Certification Products and Services

Rotorcraft - Policy - HUMS - Ac

[Aircraft Certification\
Products and Services Page](../air_home.htm)

[Rotorcraft](../Rot.htm)

[Policy](../Rot_Pol.htm)

[Hums](../Rot_Pol_Hums.htm)

> **ADVISORY CIRCULAR MATERIAL WILL BE**

**INCORPORATED IN AC-27-1 AND AC-29-2**

  ---------- ---------------------------------------- ------- --------------
  Subject:   **AIRWORTHINESS APPROVAL OF**                    July 15, 1999
             **ROTORCRAFT HEALTH USAGE MONITORING             
             SYSTEMS (HUMS)**                                 

                                                              
  ---------- ---------------------------------------- ------- --------------

**1. [Purpose]{.underline}.** The purpose of this advisory circular (AC)
is to provide guidance to achieve airworthiness approval for rotorcraft
Health and Usage Monitoring System (HUMS) installation, credit
validation, and Instructions for Continued Airworthiness (ICA) for the
full range of HUMS applications. Mandatory terms used in this AC, such
as \"must\", are terms used only in the sense of ensuring the
applicability of these particular methods of compliance when the
acceptable means of compliance described herein are used. This AC does
not change regulatory requirements and does not authorize changes in, or
deviations from, regulatory requirements. This AC establishes an
acceptable means, but not the only means of certifying a rotorcraft
HUMS.

This AC will address the most complex/extensive HUMS; systems of lesser
complexity may be addressed by use of only the parts of this AC that are
pertinent.

HUMS applications in the Catastrophic criticality category are not
addressed herein.

**2. [Related Documents]{.underline}.**

-   Federal Aviation Regulations (FARS) Parts 21, 27, 29, 33, 91, 125,
    127, 129, 133, 135, 145 -- Corresponding European Joint Aviation
    Requirements (JARS) 21, 27, 29, JAR E, JAR-OPS 3.

-   FAA Advisory Circulars AC 27-1 A, AC 29-2B and the European
    corresponding ACJs, AMJs where applicable.

-   Standards - Latest revision of RTCA/DO-160/ED-14, RTCA/DO-178/ED-12,
    SAE documents ARP 4754 and ARP 4761.

**3. [Background]{.underline}.** Various types of HUMS have been
developed, and there are likely to be more used in the future.
Initially, these systems were installed to show the feasibility of
gathering meaningful data to modify required maintenance and/or
operational actions. The degree of qualification required for this type
of installation is relatively low. However, there is an increasing
number of certification applications to install HUMS and use its data to
intervene in maintenance and/or operations of the rotorcraft. This type
of installation requires a higher degree of qualification, commensurate
to the criticality of the most severe effect of the intervention
action(s) on the rotorcraft.

HUMS typically consists of a variety of onboard sensors and data
acquisition systems. The acquired data may be processed onboard the
rotorcraft or on a ground station (or a combination of both) providing
the means to measure against defined criteria and generate instructions
for the maintenance staff and/or flight crew for intervention.

The certification of HUMS must address the complete process, from the
source of data to the intervention action. There are three basic aspects
for certification of HUMS applications: installation, credit validation,
and Instructions for Continued Airworthiness (ICA). These aspects are
not totally independent and do have varying interactions with each
other.

**4. [Definitions]{.underline}.**

**[END-TO-END]{.underline}:** The term \"end-to-end\" as used in the
text is intended to address the boundaries of the Health Usage
Monitoring System (HUMS) application and the effect on the rotorcraft.
As the term implies, the boundaries are the starting point that
corresponds with the airborne data acquisition to the result that is
meaningful in relation to the defined credit without further significant
processing. In the case where credit is sought, the result must arise
from the controlled HUMS process containing the three basic requirements
for certification as follows:

-   equipment installation/qualification (both airborne and ground),

-   credit validation activities, and

-   Instructions for Continued Airworthiness (ICA) activities.

**[HUMS]{.underline}:** Equipment, techniques, and/or procedures by
which selected incipient failure or degradation and/or selected aspects
of service history can be determined.

-   Health Monitoring System: Equipment, techniques, and/or procedures
    by which selected incipient failure or degradation can be
    determined.

-   Usage Monitoring System: Equipment, techniques, and/or procedures by
    which selected aspects of service history can be determined.

**[Credit]{.underline}:** To give approval to a HUMS application that
adds to, replaces, or intervenes in industry accepted maintenance
practices or flight operations.

**[Application(s)]{.underline}:** A HUMS process implemented for a
distinct purpose(s).

**[Criticality]{.underline} (1309):** This term describes the severity
of the end result of a HUMS application failure/malfunction. Criticality
is determined by an assessment that considers the safety effect that the
HUMS application can have on the aircraft. There are five criticality
categories as follows:

-   Catastrophic: Failure conditions which would prevent continued safe
    flight and landing.

-   Hazardous/Severe Major: Failure conditions which would reduce the
    capability of the aircraft or the ability of the crew to cope with
    adverse operating conditions to the extent that there would be:

> **(1)** A large reduction in safety margins or functional
> capabilities,
>
> **(2)** Physical distress or higher workload such that the flight crew
> could not be relied on to perform their tasks accurately or
> completely, or
>
> **(3)** Adverse effects on occupants including serious or potentially
> fatal injuries to a small number of those occupants.

-   Major: Failure conditions which would reduce the capability of the
    aircraft or the ability of the crew to cope with adverse operating
    conditions to the extent that there would be, for example, a
    significant reduction in safety margins or functional capabilities,
    a significant increase in crew workload or in conditions impairing
    crew efficiency, or discomfort to occupants, possibly including
    injuries.

-   Minor: Failure conditions which would not significantly reduce
    aircraft safety, and which would involve crew actions that are well
    within their capabilities. Minor failure conditions may include, for
    example, a slight reduction in safety margins or functional
    capabilities, a slight increase in crew workload such as routine
    flight plan changes, or some inconvenience to occupants.

-   No Effect (Non-hazardous class): Failure conditions which do not
    affect the operational capability or safety of the aircraft, or the
    crew workload.

**[Integrity]{.underline}:** Attribute of a system or a component that
can be relied upon to function as required by the criticality determined
by the Functional Hazard Assessment (FHA).

**[Mitigating Action]{.underline}:** An autonomous and continuing
compensating factor which may modify the level of qualification
associated with certification of a HUMS application. This action becomes
a part of the certification requirements and, as such, is required to be
performed as long as that certification requirement is not changed by a
subsequent re-certification. An example of a mitigating action is a
pilot\'s comparison of airborne HUMS data with aircraft instrument data.

**[Commercial Off The Shelf (COTS)]{.underline}:** This term defines
equipment hardware and software that is not qualified to aircraft
standards. An example of COTS equipment hardware and software is a
personal computer (PC) and its operational software.

**[Independent Verification Means]{.underline}:** An independent process
to verify the correct functionality of a HUMS application on a ground
station that utilizes COTS. The intent of independent verification is to
gain some degree of confidence in the COTS operational reliability.

**Note:** This process may be discontinued when sufficient confidence in
the application has been achieved.

**[Synthesis]{.underline}:** The process of evaluating service history
and any other relevant data with the objective of validating and, if
necessary, refining the performance of an approved credit.

**5. [Certification Approach]{.underline}.** There are three basic
aspects to Health Usage Monitoring Systems (HUMS) certification.
Certification of HUMS must address all three. The three aspects are
installation, credit validation, and Instructions for Continued
Airworthiness (ICA). These aspects are not totally independent and do
have varying interactions with each other. A method to address these
aspects is provided by the approach herein. Installation includes all
the equipment needed for the end-to-end application that is associated
with acquiring, storing, processing, and displaying the HUMS application
data, including airborne and ground based equipment. Credit validation
includes evidence of effectiveness for the developed algorithms,
acceptance limits, trend setting data, tests, etc., and the
demonstration methods employed. A plan is needed to ensure continued
airworthiness of those parts that could change with time or usage and
includes the methods used to ensure continued airworthiness.

The certification process should begin with the declared application
intent, and determination of the resultant criticality. This declared
intent should consider whether this application is for credit, that it
adds to, replaces, or intervenes in maintenance practices or flight
operations. When the declared intent is for credit, the end-to-end
criticality for such an application should be determined and used as an
input to establish the integrity criteria. If the declared intent is for
non-credit, it may be certified as long as it can be shown that the
installation of the equipment will not result in a hazard to the
aircraft.

The end-to-end criticality can be determined by performing a Functional
Hazard Assessment (FHA). The integrity level is required to be
equivalent to the determined end-to-end criticality. Compliance with the
criticality level established by the FHA must be demonstrated. This may
be achieved by a combination of application qualification plus
appropriate mitigating actions.

Applications are often qualified to a low level of integrity due to the
assessment of criticality; however, it may be desirable to transition to
a higher qualification level for future uses. Transition from one level
of integrity to another will require re-evaluation.

**Note:** A certification plan may be provided to assist in the
certification process. At a minimum, this plan should address the
proposed means of compliance to each applicable paragraph of this
advisory circular for a given application. Early submittal of this plan
to the regulatory Authority is recommended.

**6. [Installation]{.underline}.** Installation approval must cover
systems and equipment that acquire, store, process, and display HUMS
data and includes the airframe installation, or any one of these
functions for a particular application. This AC will address the most
complex/extensive HUMS; systems of less complexity may be covered by use
of only the parts of this AC that are pertinent. Different systems
exhibit varying capabilities and configurations. Additionally, there may
be different functional distributions between airborne and ground based
equipment. HUMS equipment requirements consist of common requirements
plus the unique requirements of airborne and ground based equipment.

**6.1 [Common Requirements]{.underline}.** A common requirement is one
that applies to airborne, ground based, and installation equipment.
These common requirements are discussed below.

**6.1.1 [Criticality Determination]{.underline}.** Criticality
determination is a primary decision point relating to the depth of
requirements for certification. The intended application can range from
systems that acquire data for proof of concept only, to a system that
acquires and processes data to determine if a life-limited part should
be replaced. This range of applications will have a corresponding range
of criticality for the systems from No Effect to Hazardous/Severe-Major.
Systems in the Catastrophic criticality category are not addressed in
this AC.

If any credit is to be gained, the general guidelines for determination
of criticality levels will be either Minor, Major, or
Hazardous/Severe-Major. They will be in agreement with the resulting
effect of the end-to-end criticality assessment.

Typical examples of applications which may be classified as Catastrophic
are as follows :

-   Applications providing cockpit warning(s) which are the only means
    of detection with associated flight manual instructions to land
    immediately.

-   System applications, for which constantly misleading information
    could be assessed as leading to a Catastrophic condition, must be
    designed to either detect these errors (e.g. Built-In-Test, system
    redundancy, etc.) and/or be tolerant to these errors (i.e.,
    procedural, etc.).

The Functional Hazard Assessment (FHA) may be a preliminary document to
the Preliminary Safety Assessment (PSA) or a part of the PSA. The FHA is
a top down analysis (should involve pilots and flight analysts as well
as engineers) that starts with the hazards to the rotorcraft and traces
these hazards to the system, subsystem, and component level in the areas
affected by HUMS. This type of analysis starts with the determination of
what undesirable effects can occur as a direct or indirect result of
using HUMS for maintenance or operational actions. The level of severity
associated with this effect will result in assigning a criticality level
that uses the definitions of criticality contained herein.

The final level of equipment qualification may not only be the result of
technical considerations, but also of other mitigating actions, of which
there are many types. Many of these actions can result in a reduction of
qualification levels for equipment.

**6.1.2 [Mitigating Actions]{.underline}**. A mitigating action is an
autonomous and continuing compensating factor which may modify the level
of qualification associated with certification of a HUMS application.
These actions are often performed as part of continued airworthiness
considerations and are also an integral part of the certification. As
such, the continuation of certification limitations, where appropriate,
must be included in the Instructions for Continued Airworthiness (ICA).
Mitigating actions are subjective in nature and are an intended
method(s) of application where the pre-mitigated levels of integrity are
defined.

Applications that use COTS software and therefore may not be fully
qualified applying RTCA/DO-178/ED-12 methodology may be accepted by
alternative qualification methods as stated in paragraph 6.3. Therefore,
the subsequent use of mitigating actions that are of themselves of a
subjective nature must be approached with caution. A mitigating action
must be based upon the integrity level derived from the FHA.

If the mitigating action is an operational consideration, the same
concerns apply for continuing the mitigating action. The mitigating
action should be recorded in the certification limitations and in the
approved flight manual.

**6.1.3 [Performance]{.underline}.** There must be minimum end-to-end
performance criteria consistent with the application\'s intended use.
Performance criteria, as a minimum, should consider accuracy,
timing/sampling, resolution, event recognition, and consistency. The
HUMS signal source must be compatible with the determined qualification
level. Tests should be conducted to demonstrate that these criteria are
met.

**6.2 [Airborne Equipment Installation]{.underline}.** Airborne
equipment and the associated installation qualification procedures are
the same as for any other airborne equipment. The installation
qualification and the equipment qualification may be considered two
separate activities although there is an obvious relationship between
them. Signal independence, irrespective of method of implementation,
should exist to the extent that acquisition of HUMS signals should not
compromise the level of safety or reliability of functions provided by
other equipment as a result of signal sharing.

**6.2.1 [Equipment Installation]{.underline}.** Equipment not approved
by other methods must be approved as part of the installation and must
consider overall system requirements.

**6.2.1.1 [Equipment Qualified as Part of Installation]{.underline}.**
Equipment qualified all or in part as a part of the installation
includes minor and major parts. Examples of minor parts are: connectors,
common usage relays, diodes, etc. Examples of major parts are
non-prequalified equipment (equipment not TSOed or not qualified under
the TSO to the required level for installation approval), consisting of
significant system components and as transducers with their interfaces.
Equipment qualification must consider environmental qualification
(RTCA/DO-160/ED 14) including HIRF and lightning.

**6.2.1.2 [Software]{.underline}.** RTCA/DO-178/ED-12 shall be used for
the software development standard. (See following figure for typical
airborne application process for software not containing COTS.)

![](media/image1.png){width="3.3958333333333335in" height="4.0in"}

**6.2.2 [Installation Specific Considerations]{.underline}.** The
overall installation considerations should include, as a minimum, supply
of electrical power, environmental conditions, system non-interference,
and human factors if operations are affected.

**6.2.2.1 [Supply of Electrical Power]{.underline}**. An adequate source
of electrical power for HUMS must be provided. The reliability of the
power source must be commensurate with the required equipment
qualification level. There should be no unacceptable reduction in the
level of safety or reliability for other equipment as a result of
acquiring power for HUMS.

**6.2.2.2 [Electromagnetic Compatibility]{.underline}.** Electromagnetic
compatibility (EMC) must be addressed. Complex systems may require an
EMC test plan, which includes a matrix of aggressors versus victims. The
end result should be to assure that HUMS does not interfere with or is
not affected by any other installed equipment.

**6.3 [Ground Based Equipment Installation]{.underline}.** Ground based
equipment is typically used to process and display the data collected by
airborne means. This processed data will ultimately be used to make
decisions pertaining to some intervention action or provide data to
other processing means to make the intervention action determination.
Since the ground based equipment may be an important part of the process
for determination of intervention actions, its integrity and accuracy
requirements must be the same as any other part of the HUMS process.

The determination of compliance to the integrity requirements for ground
based equipment is difficult when it is recognized that this equipment
may, for the most part, be commercial and not necessarily designed
specifically for the HUMS application. This section is intended to allow
for the possibility of systems that contain COTS hardware and software,
where the hardware is likely to be a personal computer (PC) and the
operational software is COTS. The determination of compliance to the
integrity requirements for COTS is based on equivalence, which is
subjective. COTS service history alone will not be sufficient to comply
with the requirements herein. Any ground based processing equipment that
consists of commercial hardware and software must have satisfactory
service history and an independent means of verifying the results of the
processing. This independent verification means may be discontinued with
the certifying Authority\'s agreement to modify the original HUMS
approval and remove this requirement after significant quantities of the
processed data consistently agree with the verifying means.

**Note:** The suggested processes contained in this document for
acceptance of a ground based system that possibly includes COTS hardware
and software is limited to ground based equipment for HUMS applications
only. The integrity determination methods for systems that do not
contain COTS is the same as described for the airborne systems.

**6.3.1 [Independent Verification Means]{.underline}.** The required
independent verification means may consist of any one of many methods.
Independent verification means may parallel only the ground based system
processing or parallel all or any portion of the process that includes
the COTS equipment processing. Some acceptable methods may include the
following:

-   Physical inspection(s).

-   Redundant processing by a second dissimilar PC with different COTS
    from the primary processor.

-   A combination of physical inspection(s) and independent dissimilar
    processing.

-   Satisfactory comparison of processed directed action to actual
    maintenance performed as a result of inspection. This approach would
    require data collection on the system prior to actual credit
    application. The amount and duration of data collection should be
    agreed between the applicant and the Authority at the beginning of
    the project on a case-by-case basis.

-   Any other independent means of verifying the accuracy/integrity of
    the equipment including software by a satisfactory comparison to the
    directed action of the HUMS processed data.

**6.3.2 [Integrity Level Considerations]{.underline}.** The methodology
is the same for different integrity level requirements as they relate to
COTS hardware/software, but the compliance requirement will vary. The
processes described in the previous and subsequent paragraphs of 6.3
should be applied to meet the initial integrity requirements for the
criticality categories of Hazardous/Severe Major and Major. Minor
criticality category level will also require qualification by this
process, except that independent verification can be performed after
certification, provided that an approved plan is submitted for this
activity. Other applications that do not employ COTS will use standard
engineering practices to satisfy the integrity level considerations.

**6.3.2.1 [Modification of Approved Systems]{.underline}.** Changes to
the equipment including software should be qualified on a case-by-case
basis that is dependent on the effect on the integrity and functionality
of the system. If mitigation had been successfully demonstrated for the
original configuration, the mitigation must be shown to provide the same
level of integrity for the changed configuration.

**6.3.3 [Ground Based Equipment Hardware]{.underline}.** This hardware
may consist of data processing, display, and possibly printing equipment
or other accessories. The hardware must be compatible with the intended
application and software. The independent means of verification activity
is required due to the use of COTS hardware.

**6.3.4 [Software]{.underline}.** Most systems will employ two types of
software. One type is the operational software and the other is the HUMS
specific software. The operational software may be COTS. (See following
figure for typical ground based application process for HUMS specific
software using COTS as an operational software.)

![](media/image2.png){width="4.270833333333333in" height="4.46875in"}

**6 .3.4.1 [COTS]{.underline}.** This type of software can only be
accepted by subjective considerations, such as service history,
independent verification means, and design of the system to limit access
to the operational COTS software to make changes. The independent means
of verification activity is required due to the use of COTS software.

**6.3.4.2 [HUMS Specific Software]{.underline}.** This software should
be developed to the integrity level required by the system criticality
assessment using RTCA/DO-178 as the standard. This system determined
level should be a result of the end-to-end criticality assessment and,
in general, the same as the airborne software. Use of mitigating actions
is dependent on constraints stated in paragraph 6.1.2.

**6.3.5 [Data Processing]{.underline}.** Data processing equipment and
software should have the capacity to process the amount of data
required. It should not introduce errors or provide out of specification
accuracy for any parameter. The speed of processing should not be
limited, by the hardware or software, to an unacceptable rate. The
acceptability of speed will depend on the amount of data to be processed
and the specified performance for HUMS data processing. The speed should
be reasonable to accomplish data processing in a reasonable time for the
particular HUMS application. Hazardous/Severe Major or Major criticality
applications that contain COTS should be part of a dedicated system or
demonstrate adequate protection for the higher level processing from
anything else processed on the same equipment. Subject to a favorable
comparison to the required independent verification means, Minor
criticality applications need not be part of a dedicated system.

**6.3.6 [Display and Peripheral Equipment]{.underline}.** The display,
for most cases, may be a part of the processing equipment or closely
interface with it. It must be compatible with other parts of the system
and provide a clear usable presentation.

**6.3.7 [Data Communications]{.underline}.** Network applications, modem
interfaces, and other system sharing and transmission features may be
utilized for integrity levels associated with Major and Minor
criticality categories, provided that the independent verification means
covers the use of these features. Integrity levels associated with
Hazardous/Severe Major criticality categories may utilize these features
only if sufficient protection can be shown to assure that this level of
integrity is maintained throughout any foreseeable failure/malfunction
or mistake in any associated application, in addition to required
independent verification means.

**7. [Credit Validation]{.underline}.** HUMS applications for which
credits are sought must be validated.

For each application, evidence shall be provided that the physics
involved is understood and therefore that the monitoring
technique/algorithm/parameter, rejection criteria, and associated
intervention actions are well chosen. The designer of the
component/equipment to be monitored is the most logical choice for this
determination. However, in some cases the source can be from any
organization as long as the validation criteria herein can be satisfied.
If changes are proposed to an approved system, re-evaluation is required
to ensure existing credit(s) are not invalidated. The degree of effort
will vary and depend on the application type, the credit sought, and the
consequences of failure or any other malfunction. The validation process
would generally need to include the following

-   Description of application and associated credit.

-   Understanding of the physics involved.

-   Validation methodology.

-   Introduction to service.

-   Continued airworthiness (synthesis).

**Note:** Early notification to the regulatory Authority of the credit
type and the proposed method for validation is recommended.

**7.1 [Description of Application and Associated Credit]{.underline}.**
There are many types of HUMS credits with different levels of
criticality. Some may be the introduction of new maintenance practices,
in place of the established maintenance practices, and others may be the
introduction of additional safeguards for safety where all standard
practices are retained.

It is important to fully evaluate and describe the proposed credit and
the worst effect on the rotorcraft should the application fail or
malfunction. This evaluation is needed to determine the system
criticality, the system installation integrity requirements, and the
depth and scope of the credit validation effort.

**7.2 [Understanding the Physics Involved]{.underline}.** The mechanisms
of failure and/or degradations associated with the requested credit must
be understood. This includes how a failure occurs and/or at what rate
the degradation progresses and a determination of the point where
intervention action is necessary. For some complex applications, this
may include supporting information from validated analytical tools such
as finite element analysis and fracture mechanics.

These understandings should be used to determine the four important
characteristics of a HUMS application.

1\. The technique to be used.

2\. The appropriate alert limits, including trending where appropriate.

3\. The appropriate intervention action.

4\. How often to monitor to give optimum opportunity for the
intervention action to be effective.

This should also recognize the different characteristics of the
failure/degradation and determine when trending or a step function is
most appropriate.

**7.3 [Validation Methodology]{.underline}.** All HUMS applications
should have their validation process based on suitably representative
physical data. This process may use direct or indirect evidence, or a
combination of the two, depending upon the credit type and the
criticality on the aircraft of any HUMS failure or malfunction.

**7.3.1 [Direct Evidence]{.underline}.** When the HUMS application is
classified as Hazardous/Severe Major, then direct evidence must be
gathered. Examples of where this might be the most appropriate method
include maintenance tasks such as vibration checks for
imbalance/misalignment of high energy rotating equipment, fatigue life
counting, or going \"on-condition\" for flight critical assemblies.

-   Actual service experience on HUMS equipped aircraft,

-   \"Seeded tests\" (where the wear, defect, or deterioration is
    introduced, allowed to develop, and the technique response
    verified), and

-   On- aircraft trials, investigating cause and effect (for example,
    introducing degrees of imbalance and calibrating the techniques
    response).

Tests should be representative of the aircraft for which the credit is
being sought and of test conditions representing the flight regime that
would prevail when data is normally gathered (e g., cruise). It must be
established that the evidence gathered from on-aircraft ground trials or
rig based seeded tests is valid in flight.

**7.3.2 [Indirect Evidence]{.underline}.** When the HUMS application is
classified as \"Major\" or lower, indirect evidence may be gathered.
Criteria for this approach includes a criticality determination of Major
or lower and either or both; application to \"on-condition\" maintenance
actions, and/or lowering the probability of undetected failures.
Monitoring of a high number of potential failure modes can collectively
determine the probability of undetected failures. Here, it may not be
practicable to generate direct evidence for each failure.

Proven analytical methods may be combined with sound engineering
judgment to provide calculated/derived criteria; tests can be performed
to validate these criteria. Model based analytical methods for
predicting damage progression (e g., finite element analysis and
fracture mechanics) may allow for a validation by claiming analogy with
\'direct\' evidence generated for other aircraft types or equipment.
However, to more fully validate this analogous data set, a degree of
direct evidence for the actual equipment being monitored is still likely
to be necessary to prove similarity of application. This might be
achieved by performing an appropriate number of seeded defect tests and,
in effect, \"sampling\" the range of failure types contained.

**Note:** For both direct and indirect evidence, the whole system must
be validated end-to-end.

**7.4 [Controlled Introduction to Service]{.underline}.** For some
credit applications, full validation and implementation may be possible
during the development period. However, for many HUMS techniques, a plan
for a controlled introduction to service may be necessary to fully
validate the credit.

There must be provisions in the certification process to instruct the
continued airworthiness effort to ensure compliance with the
aforementioned plan.

During the implementation of this plan, data is accumulated by
operational aircraft, and from this data, refinements and adjustments to
the original criteria can be made. This period may also allow a proposed
credit to be operated in parallel with alternative or standard
procedures when it is necessary to gain additional in-service validation
by way of back-to-back comparison.

The plan must include procedures and provisions for this controlled
period and should include clear goals by which progress and ultimately
termination of this phase can be measured. The plan may include a
multi-credit HUMS that will require a phased introduction of credits.

**7.5 [Continued Airworthiness & Synthesis of Credit]{.underline}.**
Normal and established procedures will prevail for HUMS as for all other
continued airworthiness matters. Arrangements should be made to validate
the performance of an approved credit throughout its service use.
Provisions should be made to allow for the Synthesis of the service
experience with relevant engineering evidence from rejected components,
development testing, seeded testing, etc. Any necessary or desired
modifications to the HUMS application or the component/equipment being
monitored must be re-evaluated.

**8. [Instructions for Continued Airworthiness (ICA) and Other
Requirements for Health and Usage Monitoring System
(HUMS)]{.underline}.** This section addresses the ICA, operator\'s HUMS
program, HUMS training, and Master Minimum Equipment List (MMEL)
revision to incorporate HUMS.

**8.1 [Instructions for Continued Airworthiness]{.underline}.** The
applicant for HUMS is required to provide ICA developed in accordance
with FAR/JAR Part 27/29 and Appendix A. This section provides
supplemental guidance with addressing aspects unique to HUMS. The
applicant may be an airframe manufacturer, HUMS equipment manufacturer,
or an operator. The ICA must address HUMS integration with the aircraft.
This section addresses both airborne and ground based systems and
equipment.

**8.1.1 [HUMS ICA Items]{.underline}.** The applicant must address the
following subjects in addition to FAR/JAR Parts 27/29. These subjects
should address both airborne and ground based systems and equipment
unless specifically indicated otherwise.

**8.1.1.1** Control and operating instructions must be provided for each
element of HUMS, and where applicable, include data acquisition,
transfer processing, display, configuration management, and resulting
actions.

**8.1.1.2** Acceptance and rejection criteria and associated actions
must be defined.

**8.1.1.3** A procedure is required when the system becomes inoperative
because data is missing.

**8.1.1.4** When required, there must be a procedure for collecting and
transferring HUMS data when the aircraft is away from the main HUMS data
processing base.

**8.1.1.5** Provide a procedure for independent verification as defined
in paragraph 6.3, if applicable.

**8.1.1.6** Provide a procedure for implementing mitigating actions,
when mitigating actions are applied.

**8.1.1.7** Provide a procedure for implementing controlled introduction
to service instructions as defined in paragraph 7.4, if applicable.

**8.1.1.8** Provide a training program on HUMS airborne and ground based
systems and equipment.

**8.1.1.9** The airworthiness limitation section must be amended to
address the following, if required:

-   Requirements for independent verification and associated procedures.

-   Requirements for mitigation actions and associated procedures.

-   Requirements for controlled introduction to service and associated
    procedures.

**8.1.2 [Ground Based System and Equipment]{.underline}.**

**8.1.2.1** A procedure must be defined to ensure the security of the
ground based system and equipment and the integrity of the HUMS data.

**8.2 [Owner/Operator\'s HUMS Program]{.underline}.**

**8.2.1 [General]{.underline}.** An owner/operator that installs and
utilizes health and usage monitoring equipment on aircraft and intends
to request maintenance credit will need a program. This program and
revision to existing maintenance and/or inspection programs must be
submitted to the aviation Authority for approval. This is due to the
fact that maintenance credit may change existing maintenance inspection,
overhaul requirements, and/or life limits.

**8.2.2 [HUMS Program Items]{.underline}.** Regardless of the size and
complexity of the health and usage monitoring equipment, the HUMS
program must contain the following:

**8.2.2.1** A system must be provided for tracking the HUMS monitored
component/system, including identification of component/system,
recording requirement, tracking procedure, and other related activities.

**8.2.2.2** A system to assure that a maintenance credit must be
maintained. The historical HUMS data must be traceable when such
components/assemblies are transferred between aircraft.

**8.2.2.3** A procedure for new or overhauled HUMS monitored components.

**8.2.2.4** A procedure to address inoperative HUMS in accordance with
paragraph 8.1.1.3.

**8.2.2.5** A means for implementing procedures specified in 8.1.2.

**8.2.2.6** A procedure for adjusting maintenance credits.

**8.2.2.7** An organization with clearly defined responsibilities to
collect, analyze, and act upon the HUMS data.

**8.2.2.8** A procedure for implementing the training program specified
in paragraph 8.1.1.8.

**8.2.2.9** Where appropriate, a procedure for implementing the
controlled introduction to service plan. See section 7.4, Controlled
Introduction to Service.

**8.2.3 [Ground Based System and Equipment]{.underline}.**

**8.2.3.1** A procedure for troubleshooting and testing of the HUMS.

**8.2.3.2** A procedure for revising and using the operator's Minimum
Equipment List (MEL) for HUMS.

**8.2.4 [Master Minimum Equipment List/Minimum Equipment
List]{.underline}.** The MMEL may need to be revised to include the HUMS
equipment. Once the MMEL contains the HUMS equipment, the operator can
revise their MEL to include HUMS and submit the MEL to the aviation
Authority for approval.

The aviation Authority should coordinate with engineering in evaluating
the revised MEL.

**Note:** Any MMEL allowance should be determined considering the
criticality of the \'credit\' [effect resulting]{.underline} from the
HUMS application(s). MMEL allowances should be substantiated based on a
Functional Hazard Assessment (FHA).