order to ensure the end-to-end system integrity and safety. Therefore, for such applications, non-qualified platforms should not be solely relied upon for the processing of VHM data and/or determining the need to provide indications regarding the condition of the components monitored. Alternatively, for VHM systems with non-qualified platforms that are solely relied upon for VHM applications for which qualitative safety objectives higher than DAL C have been identified in accordance with paragraph (d) of this AMC, adequate independent verification means should be implemented to ensure the end-to-end system integrity and safety.

Any ground-based system architecture requirements should be specified as part of the ICA for the VHM system, including man-machine interfaces.

(2) Ground-based software

The reliability of ground-based software should not compromise end-to-end system integrity and safety.

Ground-based systems can consist of a COTS platform, without software or hardware qualification, whose technological and performance features as available on the market may change very rapidly. Therefore, the specifications of the host platform configuration characteristics and their authorised range for which the applicant guarantees the VHM performance and integrity should be provided through the ICA. Alternatively, the necessary set of test procedures allowing for operators to check VHM ground-based software compatibility with their host platforms should be provided through the ICA, in case configuration characteristics cannot be easily identified.

As the ground-based application software of the VHM system is intended to be installed on a COTS platform, the lack of development assurance for the platform should be compensated for by:

(i) development assurance at application software level; and

(ii) verification at VHM end-user level (operator).

The applicant should define and implement a software development assurance process for the ground-based application software of the VHM system. It should include in particular extensive verification/testing[20] of the ground-based VHM functionality, including robustness test cases, in a repeatable and standardised manner, including the worst-case authorised platform configurations when identified. This could be achieved by means of development assurance processes (e.g. RTCA DO 178()/EUROCAE ED 12(), RTCA DO-330/EUROCAE ED-215, RTCA DO-278()/EUROCAE ED-109(), etc.) or other appropriate means to be proposed by the applicant.

As part of the ICA, an installation procedure of the ground-based software should be developed by the applicant to be provided to end users, to verify the correct behaviour of the software on the end-user ground-based platform configuration(s). It is intended to be also used to ensure the compatibility and the correct behaviour in case new platforms (e.g. new OS, new processors, etc.) or new application software versions are released.

The end-to-end system integrity of the VHM information (including possible conversion means) should be ensured, e.g. by means of cyclic redundancy checks (CRC) protection of the data files or any other adequate means.

(j) Technical publications

Appropriate ICA are required by CS 29.1529 and Appendix A, which includes the VHM system itself and its applications. Thus, ICA and any other necessary supporting documentation should be available at entry into service and updated whenever necessary during the service life of the system.

(1) The ICA should typically include the following:

(i) Instructions to support the processing of each of the VHM system’s indications in accordance with (e)(4).

(ii) The recommended and MIDR in accordance with (e)(3).

(iii) The necessary procedures to ensure that sufficient complete data sets are available to allow for full diagnostics evaluation at the MIDR. In addition, the following details should be specified:

(A) The recommended and the minimum frequency of VHM data acquisition in accordance with (e)(1), as well as the necessary procedures to ensure that at least one complete data set is recorded within the required frequency.

(B) Means and procedures for data transfer, processing, networking and data integrity assurance.

(C) Methods to ensure the reliability of this process.

(D) The expected time required for upload/download and retrieval of data/health report.

(E) Facilities for storage of all data downloaded from the VHM systems and which permit timely access to the data.

(iv) The procedures to ensure that any alert is acted upon at an interval no greater than the MIDR.

(v) Provisions to support the mitigation of potential misleading information, missing or failed acquisition, and conflicting data from redundant sensors.

(vi) Effective scheduled maintenance to be carried out on the VHM system itself, when applicable, including inspections to confirm sensor performance and system functionality.

(vii) Troubleshooting and maintenance instructions to restore the VHM system functionality from any system failure.

(viii) Supporting information for all maintenance required on the VHM system, including illustrated parts catalogue/illustrated parts breakdown and wiring diagrams.

(ix) Instructions to calibrate the system and verify that the computed indicators are representative of the condition of the monitored components.

(x) A maximum period of unavailability for each of the VHM system functionalities for inclusion, when required, in maintenance instructions, taking into consideration MMEL instructions. These periods should be defined in a way that ensures that the MIDR of the different VHM applications are supported.

(xi) In addition, for VHM applications for credit, the applicant should consider the need for the following additional details:

(A) Alternate means for monitoring in case of VHM system malfunction or unavailability.

(B) Procedures to verify the continuous capability of the VHM system to evaluate the condition of the parts subject to credit.

(C) Procedures to support the transfer of parts between rotorcraft.

(2) Other supporting documentation may include:

(i) operating instructions detailing the operation of the VHM system, including any ground-based elements or functions; and

(ii) the required flight manual instructions when direct interface exists between the flight crew and the VHM system.

(k) Controlled service introduction

A CSI is a set of post-approval activities that are generally needed to ensure that the objectives of the VHM system applications are adequately fulfilled in service. Unless the applicant can justify otherwise, a CSI should be planned at the certification phase and implemented in service.

The objectives of the CSI should be defined to address those aspects of the VHM system and associated monitoring approach whose demonstration of compliance is supported by assumptions.

These assumptions may have been considered in the demonstration of the fault detection performance, involving, for example, the representativeness of the testing conditions relative to the rotorcraft or the evaluation of variability and scatter in cases of limited data gathered. Other assumptions may involve other aspects that ensure that the monitoring approach defined is effective, which may include aspects such as the actual operation the rotorcraft is subject to, or the ground segment set-up for the VHM system used by operators.

The applicant should consider that completing the compliance demonstration without relying on any assumption and/or ensuring that every assumption is fully confirmed prior to introduction into service is generally challenging and typically requires a significant amount of VHM data gathered not only from tests but also in flight.

For VHM applications for credit and in support of compliance with an operational regulation:

(1) The applicant should establish a CSI plan detailing the VHM system applications concerned and specify for each of them:

(i) the objectives to be considered and associated KPIs and targets, as applicable;

(ii) the data requirements from the fleet in support of the CSI activities listed (further details are provided in point (8) below); and

(iii) the criteria for closure of the CSI, in line with point (4) below.

(2) The list below specifies a generic list of CSI objectives that typically need to be considered. The applicant should evaluate the needs of the VHM application in question and determine which of these need to be addressed and which criteria should be met for each objective.

(i) Acquisition: the VHM system acquisition cycle enables data acquisition at an adequate frequency for all types of operations.

(ii) Data availability: sufficient data is available at each VHM data review interval to evaluate the condition of monitored components according to every indicator and to perform any additional analysis needed for fault isolation.

(iii) Data review: the VHM data review interval observed is in line with that defined in the ICA and downloads, when applicable, are successful and free from errors.

(iv) Fault detection performance: in case of damage or degradation associated with incipient failures on the monitored components, the VHM system can provide early indication.

(v) VHM system hardware reliability: the VHM system hardware and installation are reliable (including airborne and ground-based systems, as applicable).

(vi) Ground-based system software reliability: required for ground-based systems using COTS software platforms.

(vii) Maintenance and troubleshooting burden: the processing of alerts and any subsequent tasks do not generate an increased risk of errors.

(viii) VHM usability and maintainability: the VHM system is usable (including pilot interface, if any, and ground segment man-machine interface) and maintainable (procedures for calibration, software update, troubleshooting, etc.).

(ix) Effectiveness and completeness of the ICA: the ICA address all indications provided by the VHM system, and the instructions are effective for their analysis and any required subsequent fault isolation.

(3) Examples of KPIs and recommended targets for each of the objectives listed in (2) above are provided in GM1 29.1465(g).

(4) The CSI plan should be presented to and accepted by the Agency as part of the compliance demonstration of the VHM system with CS 29.1465.

(5) The CSI should only be closed once its objectives have been fulfilled. For this purpose, the applicant should document how this is demonstrated, considering the evaluations of KPIs, the data gathered versus the targets selected, and feedback from the operators involved in the CSI plan. In addition, any other relevant event or finding should be duly recorded and investigated. Finally, the CSI closure process should be duly documented and:

(i) provided to the Agency for any of the CSI activities necessary in support of the demonstration of compliance of a VHM credit application. The Agency should concur with the fulfilment of the CSI objectives and, thus, the confirmation of the assumptions addressed by the CSI; or

(ii) agreed with the operator(s) involved, for any other CSI activities. The Agency should be informed and consulted in case of disagreement between the applicant and the operator(s).

(6) The CSI activities should typically be performed in close collaboration with a number of operators. In addition, operator feedback should be used in the evaluation of some CSI objectives. Therefore, the applicant should consult the operators involved for the definition and evaluation of the progress of the CSI activities.

CSI activities may also be used to validate objectives which are not directly related with demonstration of compliance with CS 29.1465. These may include ancillary elements to VHM operation such as those described in GM1 29.1465 (h) and (j).

(7) In case of any findings questioning the assumptions addressed by the CSI, the applicant should perform a detailed evaluation of the potential impact, confirm whether the objectives of the VHM system applications are fulfilled and, when needed, report to their competent authority for continued airworthiness. In addition, the applicant should report to the Agency at regular intervals the status of and progress on the activities planned in the CSI plan.

(8) In order to provide meaningful conclusions, the applicant should identify the requirements regarding in-service experience to be acquired to ensure that the VHM data gathered as part of the CSI is complete and comprehensive. These requirements should include the number of rotorcraft, the number of operators, the calendar time and the accumulated flight hours. Within the definition of these requirements, the applicant should consider the need to gather data representing the complete scope of usage the rotorcraft is subject to. This may include consideration of type of operations, environmental conditions and ageing effects.

The recommended minimum in-service experience included in Table 3 should be considered in support of the approval of a new VHM application.

Table 3: Recommended minimum in-service experience for CSI completion

Parameter	Recommended minimum data set
Number of rotorcraft	≥ 8
Number of operators	≥ 2
Calendar time	≥ 2 years
Flight hours	≥ 5 000

The applicant should consider the characteristics of the VHM system and the needs of the CSI to adjust these requirements, when needed. Changes to these requirements may also be proposed to optimise the CSI, provided that the completeness of the results and the validity of the conclusions are not adversely affected.

(9) In addition, to evaluate the progress of the CSI activities over time, the plan should define a minimum accumulated operating time and/or calendar time for KPI calculation and review. Generally, an initial assessment may be performed taking into account the initial 1 000 flight hours, and then the status may be checked again every 1 000 flight hours. Once the operating fleet is sufficiently wide, the KPIs might be computed yearly, considering the last 1 000 flight hours.

(l) Pilot interface and cockpit indications

Although VHM systems do not strictly require a cockpit interface for pilot interaction or for providing VHM alerts, such a feature may be introduced. This section addresses this functionality focusing on cockpit indications generated by the VHM system.

Pilot interaction with the VHM system, if any, should be specified and should not adversely impact the crew’s workload. Where applicable, the applicant should perform a crew workload assessment and a human factors evaluation in accordance with CS 29.1302 and the other appropriate certification specifications.

The applicant may consider in-flight or on-ground VHM cockpit indications for certain VHM applications. For this purpose, the definitions included in GM1 29.1465(a) for the different kinds of cockpit indications should be considered. When applicable, the applicant should address them as follows:

(1) Real-time VHM alerting

Due to the characteristics of VHM systems and the nature of the mechanical responses they monitor, it is very difficult to design and demonstrate that a VHM system has sufficient capability and reliability to provide cockpit indications in flight requiring immediate pilot actions which may result in hazardous or catastrophic consequences for the rotorcraft. Such actions typically involve the requirement to land immediately or within a limited period of time. It is considered that any failure monitored by VHM that would require such immediate and drastic pilot action should be prevented through robust design methodologies of the monitored mechanical system, ensuring that the probability of occurrence is in line with the safety objective.

Nevertheless, real-time VHM alerting could be implemented where the cockpit indication will instruct the pilot to perform less severe actions such as reducing power, monitoring other instruments, or landing as soon as practicable. Considering the potential impact of real-time VHM alerting on crew workload, the following are considered as key elements to achieve a system fit for this purpose:

(i) It should be justified that the probability of occurrence of any preceding degraded condition that, if undetected, may ultimately lead to the failure is commensurate with the associated severity of the RFM procedure for the corresponding indication.

(ii) The demonstration of performance should be performed in accordance with paragraphs (f), (g) and/or (h), as applicable. Nevertheless, the applicant should consider dedicated testing activities to validate the monitoring performance and capability of detection, including seeded flaw tests and validation on the rotorcraft.

(iii) Means providing increased reliability of the system installation and monitoring should be implemented (sensor redundancy, improved mounting means, combination of condition indicators, etc.).

(iv) The false alert rate should be minimised and justified to be consistent with the quantitative objective associated with the severity identified in the FHA for the corresponding RFM procedure, taking into account the possible operational scenarios.

(v) When warning, caution or advisory lights are installed in the cockpit, the applicant should consider compliance with CS 29.1322.

(vi) The RFM should include the necessary instructions to allow interpretation and management of any information which may include alerts provided by the VHM system in flight.

(2) Near real-time VHM alerting

This approach can be considered for degradation modes for which the demonstrated time between detection and failure is limited, to support operators without the capabilities to perform regular downloads and reviews of VHM data, or to ensure that the VHM system does not solely rely on the ground-based system for the generation of alerts. It is considered that, when such kind of VHM application is needed due to the limited time demonstrated between detection and failure, additional mitigating actions should also be implemented and the key elements (i) to (v) listed in (1) above for real-time VHM alerting are also considered applicable.

In addition, regardless of the exact use of a VHM application relying on near real-time VHM alerting, it is recommended that the applicant considers implementing some of the key elements (i) to (v) listed in (1) above, due to the potential impact on the operability of the rotorcraft.

(3) Real-time VHM data transfer

It is considered that the intent of such applications should be oriented to improving the response time to any VHM indication and thus to improve rotorcraft availability. However, the applicant should consider implications on avionics certification and cybersecurity.

(m) Master minimum equipment list (MMEL) recommendation

The applicant should evaluate the impact on safety from temporarily inoperative VHM applications, and determine the need for including associated elements of the VHM system in the rotorcraft MMEL. This may generally be the case for VHM applications for credit. In such cases, the applicant should define an appropriate rectification interval, in accordance with CS-MMEL, and/or revert to maintenance and flight procedures applicable for the rotorcraft configuration without the VHM application for credit.

[Amdt 29/12]