257 malfunctions are to be measured accurately and presented in the limitations section of the AFM or approved manual material. In maneuvering and approach flight regimes, the pilot should recognize an autopilot system malfunction within one-second. This recognition should occur as the result of a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable warning system that is applied.
NOTE: Accurate measurement of altitude loss, because of an autopilot malfunction during an instrument landing approach, is essential. This altitude loss during a critical phase of flight provides the basis for establishing the minimum approach altitude during autopilot-coupled approaches. The loss should be determined by measuring from the altitude at which the malfunction is induced to the lowest altitude observed during the recovery maneuver, unless instrumentation is available to measure the vertical deviation from the intended glide path to the lowest point in the recovery maneuver. In this section, Appendix 1 contains a method of measurement for approach altitude loss. Altitude losses because of malfunctions in other flight regimes, though less critical, may be determined by measuring the deviation from the flight path in a manner similar to that used for the glide slope.
(4) Alternate Means of Compliance for Autopilots Incorporating Electronic Monitors/Limiting Devices Listed below are alternate means of compliance. These alternate means cite considerations for evaluating both monitors and limiting devices when functioning of such devices is necessary to prevent the airplane from exceeding the malfunction limits identified in paragraph 3b(1) of this AC.
(a) Alternate Means No. 1
1. Monitor/Limiter Inhibited With the monitor/limiter inhibited, autopilot malfunction flight testing may not cause any of the following:
(aa) Roll to exceed 80 degrees.
(bb) Pitch to exceed +45 degrees, -35 degrees.
(cc) Accelerations outside the 0g to 2.5g envelope.
(dd) Airspeed exceeding VNE or for an airplane having an established VMO/MMO, a speed not greater than a speed midway between VMO/MMO and the lesser of VD/MD or the speed demonstrated under § 23.253.
2. Reliability and Prerequisite Criteria (aa) A fault analysis should show the failure effect of a monitor failure, combined with an autopilot malfunction, is less than major; and
(bb) Pre-engagement check of the monitor is mandatory. No credit is allowed for a pilot-activated pre-engagement check unless there is a lockout device or system.
(b) Alternate Means No. 2
1. Monitor/Limiter Inhibited With the monitor/limiter inhibited, autopilot malfunction flight testing may not cause any of the following:
(aa) Roll to exceed 80 degrees.
(bb) Pitch to exceed +45 degrees, -35 degrees.
(cc) Accelerations outside the -0.2g to 2.5g envelope.
(dd) Airspeed exceeding VNE or for an airplane having an established VMO/MMO, a speed not greater than a speed midway between VMO/MMO and the lesser of VD/MD or the speed demonstrated under § 23.253.
2. Reliability and Prerequisite Criteria (aa) An acceptable fault analysis showing the failure effect of a combined monitor failure and an autopilot malfunction is less than hazardous. In addition, the failure effect of failure of a lockout device to inhibit autopilot engagement, as identified in Item (cc) below, is less than major;
(bb) Pre-engagement check of the monitor is mandatory with either a manual or automatic activation means; and
(cc) Autopilot engagement is inhibited until pre-engagement check is successfully completed.
(c) Alternate Means No. 3
1. Flight tests with monitors inhibited are not required.
2. Reliability and prerequisite Criteria
259 (aa) An acceptable fault analysis showing the failure effect of a combined monitor failure and autopilot is less than catastrophic.
In addition, failure of a lockout device/system to inhibit autopilot engagement, as identified in Item (cc) below, is less than hazardous;
(bb) Pre-engagement check of the monitor is mandatory with either a manual or automatic activation means;
(cc) Autopilot engagement inhibited until the pre-engagement check is successfully completed; and
(dd) Autopilot authority not greater than necessary to satisfactorily control the airplane.
c. Recovery of Flight Control Evaluate the ability to recover flight control from the engaged autopilot system either by manual use of a quick disconnect or by physically overpowering the system.
d. Performance Flights Performance evaluation tests should be conducted with the airplane loaded to its most adverse CG and weight condition. Autopilot performance with the servo torque values at the lowest production torque tolerance limit should be used to demonstrate safe controllability and stability. Flight tests are necessary to ensure the autopilot system performs its intended function, including all modes of operation presented for approval (reference § 23.1301).
e. Single-Engine Approach For multiengine airplanes, an engine failure during a normal Instrument Landing System (ILS) approach should not cause a lateral deviation of the airplane from the flight path at a rate greater than three degrees per second or produce hazardous attitudes. This rate should be measured and averaged over a five-second period.
If approval is sought for ILS approaches initiated with one engine inoperative, the autopilot should be capable of conducting the approach.
f. Aircraft Flight Manual (AFM) Information The following information should be placed in the AFM (or, if the airplane does not have an AFM, it should be placed in the Pilots Operating Handbook (POH) or presented to the pilot in the form of placards) as follows:
(1) In the operating limitations section, the airspeed limitations, maximum altitude for operation if different from the maximum certificated altitude of the airplane, category of ILS approaches for which approval is granted, minimum approach height, and any other applicable limitations.
(2) In the operating procedures section, the normal operating information, including navigation and glide slope intercept recommendations. For those autopilot systems, which incorporate either monitors or limiter devices, the pre-engagement procedures and the means of indicating that, the preengagement has been successfully completed.
(3) In the emergency operation procedures section
(a) A statement of the altitude loss in the cruise, climb, and descent configurations; and maneuvering flight conditions, because of possible malfunctioning of the autopilot system.
(b) A statement of the altitude loss because of malfunctions while in the approach configuration. If engine inoperative approach is approved, the altitude loss should be included.
(c) Any other procedure related to emergency procedures associated with either the autopilot or associated systems. (See Figure 1.)
Altitude Loss
1. Malfunction inducement point.
2. Malfunction recognition by pilot.
3. Initiation of manual recovery action by pilot.
4. Altitude loss with no instrumentation.
5. Altitude loss with instrumentation.
30 ILS Nominal Glide Slope Path of Airplane Wheels One Second Delay Y Malfunction Inducement Point 1:29 Slope 15.0 feet 8177 Runway Threshold ILS Glide Path Origin FIGURE 1. ACCEPTABLE METHOD FOR DETERMINING
ALTITUDE LOSS IN APPROACH 261
262 FIGURE 1CONTINUATION
Malfunction Evaluations. The airplane should be established on the ILS glide slope and localizer in the configuration(s) with the approach speed(s) specified by the applicant for approach. Simulated automatic flight control system malfunctions should be induced at critical points along the ILS taking into consideration all design variations and their limits in automatic flight control system sensitivity and authority.
The malfunctions should be induced in each axis. While the pilots may know the purpose of the flight, they should not be told when a malfunction is to be or has been applied except through a deviation of the airplane from the intended flight path, abnormal control movements, or by a reliable failure warning system. After a failure, recovery should be initiated one second after the pilot recognizes the failure.
a. A three-degree glide slope should be used for these tests to determine the malfunction effects to be expected in service.
b. For use during a coupled ILS approach, the automatic control system should not fail in such a way that it causes the airplane wheels to descend below a limit line lying below the glide slope, sloping upward at 29:l from a point 15 feet above the runway threshold. With the airplane established on the glide slope in approach configuration, at approach speed, the most critical malfunction is induced at a test altitude referenced to the runway threshold. Measure the altitude loss between the test altitude and the lowest point of the manual recovery, unless instrumentation is available to measure the vertical deviation from the intended glide path to the lowest point in the recovery maneuver. The altitude loss and the known distance to the threshold from the lowest recovery altitude are compared to the limit line.
The lowest test altitude, from which malfunction and manual recovery can be completed, without the airplane wheels descending below the limit line, is considered the minimum height for use of the automatic flight control system.
c. Recovery from all malfunctions should be shown either by overpowering or by manual use of an emergency quick disconnect device after the appropriate delay.
The pilot should be able to return the airplane to its normal flight altitude under full manual control without exceeding the defined limits.
Amendment 23-43 and Subsequent
A proposed revision in NPRM 90-23 added a requirement for a quick release explained as follows: “This proposal would standardize the location of the quick release (emergency) control for autopilot systems. Standardization permits consistency of pilot responses in preventing hazardous airplane attitudes during autopilot malfunctions. The location specified is consistent with the requirements for part 25 airplanes, except this proposal allows the control to also be located on a stick control.”
263 Amendment 23-49 and Subsequent
A proposed revision in NPRM 94-21 clarified the quick release requirement explained as follows: “New Sec. 23.1329(b), adopted by Amendment No. 23-24 (58 FR 18958, April 9, 1993), does not state clearly that stick controlled airplanes must be equipped with the same autopilot quick release controls that are required for airplanes with control wheels. This proposed revision of Sec. 23.1329(b) would clarify that a quick release control must be installed on each control stick of an airplane that can be operated from either pilot seat.”
23.1331 Instruments using a power source
The corresponding rule in CAR 3 is CAR 3.668.
The corresponding airworthiness criteria is section 6.14, Airship Design Criteria, FAA-P-8110-2, Change 2.
Original Issue and Subsequent Section 23.1331(a) applies only to gyroscopic instruments, but § 23.1331(b) in this section applies to any instrument that depends on external power or external energy for proper operation.
The requirement for two independent power sources in § 23.1331(b)(1) applies to either vacuum or electrically driven gyroscopic instruments.
NOTE: Section 23.1331 does not apply to pitot and static systems.
Electrical Systems When complying with § 23.1331(b) in this section, a single battery required for starting is acceptable if: 1) the electrical system is capable of continuous normal operation without external excitation or stability, and 2) there is no probable failure of the battery that will adversely affect the electrical system once it is operating.
However, the airplane battery cannot be accepted toward showing compliance to the power source requirements of §§ 23.1331 and 23.1351 unless the state of charge of the battery is displayed to the pilot.
A single electrical bus is unacceptable for a multiengine airplane.
The multiengine requirement is for two independent power sources. Therefore, an installation with a single primary power source for all flight instruments and a manually operated backup is not acceptable.
a. This system could conceivably fail in su ch a way that all the flight instruments could be simultaneously damaged or disabled (that is, loss of voltage regulation).
This would not be corrected by switching to the backup power source.
b. Also, an electrical system with a pr imary power source that employed a backup source with common circuitry or components is not independent.
Standby Vacuum Systems The intended function of a standby vacuum system is to provide a second vacuum source for the gyroscopic instruments after a failure of the primary vacuum system.
The standby system should either supply enough vacuum to maintain the accuracy and reliability of the gyroscopic instruments throughout the phases of flight, or there
265 should be limitations on operation in the AFM. When operating on the standby system, the pilot should predicate operations on other certified systems (partial panel) and use the gyroscopic instruments as an aid, provided the pilot determines these instruments give acceptable information. Also, the pilot should not manipulate the throttle, other than for normal flight, in an attempt to control vacuum pressure within the limitations.
If a second vacuum system were not required, the standby installation would be for non-required equipment according to this rule. In addition, § 21.21(b)(2) requires there be no feature that results in an unsafe condition. To comply with these requirements, it should be shown that neither operation nor failure of the standby vacuum system interfere with the normal operation of the primary system or result in any unsafe condition. The pilot should also be kept apprised of when the standby system is in operation either by manual source selection or by red visual annunciation (§ 23.1322) if an automatic switching system is installed. To assure that no unsafe condition will result, the standby system should be flight evaluated in each unique airplane installation. In addition, operating information, emergency procedures, and limitations should be available in an AFMS or placards, as appropriate. This information should meet the requirements of §§ 23.1583 and 23.1585 of this part, and it should emphasize the standby vacuum system is for emergency use only and should not be used for dispatch purposes.
Amendment 23-43 and Subsequent Independent Power Sources A proposed revision in NPRM 90-23 explains this amendment as follows: “This proposal requires a visual annunciation to indicate when power for gyroscopic instruments is not adequate, and two independent sources of power for all airplanes.
Requirements in current paragraphs (a)(1) and (a)(2) are being deleted because the general requirements of §§ 23.1301 and 23.1309 will adequately address these issues.”
The proposal to Amendment 23-43 by Final Rule, Docket 26344, is based on comments as follows: “Several comments were received on this proposal. One commenter supports the proposal but notes that it does not address non-gyroscopic instruments, and would result in power supply requirements for such instruments being omitted from regulations. This commenter also believes the word "adjacent" in proposed Sec. 23.1331(a) is too restrictive and requests the meaning of the word "independent" in proposed Sec. 23.1331(c) in context of sources of power for singleengine airplanes. Finally, this commenter identifies support for the provisions of proposed Sec. 23.1331(b)(2).
The FAA has reviewed this proposal and agrees that by inserting the word "gyroscopic" in the introductory text of this proposal, other types of instruments that use a power source for their function would be omitted from the regulations. To correct this omission and retain the current provision of the regulations that address
266 all instruments, the word "gyroscopic" is being removed from the introductory text.
To further clarify the applicability of these requirements, the words "that uses a power source" are being added between the words "instrument" and "the".
The FAA also reviewed this commenter's position on the word "adjacent" and agrees that its application could be too restrictive. The intent of this proposal is to require any installed separate power indicator to be located so that a pilot who is using that instrument will notice the loss of that instrument's power. To clarify and preclude restrictive application of this requirement, the word "adjacent" is removed and replaced with words similar to those used in Sec. 23.1321(a).
In regard to the commenters question on the word "independent" in context of sources of power for single-engine airplanes, this word has the same meaning for all airplanes, except that on single-engine airplanes the second source cannot be driven by a separate engine.
Adverse service experience that has resulted from power source failures and the subsequent loss of flight instrumentation has shown that it is necessary to provide a backup power source for the flight instruments. In the case of instruments that use a vacuum power source, the second source has been provided by installing a smaller electric driven vacuum pump and by arranging the vacuum system so that this pump is isolated from the normal vacuum system and so that it provides power to the instruments only after the normal engine driven pump fails.”
Guidance
This amendment adds the requirement for independent power sources for required instruments for single-engine as well as multiengine airplanes. This was considered appropriate because of the number of single-engine airplane accidents that were attributed to the loss of power to required flight instruments. Also, the reference to “gyroscopic” was removed to include both gyroscopic and non-gyroscopic instruments since non-gyroscopic flight instruments are in use.
a. Instruments that provide required flight information and use an external power source are now required to have two independent power sources. This requirement has the same intent for single-engine airplanes as for multiengine airplanes: to functionally isolate flight instruments so any failure of one power source or instrument will not cause the complete loss of a required flight instrument function. Thus, in the failure of a heading instrument, that failure may not result in the loss of the proper supply of energy to the attitude indicator powered by the same source, and loss of a single power supply may not cause loss of any required instrument function.
b. Ships starter batteries used in normal operations are acceptable as backup power sources only if they are approved per § 23.1353.
c. This regulation is not intended to apply to circuit protection devices, which are to be considered in §§ 23.1351 and 23.1357.
d. These changes are meant to apply to those instruments that rely on a power source and provide required flight information. Such instruments are those that provide information for direct control of flight that are required by the kinds of operation for which the airplane has been approved. Thus, this section applies to all flight instruments required by 14 CFR, part 23, § 23.1303 and part 91, § 91.205. So, instruments in airplanes limited to VFR operations that are not required for VFR would not have to comply with the requirements of § 23.1331. Exemptions would not be necessary or appropriate.
e. Each independent power source must provide enough power for normal operations throughout the approved flight envelope of the airplane and for any operations for which the airplane is approved. For example, an IFR approved airplane must have independent power sources for the display of attitude that are not limited to altitudes below the approved service ceiling of the airplane.
f. Section 23.1331(c) does not require installing dual alternators or vacuum systems on single engine airplanes. Other options include: 1) a dedicated battery with a 30-minute capacity for electrical instrument loads essential to continued safe flight and landing, 2) use of differently powered types of instruments for primary and standby, or 3) verifying the aircraft battery used for starting by a system safety analysis per § 23.1309.
Amendment 23-62 and Subsequent
In Docket No. FAA-2009-0738, the Discussion of the Regulatory Amendments stated: The proposed changes to § 23.1331would apply to instruments that rely on a power source to provide required flight information for IFR operations.
Consequently, this section applies to all flight instruments such as those required by parts 23, 91, 121, and 135. Airplanes limited by type design to VFRoperations would not have to comply with the requirements of proposed § 23.1331(c).
Each independent power source must provide sufficient power for normal operations throughout the approved flight envelope of the airplane and for any operations approved for the airplane. Section 23.1331(c) would not require the installation of dual alternators or vacuum systems on single engine airplanes. One option includes a dedicated battery that meets the requirements of § 23.1353(h) for electrical instrument loads essential to continued safe flight and landing. Another option includes separately powered types of instruments for primary and standby use. The last option would include performing a system safety analysis, per § 23.1309, to identify the procedures necessary to verify the charge state of any airplane starting battery that is used to power a stand-by system.
Change 1 AC 23-17C 7/16/2012
268 This amendment removes the requirement to comply with § 23.1331(c) for Day VFR and Night VFR aircraft. For IFR aircraft, this amendment clarifies that two independent power sources are acceptable if:
1. Two electrical power sources are installed for an all electric aircraft,
2. One generated electrical source and a battery that meets § 23.1353(h) is installed in an all electric aircraft, or
3. Different types of power, electrical and vacuum, are installed for primary and secondary instruments.
The Final Rule is adopted with clarification.