23.1325 Static pressure system Amendment 23-1 and Subsequent Both VFR and IFR airplanes should meet the requirements of § 23.1325 in paragraph (b)(3) of this regulation because static vent icing can occur during both VFR and IFR conditions with hazardous consequences. The rule provides for either an anti-icing means or an alternate static source.
a. If installed, the alternate static source is not restricted to emergency conditions but may be used to monitor the primary static system.
b. We suggest marking the secondary static source with the word “Alternate.”
c. This rule also requires a correction card in the cockpit if the altimeter changes by more than 50 feet on the alternate source. The correction card does not need to be in clear view of the pilot as long as it is available to a pilot seated in the flight position. An acceptable means for alternate-static-source correction data is located in the Performance Section of Airplane Flight Manuals (AFM) with other airspeed and altimeter calibration graphs. A placard that the correction data is available in the Performance Section, which is noted in the Limitations Section of the AFM, may be provided for additional clarification. The alternate static source is separate, and its correction card should provide correction data for the alternate source only.
d. The alternate static source is subject to all parts of § 23.1325, as is the primary static source.
See AC 20-124, Water Ingestion Testing for Turbine Powered Airplanes, for guidance on testing the airspeed and static systems for water ingestion susceptibility.
Amendment 23-34 and Subsequent See AC 23-8A, Flight Test Guide for Certification of Part 23 Airplanes, for additional guidance.
23.1326 Pitot heat indication systems Amendment 23-49 and Subsequent This rule requires a caution annunciation whenever the pitot heat is Off or there is a failed heating circuit in the pitot tube heater. The second annunciation cause is fully justified in that it represents a failure condition. The first can have a positive safety effect if it causes pilots to activate the pitot heat in all environmental conditions. This eliminates the loss of the pitot static system due to the pilot error of failing to operate pitot heat when conditions warrant it.
A caution annunciation when the pitot heat is Off has two negative issues:
(1) It violates the “dark cockpit” where caution and warning lights only represent failure conditions; and
(2) Adherence to a “dark cockpit” will cause pitot heat operation in all environmental conditions, which will shorten the life of the system.
The Small Airplane Directorate is proposing rulemaking to delete § 23.1326(b)(1) (the requirement for a caution annunciation when the pitot heat is Off). An aircraft design that does not include a caution annunciation when the pitot heat is Off may be eligible for an Equivalent Level of Safety finding that preserves a “dark cockpit” provided a placard or flight manual prescribes when to operate the pitot heat.
23.1327 Magnetic direction indicator Original Issue and Subsequent If the magnetic compass that is required by § 23.1303 is the only heading instrument, then it should meet the requirements of this section. With an approved secondary system such as a directional gyro, and with an appropriate placard to dictate which electrical devices should be switched off when reading the magnetic compass, per § 23.1547, equivalent safety pursuant to part 21, § 21.21(b)(1) may be shown.
Regarding magnetic direction indicators: heading information is considered an essential flight instrument function because its loss could result in reduced capability of the flight crew to cope with adverse operating conditions, especially for IFR flights. The indicator specified in this rule was intended to be a magnetic compass (non-stabilized). The requirement for a magnetic direction indicator existed before remote indicating compasses were available. If a magnetic stabilized direction indicator is installed as an additional instrument, the magnetic non-stabilized direction indicator (magnetic compass) is still required as the primary source of magnetic direction.
a. A magnetic direction indicator with remote magnetic sensor can be approved under § 21.21 of part 21 if it can be substantiated that it provides a level of safety equal to that provided by the magnetic compass required by § 23.1303(c). The reliability of the system should consider the effects of loss of the airplane’s electrical system, the performance of the equipment under environmental conditions that may be encountered by the airplane, the integrity of the interface wiring, and the reliability of the components.
b. For a magnetically stabilized direction indicator approved under an equivalent level of safety finding, the system should be powered from a source that is independent of a single electrical generating system. This other source should be installed so that it is operative without manual selection after total failure of a single electrical generating system. Dual independent stabilized indicator installations with split electrical bus systems may also be approved on multiengine airplanes under an equivalent level of safety finding. The airplane’s battery is not considered an acceptable source unless the state of charge of the battery is displayed to the pilot.
c. The following installation requirements of §§ 23.1327 and 23.1547 are also directly related to approval of either type of magnetic indicator:
(1) The accuracy is not excessively affected by the airplane’s vibration or magnetic fields.
(2) Deviations of more than 10° in level flight are not permissible, unless a magnetic stabilized direction indicator which does not have a deviation in level flight greater than 10° on any heading, or a gyroscopic direction indicator, is installed. If a gyroscopic direction indicator is installed, it is subject to compliance with § 23.1301 in that it must perform its intended function. It must, therefore, meet the accuracy requirements of TSO-C5, which represent the minimum allowable performance for gyroscopic direction indicators.
(3) A placard should show the calibration of the instruments in level flight with the engine(s) operating and whether the calibration was made with the radio receivers on or off.
(4) If deviations of more than 10° caused by operation of electrical equipment are approved, the placard should state which electrical loads or combination of loads would cause deviations of more than 10°.
23.1329 Automatic pilot system Original Issue and Subsequent A single malfunction may not result in a hardover signal in more than one axis. When the result of any single malfunction is shown not to be hazardous (no hardover signals) (slowover signals are acceptable if they are determined to be easily controllable without requiring exceptional skill or strength), then multiple axes being affected is acceptable providing the following:
a. The malfunction evaluations are acceptable even with the maximum drive signal due to the limited rate of change authority of the powered controlling element and flight control surfaces;
b. The monitor/limiting device is independent of the automatic pilot element;
c. The signal is less than the hardover signal due to the monitor/limiting device; and
d. An acceptable fault analysis shows the functional hazard of a combined monitor failure and automatic pilot malfunction is not catastrophic, including the following:
(1) The functional hazard of a failure of a lockout device/system to inhibit autopilot engagement until the pre-engagement check is successfully completed is hazardous or less;
(2) Pre-engagement check of the monitor system is mandatory with either a manual or automatic activation means, and;
(3) Automatic pilot authority is not greater than necessary to satisfactorily control the airplane.
Alterations of increased engine horsepower (and either engine horsepower or major changes in exterior cowlings and surfaces, etc.), in part 23 airplanes, should consider the compatibility of the autopilot system with the increased horsepower, since the malfunction and performance tests of the autopilot are conducted with a defined amount of engine power.
Generally, an increase in engine horsepower beyond 10 percent may adversely affect the autopilot system malfunctions, performance, controllability, and longitudinal stability characteristics. Therefore, flight testing may be necessary to verify that the original approval of the autopilot system is still valid.
a. The results of malfunction testing determine which flight condition is most critical. The effects of autopilot runaways are more pronounced at aft center of gravity (c.g.).
174 Furthermore, the phase of flight with the largest contribution to adverse conditions varies with airplane model.
b. Airplane longitudinal stability is a factor in autopilot system malfunctions. Generally, there is an inverse relationship between engine horsepower and longitudinal stability. Although the turbine engine installations replacing reciprocating engines may be flat rated, the turbine is capable of producing increased horsepower at higher temperatures and altitudes, which could reduce longitudinal stability. Therefore, autopilot performance, especially the pitch axis hardover malfunction, should be evaluated for acceptability. This policy is also applicable to power increases on airplanes with reciprocating engines, either engine replacement or engine modifications that add a turbocharger.
c. Performance and controllability evaluations should be considered, including the configuration of most forward c.g. and minimum autopilot authority. This configuration is used to demonstrate that the airplane can be safely controlled by the autopilot when the control surface hinge moment is the highest and the autopilot controllability is at its lowest during corresponding longitudinal trim and airspeed changes.
To show compliance with part 23, § 23.1329, applicable to autopilot system installations in small airplanes, the following is acceptable.
1. RELATED REGULATIONS AND DOCUMENTS
a. Regulations These acceptable means of compliance refer to certain provisions of part 23. They may be used in showing compliance with the corresponding provisions of the former Civil Air Regulations (CAR) in the case of airplanes to which the CAR regulations are applicable. For convenience, the part 3 section reference is shown in parenthesis following the part 23 section reference:
§ 23.143 (3.106) Controllability and Maneuverability, General.
§ 23.253 High speed characteristics.
§ 23.395 (3.231) Control system loads.
§ 23.397 (3.212) Limit control forces and torque’s.
§ 23.689 (3.345) Cable systems.
§ 23.777 (3.384) Cockpit controls.
§ 23.779 (3.384) Motion and effect of cockpit controls.
§ 23.1301 (3.651 and 3.652) Function and installation.
§ 23.1309 Equipment, systems, and installations.
§ 23.1321 (3.661 and 3.662) Arrangement and visibility.
§ 23.1322 Warning, caution, and advisory lights.
175 § 23.1329 (3.667) Automatic pilot system.
§ 23.1351 (3.681) Electrical Systems and Equipment, General.
§ 23.1381 (3.696 and 3.697) Instrument lights.
§ 23.1431 (3.721) Electronic equipment.
§ 23.1555 (3.762, 3.763, and 3.765) Control markings.
§ 23.1581 (3.77) Airplane Flight Manual and Approved Manual Material, General.
§ 23.1583 (3.778) Operating limitations.
§ 23.1585 (3.779) Operating procedures.
b. Advisory Circulars AC 21-16D Radio Technical Commission for Aeronautics (RTCA) Document DO-160D.
AC 23.1309-1C Equipment, Systems, and Installations in Part 23 Airplanes.
c. Technical Standard Order TSO-C9c Automatic Pilots.
d. Industry Documents RTCA/DO-160D Environmental Test Conditions and Test Procedures for Airborne Equipment.
RTCA/DO-178B Software Considerations in Airborne Systems and Equipment Certification.
2. BACKGROUND AC 23.1329-1, Automatic Pilot Systems Approval, which set forth an acceptable means for showing compliance with the autopilot installation requirements, was issued December 23, 1965. Although AC 23.1329-1 was inadvertently canceled in 1977, criteria essentially equivalent to that contained therein continued to be used to show compliance with the applicable autopilot installation requirements. The airworthiness regulations prescribe the requirements for autopilot installation approval. The following criteria have been applied and found reasonable and acceptable in previous type certification programs for complying with specific sections related to these approvals:
a. Compliance with the regulations necessitated the conversion of the force exerted by one pilot to overpower an engaged autopilot into measurable terms when either an
176 autopilot quick disconnect or interrupt switch was not provided. The values in the table under § 23.143 are maximums. There may be circumstances where a maximum force less than 75 pounds is required for safety. For example, if a pilot is trying to overpower a nose-up malfunction during climb and reduce power at the same time, a maximum safe force may be less than 75 pounds. Consequently, these forces, as measured at the pilot's controls, were equated to the following temporary and prolonged forces:
(1) The maximum temporary force to overpower the autopilot has not been allowed to exceed 30 pounds in roll (force applied at the rim of the wheel), 50 pounds in pitch, and 150 pounds in yaw. These forces are applicable only to initially overpowering the autopilot system.
(2) The maximum prolonged force to overpower the autopilot should not exceed 5 pounds in roll, 10 pounds in pitch, and 20 pounds in yaw.
b. A reasonable period of time has been established for pilot recognition between the time a malfunction is induced into the autopilot system and the beginning of pilot corrective action following hands-off or unrestrained operation. The following time delays have been acceptable:
(1) A 3-second delay following pilot recognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable failure warning system in the climb, cruise, and descent flight regimes.
(2) A 1-second delay following pilot recognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable warning system, in maneuvering and approach flight regimes.
3. ACCEPTABLE MEANS OF COMPLIANCE The following procedure, in accordance with the forces and times above, is acceptable as a means of showing that an autopilot system installation is in compliance with the airworthiness rules:
a. Cockpit Controls Evaluation of cockpit controls should include the following:
(1) The location of autopilot system controls should be readily accessible to the pilot, or both pilots, if a minimum of two pilots is required.
(2) Annunciators should conform to the proper color as specified in § 23.1322.
(3) A determination that the controls are usable under bright sunlight and night lighting conditions (§ 23.1381).
(4) Either a quick disconnect or interrupt switch for the autopilot system are located on the side of the control wheel opposite the throttle(s) and are red in color. A disconnect switch stops all movement of the autopilot system. An interrupt switch momentarily interrupts all movement of the autopilot system.
(5) A determination that any automatic disconnects of the autopilot is adequately annunciated by an aural warning. If warning lights are utilized to supplement the aural warning, they should meet the requirements of § 23.1322. Use of a visual warning as the sole means of annunciating automatic disconnects is not considered acceptable.
(6) Motion and effect of autopilot cockpit controls should conform with the requirements of §§ 23.1329(c) and 23.779.
b. Malfunction Evaluations
(1) Malfunction evaluation flights should be conducted with the airplane loaded at the most critical weight or the most critical c.g./weight combination. Maximum untrimmed fuel imbalance should be considered during the evaluation. If autothrottles are installed, they should be operating, and autopilot servo torque should be set to the upper tolerance limit. The simulated malfunctions should be induced at various airspeeds and altitudes throughout the airplane's airspeed and altitude envelopes. These envelopes should include the maximum operating altitude for turbocharged or high altitude airplanes, or be within 10 percent of the service ceiling for normally aspirated airplanes, and when the airplane is stabilized in the normal operational attitudes. Vertical gyro mechanical failures should not be considered. The simulated failures and subsequent corrective actions are not acceptable if they result in any of the following:
(i) Loads that exceed the substantiated structural design limit loads.
(ii) Acceleration that is outside the 0 to 2g envelope. The positive "g" limitation may be increased up to the positive design limit maneuvering load factor if it has been previously determined analytically that neither the simulated failure nor subsequent corrective action would result in loads beyond the design limit loads of the airplane.
(iii) Speeds in excess of VNE or for airplanes with an established VMO/MMO, a speed midway between VMO/MMO and the lesser of VD/MD, or the speed demonstrated under § 23.253.
(iv) Deviations from the flight path including bank angle in excess of 60° or pitch attitude in excess of + 30° deviation from the attitude at which the malfunction was introduced.
(v) A hazardous dynamic condition.
(2) Normal Flight Malfunctions The airplane's performance should be evaluated when the effect caused by the most critical single failure condition that can be expected to occur to the system and can be detected by the pilot is induced into the autopilot system. Hidden or latent failures, in combination with detectable failures, should be considered when determining the most critical failure condition. Normal flight includes climb, cruise, and descent flight regimes with the airplane properly trimmed in all axes. Airplane configurations (combinations of gear and flaps), speeds, and attitudes should be evaluated for unsafe conditions. The more critical of the following simulated malfunctions are the following:
(i) A simulated malfunction about any axis equivalent to the cumulative effect of any failure or combination of hidden failures, including manual-electric or automatic trim, if installed.
(ii) The combined signals about all affected axes, if multiple axis failures can result from the malfunction of any single component. Since Amendment 3-2 to part 3 of the CAR, effective August 12, 1957, the requirements are that an autopilot system should be designed so that a single malfunction will not produce a hardover signal in more than one control axis (reference §§ 3.667(e) and
23.1329(e)).
Note: A 3-second delay following pilot recognition of an autopilot system malfunction, as indicated in Item 2b(1), should be applied for normal flight malfunction evaluations.
(3) Maneuvering and Approach Malfunction Maneuvering flight tests should include turns with the malfunction induced at the maximum bank angle for normal operation, up to and including the autopilot authority limits. Airplane configurations (combinations of gear and flaps), airspeeds, and altitudes should be evaluated to determine if unsafe conditions exist. Simulated malfunctions described for normal flight malfunctions as indicated in Items 3b(2)(i)
179 and (ii) (titled, “Normal Flight Malfunctions”) are applicable for introduction during maneuvering flight malfunction evaluation. The resultant accelerations, loads, and speeds should be within limits described for normal flight malfunctions. Malfunctions introduced during coupled approaches should not place the airplane in a hazardous attitude or an attitude that would prevent the pilot from conducting a missed approach or safe landing. Altitude losses resulting from the simulated malfunctions are to be measured accurately and presented in the Limitations Section of the Airplane Flight Manual (AFM) or approved manual material. In maneuvering and approach flight regimes, the pilot should recognize an autopilot system malfunction within 1-second. This recognition should occur as the result of a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable warning system that is applied.
Note: Accurate measurement of altitude loss, due to an autopilot malfunction during an instrument landing approach, is essential. This altitude loss during a critical phase of flight provides the basis for establishing the minimum approach altitude during autopilot coupled approaches. The loss should be determined by measuring from the altitude at which the malfunction is induced to the lowest altitude observed during the recovery maneuver, unless instrumentation is available to measure the vertical deviation from the intended glide path to the lowest point in the recovery maneuver. In this section, Appendix 1 contains a method of measurement for approach altitude loss. Altitude losses due to malfunctions in other flight regimes, though less critical, may be determined by measuring the deviation from the flight path in a manner similar to that used for the glide slope.
(4) Alternate Means of Compliance for Autopilots Incorporating Electronic Monitors/Limiting Devices Listed below are alternate means of compliance. These alternate means cite considerations for evaluating both monitors and limiting devices when functioning of such devices is necessary to prevent the airplane from exceeding the malfunction limits identified in paragraph 3b(1) of this AC.
(i) Alternate Means No. 1 (A) Monitor/Limiter Inhibited With the monitor/limiter inhibited, autopilot malfunction flight testing may not cause any of the following:
(1) Roll to exceed 80°.
(2) Pitch to exceed +45°, -35°.
(3) Accelerations outside the 0g to 2.5g envelope.
(4) Airspeed exceeding VNE or for an airplane having an established VMO/MMO, a speed not greater than a speed midway between VMO/MMO and the lesser of VD/MD or the speed demonstrated under § 23.253.
(B) Reliability and Prerequisite Criteria
(1) A fault analysis should show that the failure effect of a monitor failure, combined with an autopilot malfunction, is less than major; and
(2) Pre-engagement check of the monitor is mandatory. No credit is allowed for a pilot-activated pre-engagement check unless there is a lockout device or system.
(ii) Alternate Means No. 2 (A) Monitor/Limiter Inhibited With the monitor/limiter inhibited, autopilot malfunction flight testing may not cause any of the following:
(1) Roll to exceed 80°.
(2) Pitch to exceed +45°, -35°.
(3) Accelerations outside the -0.2g to 2.5g envelope.
(4) Airspeed exceeding VNE or for an airplane having an established VMO/MMO, a speed not greater than a speed midway between VMO/MMO and the lesser of VD/MD or the speed demonstrated under § 23.253.
(B) Reliability and Prerequisite Criteria
(1) An acceptable fault analysis showing that the failure effect of a combined monitor failure and an autopilot malfunction is less than hazardous. In addition, the failure effect of failure of a lockout device to inhibit autopilot engagement, as identified in Item (3) below, is less than major;
(2) Pre-engagement check of the monitor is mandatory with either a manual or automatic activation means; and
(3) Autopilot engagement is inhibited until pre-engagement check is successfully completed.