23.1326 Pitot heat indication systems
There are no corresponding rule or airworthiness criteria in CAR 3 or the Airship Design Criteria.
Amendment 23-49 and Subsequent
A proposed revision in NPRM 94-21 explains this amendment as follows: “Due to advancements in technology, many part 23 airplane installations now utilize equipment whose data sources are critical to the accurate and dependable operation of that equipment. The heated pitot tube is one such data source. The pitot heat indicating system will advise the pilots of any inoperative heating element in the pitot tube and that subsequent inaccuracies may result.
Part 23 airplanes certificated for flight under instrument flight rules or for flight in icing conditions are required by current Sec. 23.1323(e) to have a heated pitot system or an equivalent means of preventing an airspeed indicating system malfunction due to ice accumulation. This proposal would require such airplanes equipped with a heated pitot tube to be equipped with a pitot tube heat indicating system. This requirement will provide greater assurance that the pilots will not be dangerously misled by faulty flight instrument indications caused by pitot tube icing.
When pitot tube heat indicating system requirements were added to part 25, the FAA noted the occurrence of at least one accident and several incidents in which an airspeed indicating error occurred that might have been avoided if a pitot tube heat indicating system had been installed. Part 23 airplanes operate at lower airspeeds and over shorter distances that do part 25 airplanes; therefore, their exposure to moisture and temperature conditions where icing may occur is higher than it is for transport category airplanes. Because of this environmental exposure, the potential for an inoperative heated pitot tube becoming a hazard to part 23 airplanes is greater.”
This rule requires a caution annunciation whenever the pitot heat is off or there is a failed heating circuit in the pitot tube heater. The second annunciation cause is fully justified in that it represents a failure condition. The first can have a positive safety effect if it causes pilots to activate the pitot heat in all environmental conditions. This eliminates the loss of the pitot static system because of the pilot error of failing to operate pitot heat when conditions warrant it.
A caution annunciation when the pitot heat is off has two negative issues as follows:
a. It violates the “dark cockpit” where caution and warning lights only represent failure conditions; and
b. Adherence to a “dark cockpit” wi ll cause pitot heat operation in all environmental conditions, which will shorten the life of the system.
246 The criteria wherein a design may be considered eligible for an ELOS to part 23, § 23.1326(b)(1):
(1) To be an eligible configuration, a de sign that is proposed for an ELOS must also contain the necessary compensating safety features if it is to be issued an ELOS.
(2) Any ELOS applicable to part 23 airplane s must be issued in accordance with the Small Airplane Directorate procedures.
APPLICABILITY
This guidance applies to any Type Certificate (TC), Amended Type Certificate (ATC), or Supplemental Type Certificate (STC) project for a small airplane approved for IFR with a certification basis that includes 14 CFR part 23, § 23.1326, amendment 23-49.
Earlier guidance contained in AC 23-17B, Systems and Equipment Guide for Certification of Small Airplanes and Airships, has been misinterpreted. That guidance stated: "An aircraft design that does not include a caution annunciation when the pitot heat is Off may be eligible for an ELOS finding that preserves a "dark cockpit" provided a placard or flight manual prescribes when to operate the pitot heat.” The phrase “may be eligible” means that design may be considered for an ELOS, however, not all design configurations are eligible as noted below:
1. Commuter category airplanes are not eligible.
2. Airplanes approved for Flight Into Known Icing per 14 CFR, part 23, § 23.1419 are not eligible.
3. Airplanes with service ceilings or maximum operating altitudes above 18,000 feet are not eligible because of controlled airspace. If a plane can fly at or above 18,000 feet it must be certified for Instrument Flight Rules (IFR) operation.
4. The eligibility of other IFR approved airplanes, including those with the service ceilings below 18,000 feet, is determined jointly by the ACOs and the Small Airplane Directorate.
Aircraft that are not eligible for the ELOS described above may be eligible for a different ELOS if their design has compensating features other than placards or AFM limitations. For instance, a design with retractable landing gear could hardwire pitot heat to power through a weight-on-wheels switch. There would be no need for an ON/OFF switch, so there would be no need for a caution annunciation of switch position.
Change 1 AC 23-17C 7/16/2012
247 An ELOS is inappropriate if the airplane is certified only for VFR since neither pitot heat nor pitot heat indication is required for VFR-Only airplanes. Pitot heat installed in a VFR-Only airplane is nonrequired equipment so neither § 23.1323 or § 23.1326 is applicable.
Change 1 AC 23-17C 7/16/2012
23.1327 Magnetic direction indicator
The corresponding rule in CAR 3 is CAR 3.666.
The corresponding airworthiness criteria is section 6.11, Airship Design Criteria, FAA-P-8110-2, Change 2.
Original Issue and Subsequent
If the magnetic compass that is required by § 23.1303 is the only heading instrument, then it should meet the requirements of this section. With an approved secondary system such as a directional gyro, and an appropriate placard to dictate which electrical devices should be switched off when reading the magnetic compass, according to § 23.1547, equivalent safety under part 21, § 21.21(b)(1) may be shown.
On magnetic direction indicators, heading information is considered an essential flight instrument function because its loss could result in reduced capability of the flight crew to cope with adverse operating conditions, especially for IFR flights. The indicator specified in this rule was intended to be a magnetic compass (nonstabilized). The requirement for a magnetic direction indicator existed before remote indicating compasses were available. If a magnetic stabilized direction indicator is installed as an additional instrument, the magnetic non-stabilized direction indicator (magnetic compass) is still required as the primary source of magnetic direction.
a. A magnetic direction indicator with remote magnetic sensor can be approved under § 21.21 of part 21 if it can be confirmed that it provides a level of safety equal to that provided by the magnetic compass required by § 23.1303(c). The reliability of the system should consider the effects of loss of the airplanes electrical system, the performance of the equipment under environmental conditions that may be encountered by the airplane, the integrity of the interface wiring, and the reliability of the components. The ELOS may be approved with or without a magnetic compass. If with, the accuracy requirements of this section do not apply to the magnetic compass. The stabilized direction indicators should have battery back-up. While the rules currently require 30 minutes of back-up power in § 23.1353(h), applicants should be advised that in our proposed jet rules, FAA is asking for enough back-up power to get the airplane down from its maximum altitude flying through IFR using normal pilot skills, not to exceed 60 minutes of back-up. The ELOS must specify how much back-up time they will have.
b. For a magnetically stabilized direc tion indicator approved under an ELOS finding, the system should be powered from a source that is independent of a single electrical generating system. This other source should be installed so it is operative without manual selection after total failure of a single electrical generating system. Dual independent stabilized indicator installations with split electrical bus systems may also be approved on multiengine airplanes under an
249 ELOS finding. The airplanes battery is not considered an acceptable source unless the state of charge of the battery is displayed to the pilot.
c. The following installation require ments of §§ 23.1327 and 23.1547 are also directly related to approval of either type of magnetic indicator:
(1) The accuracy is not excessively aff ected by the airplanes vibration or magnetic fields.
(2) Deviations of more than 10 degrees in level flight are not permissible, unless a magnetic stabilized direction indicator, which does not have a deviation in level flight greater than 10 degrees on any heading, or a gyroscopic direction indicator, is installed. If a gyroscopic direction indicator is installed, it is subject to compliance with § 23.1301 in that it must perform its intended function. It must, therefore, meet the accuracy requirements of TSO-C5, which represent the minimum allowable performance for gyroscopic direction indicators.
(3) A placard should show the calibration of the instruments in level flight with the engine(s) operating and whether the calibration was made with the radio receivers on or off.
(4) If deviations of more than 10 de grees caused by operation of electrical equipment are approved, the placard should state which electrical loads or combination of loads would cause deviations of more than 10 degrees.
Amendment 23-20 and Subsequent
A proposed revision in NPRM 75-23 explains this amendment as follows: “This proposal would allow deviation (exceeding 10 degrees) in a magnetic nonstabilized direction indicator caused by operation of electrically powered systems if the airplane is equipped with another direction indicator that meets the standard specified in paragraph (b) and the airplane is placarded in accordance with proposed Sec. 23.1547(e). Under these conditions, safety would not be adversely affected.”
The proposed rule, revised by Final Rule, Docket 14625, is explained as follows:
“One commentator objected to the proposal to amend Section 23.1327 on the ground that it would allow an indefinite amount of interference, which would confuse the pilot. The FAA believes that the placard that would be required by proposed Section 23.1327(c) would serve to alert the pilot to the fact that certain electrical loads, when switched on, cause excessive deviations of the magnetic nonstabilized direction indicator. The commentator further stated that if an additional magnetic direction indicator (having a deviation less than 10 degrees) were installed, there would no longer be a need for the magnetic nonstabilized direction indicator. The FAA agrees that an additional magnetic nonstabilized direction indicator is not a practical alternative, and proposed Section 23.1327 is revised to delete that
250 alternative. However, the FAA believes that the proposed exception is appropriate for those instances in which a magnetic stabilized direction indicator or gyroscopic direction indicator is installed along with a magnetic nonstabilized direction indicator. The commentator also contended that the gyroscopic direction indicator alternative is not a practical solution because it must be reset frequently, thus increasing the pilot’s workload. The FAA does not believe that the need to periodically reset the gyroscopic direction indicator adds significantly to the pilot's workload. Finally, this commentator stated that proposed Section 23.1327(c) would allow interference that is contrary to current Secs. 23.1327(a) and 23.1301(a)(4).
With respect to current Section 23.1327(a), the FAA believes the comment is valid, and that paragraph is revised for clarification. In view of this change, the requirements in current Section 23.1327(a) and proposed Section 23.1327(b) are combined into Section 23.1327(a), and proposed Section 23.1327(c) is redesignated Section 23.1327(b). With respect to current Section 23.1301(a)(4), the FAA does not believe the comment is valid, since the system consisting of a magnetic nonstabilized direction indicator and either a magnetic stabilized type or a gyroscopic type would meet that requirement.”
23.1329 Automatic pilot system
The corresponding rule in CAR 3 is CAR 3.667.
The corresponding airworthiness criteria is section 6.12, Airship Design Criteria, FAA-P-8110-2, Change 2.
Original Issue and Subsequent A single malfunction may not result in a hardover signal in more than one axis.
When the result of any single malfunction is shown not to be hazardous (no hardover signals) (slowover signals are acceptable if they are determined to be easily controllable without requiring exceptional skill or strength), then multiple axes being affected is acceptable providing the following:
a. The malfunction evaluations are acceptable even with the maximum drive signal due to the limited rate of change authority of the powered controlling element and flight control surfaces,
b. The monitor/limiting device is independent of the automatic pilot element,
c. The signal is less than the hardover signal due to the monitor/limiting device, and
d. An acceptable fault analysis shows the functional hazard of a combined monitor failure and automatic pilot malfunction is not catastrophic, including:
(1) The functional hazard of a failure of a lockout device/system to inhibit autopilot engagement until the pre-engagement check is successfully completed is hazardous or less,
(2) Pre-engagement check of the monitor system is mandatory with either a manual or automatic activation means, and
(3) Automatic pilot authority is not greater than necessary to satisfactorily control the airplane.
Alterations of increased engine horsepower (and either engine horsepower or major changes in exterior cowlings and surfaces), in part 23 airplanes, should consider the compatibility of the autopilot system with the increased horsepower. This is because the malfunction and performance tests of the autopilot are conducted with a defined amount of engine power. An increase in engine horsepower beyond 10 percent may adversely affect the autopilot system malfunctions, performance, controllability, and longitudinal stability characteristics. Therefore, flight testing may be necessary to verify the original approval of the autopilot system is still valid.
(a) The results of malfunction testing determine which flight condition is most critical. The effects of autopilot runaways are more pronounced at aft CG. Also, the phase of flight with the largest contribution to adverse conditions varies with airplane model.
(b) Airplane longitudinal stability is a factor in autopilot system malfunctions. There is an inverse relationship between engine horsepower and longitudinal stability. Although the turbine engine installations replacing reciprocating engines may be flat rated, the turbine is capable of producing increased horsepower at higher temperatures and altitudes, which could reduce longitudinal stability.
Therefore, autopilot performance, especially the pitch axis hardover malfunction, should be evaluated for acceptability. This policy is also applicable to power increases on airplanes with reciprocating engines, either engine replacement or engine modifications that add a turbocharger.
(c) Performance and controllability evaluations should be considered, including the configuration of most forward CG and minimum autopilot authority. This configuration is used to show the airplane can be safely controlled by the autopilot when the control surface hinge moment is the highest and the autopilot controllability is at its lowest during corresponding longitudinal trim and airspeed changes.
To show compliance with part 23, § 23.1329, applicable to autopilot system installations in small airplanes, the following is acceptable.
1. RELATED REGULATIONS AND DOCUMENTS
a. Regulations These acceptable means of compliance refer to certain provisions of part 23.
They may be used in showing compliance with the corresponding provisions of the former CAR for airplanes to which the CAR regulations are applicable. For convenience, the part 3, section reference is shown in parenthesis following the part 23 section reference:
§ 23.143 (3.106) Controllability and Maneuverability, General.
§ 23.253 High speed characteristics.
§ 23.395 (3.231) Control system loads.
§ 23.397 (3.212) Limit control forces and torques.
§ 23.689 (3.345) Cable systems.
§ 23.777 (3.384) Cockpit controls.
§ 23.779 (3.384) Motion and effect of cockpit controls.
§ 23.1301 (3.651 and 3.652) Function and installation.
§ 23.1309 Equipment, systems, and installations.
253 § 23.1321 (3.661 and 3.662) Arrangement and visibility.
§ 23.1322 Warning, caution, and advisory lights.
§ 23.1329 (3.667) Automatic pilot system.
§ 23.1351 (3.681) Electrical Systems and Equipment, General.
§ 23.1381 (3.696 and 3.697) Instrument lights.
§ 23.1431 (3.721) Electronic equipment.
§ 23.1555 (3.762, 3.763, and 3.765) Control markings.
§ 23.1581 (3.77) Airplane Flight Manual and Approved Manual Material, General.
§ 23.1583 (3.778) Operating limitations.
§ 23.1585 (3.779) Operating procedures.
b. Advisory Circular AC 23.1309-1E “System Safety Analysis and Assessment for Part 23 Airplanes,” November 17, 2011.
c. Technical Standard Order (TSO) TSO-C9c “Automatic Pilots”, September 15, 1960.
d. Industry Documents RTCA/DO-160F “Environmental Conditions and Test Procedures for Airborne Equipment”, December 6, 2007.
RTCA/DO-178B “Software Considerations in Airborne Systems and Equipment Certification”, December 1, 1992.
2. BACKGROUND
AC 23.1329-1, “Automatic Pilot Systems Approval,” which set forth an acceptable means for showing compliance with the autopilot installation requirements, was issued December 23, 1965. Although AC 23.1329-1 was inadvertently cancelled in 1977, criteria essentially equivalent to that contained in it continued to be used to show compliance with the applicable autopilot installation requirements.
AC 23.1329-1 was canceled by incorporation into this AC. The airworthiness regulations prescribe the requirements for autopilot installation approval. The following criteria have been applied and found reasonable and acceptable in previous type certification programs for complying with specific sections related to these approvals:
a. Compliance with the regulations necessitated the conversion of the force exerted by one pilot to overpower an engaged autopilot into measurable terms when either an autopilot quick disconnect or interrupt switch was not provided. The values in the table under § 23.143 are maximums. There may be circumstances where a maximum force less than 75 pounds is required for safety. For example, if a pilot is trying to overpower a nose-up malfunction during climb and reduce power at the same time, a maximum safe force may be less than 75 pounds. Thus, these forces, as measured at the pilots' controls, were equated to the following temporary and prolonged forces:
(1) The maximum temporary force to ov erpower the autopilot has not been allowed to exceed 30 pounds in roll (force applied at the rim of the wheel), 50 pounds in pitch, and 150 pounds in yaw. These forces are applicable only to initially overpowering the autopilot system.
(2) The maximum prolonged force to overpow er the autopilot should not exceed five pounds in roll, 10 pounds in pitch, and 20 pounds in yaw.
b. A reasonable period of time has been established for pilot recognition between the time a malfunction is induced into the autopilot system and the beginning of pilot corrective action following hands-off or unrestrained operation. The following time delays have been acceptable:
(1) A three-second delay following pilot recognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by a reliable failure warning system in the climb, cruise, and descent flight regimes.
(2) A one-second delay following pilot re cognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable warning system, in maneuvering and approach flight regimes.
3. Acceptable Means of Compliance The following procedure, according to the forces and times above, is acceptable as a means of showing that an autopilot system installation is in compliance with the airworthiness rules:
a. Cockpit Controls Evaluation of cockpit controls should include:
(1) The location of autopilot system controls should be readily accessible to the pilot, or both pilots, if a minimum of two pilots is required.
(2) Annunciators should conform to the proper color as specified in § 23.1322.
(3) A determination the controls are usable under bright sunlight and night lighting conditions (§ 23.1381).
(4) Either a quick disconnect or interrupt switch for the autopilot system are located on the side of the control wheel opposite the throttle(s) and are red in color. A disconnect switch stops all movement of the autopilot system. An interrupt switch momentarily interrupts all movement of the autopilot system.
(5) A determination that any automatic disconnects of the autopilot is adequately annunciated by an aural warning. If warning lights are used to supplement the aural warning, they should meet the requirements of § 23.1322. Use of a visual warning as the sole means of annunciating automatic disconnects is not considered acceptable.
(6) Motion and effect of autopilot cockpit controls should conform to the requirements of §§ 23.1329(c) and 23.779.
b. Malfunction Evaluations
(1) Malfunction evaluation flights should be conducted with the airplane loaded at the most critical weight or the most critical CG/weight combination.
Maximum untrimmed fuel imbalance should be considered during the evaluation. If autothrottles are installed, they should be operating, and autopilot servo torque should be set to the upper tolerance limit. The simulated malfunctions should be induced at various airspeeds and altitudes throughout the airplanes airspeed and altitude envelopes. These envelopes should include the maximum operating altitude for turbocharged or high altitude airplanes, or be within 10 percent of the service ceiling for normally aspirated airplanes, and when the airplane is stabilized in the normal operational attitudes. Vertical gyro mechanical failures should not be considered. The simulated failures and resulting corrective actions are not acceptable if they result in any of the following:
(a) Loads that exceed the substantiated structural design limit loads.
(b) Acceleration that is outside the 0 to 2g envelope. The positive "g" limitation may be increased up to the positive design limit maneuvering load factor if it has been previously determined analytically that neither the simulated failure nor resulting corrective action would result in loads beyond the design limit loads of the airplane.
(c) Speeds in excess of V NE or for airplanes with an established VMO/MMO, a speed midway between VMO/MMO and the lesser of VD/MD, or the speed demonstrated under § 23.253.
(d) Deviations from the flight path including bank angle in excess of 60 degrees or pitch attitude in excess of + 30 degrees deviation from the attitude at which the malfunction was introduced.
(e) A hazardous dynamic condition.
(2) Normal Flight Malfunctions The airplanes performance should be evaluated when the effect caused by the most critical single failure condition that can be expected to occur to the system and can be detected by the pilot is induced into the autopilot system.
Hidden or latent failures, in combination with detectable failures, should be considered when determining the most critical failure condition. Normal flight includes climb, cruise, and descent flight regimes with the airplane properly trimmed in all axes. Airplane configurations (combinations of gear and flaps), speeds, and attitudes should be evaluated for unsafe conditions.
The more critical of the following simulated malfunctions are the following:
(a) A simulated malfunction about any axis equivalent to the cumulative effect of any failure or combination of hidden failures, including manual-electric or automatic trim, if installed.
(b) The combined signals about all aff ected axes, if multiple axis failures can result from the malfunction of any single component. Amendment 3-2 to part 3 of the CAR, effective August 12, 1957, requires that an autopilot system should be designed so a single malfunction will not produce a hardover signal in more than one control axis (reference §§
3.667(e) and 23.1329(e)).
NOTE: A three-second delay following pilot recognition of an autopilot system malfunction, as indicated in item 2b(1), should be applied for normal flight malfunction evaluations.
(3) Maneuvering and Approach Malfunction
Maneuvering flight tests should include turns with the malfunction induced at the maximum bank angle for normal operation, up to the autopilot authority limits. Airplane configurations (combinations of gear and flaps), airspeeds, and altitudes should be evaluated to determine if unsafe conditions exist.
Simulated malfunctions described for normal flight malfunctions as indicated in items 3b(2)(a) and (b) (titled, “Normal Flight Malfunctions”) are applicable for introduction during maneuvering flight malfunction evaluation. The resultant accelerations, loads, and speeds should be within limits described for normal flight malfunctions. Malfunctions introduced during coupled approaches should not place the airplane in a hazardous attitude or an attitude that would prevent the pilot from conducting a missed approach or safe landing. Altitude losses resulting from the simulated