(iii) Alternate Means No. 3 (A) Flight tests with monitors inhibited are not required.
(B) Reliability and prerequisite Criteria
(1) An acceptable fault analysis showing that the failure effect of a combined monitor failure and autopilot be less than catastrophic. In addition, failure of a lockout device/system to inhibit autopilot engagement, as identified in Item (3) below, is less than hazardous;
(2) Pre-engagement check of the monitor is mandatory with either a manual or automatic activation means;
(3) Autopilot engagement inhibited until the pre-engagement check is successfully completed; and
(4) Autopilot authority not greater than necessary to satisfactorily control the airplane.
c. Recovery of Flight Control Evaluate the ability to recover flight control from the engaged autopilot system either by manual use of a quick disconnect or by physically overpowering the system.
d. Performance Flights Performance evaluation tests should be conducted with the airplane loaded to its most adverse c.g. and weight condition. Autopilot performance with the servo torque values at the lowest production torque tolerance limit should be used to demonstrate safe controllability and stability. Flight tests are necessary to ensure the autopilot system performs its intended function, including all modes of operation presented for approval (reference § 23.1301).
e. Single-Engine Approach For multiengine airplanes, an engine failure during a normal instrument landing system (ILS) approach should not cause a lateral deviation of the airplane from the flight path at a rate greater than 3° per second or produce hazardous attitudes. This rate should be measured and averaged over a 5-second period. If approval is sought for ILS approaches initiated with one engine inoperative, the autopilot should be capable of conducting the approach.
f. Airplane Flight Manual (AFM) Information The following information should be placed in the AFM (or, if the airplane does not have an AFM, it should be placed in the Pilot's Operating Handbook (POH) or presented to the pilot in the form of placards):
(1) In the Operating Limitations Section, the airspeed limitations, maximum altitude for operation if different from the maximum certificated altitude of the airplane, category of ILS approaches for which approval is granted, minimum approach height, and any other applicable limitations.
(2) In the Operating Procedures Section, the normal operating information, including navigation and glide slope intercept recommendations. For those autopilot systems which incorporate either monitors or limiter devices, the pre-engagement procedures and the means of indicating that the pre-engagement has been successfully completed.
(3) In the Emergency Operation Procedures Section
(i) A statement of the altitude loss in the cruise, climb, and descent configurations;
and maneuvering flight conditions, due to possible malfunctioning of the autopilot system.
(ii) A statement of the altitude loss due to malfunctions while in the approach configuration. If engine inoperative approach is approved, the altitude loss should be included.
(iii) Any other procedure related to emergency procedures associated with either the autopilot or associated systems. (See Figure 1.)
Altitude Loss
1. Malfunction inducement point.
2. Malfunction recognition by pilot.
3. Initiation of manual recovery action by pilot.
4. Altitude loss with no instrumentation.
5. Altitude loss with instrumentation.
3° ILS Nominal Glide Slope Airplane Wheels One Second Delay y 1:29 Slope 15.0 feet Runway Threshold ILS Glide Fath Origin FIGURE 1. ACCEPTABLE METHOD FOR DETERMINING
ALTITUDE LOSS IN APPROACH 183
184 FIGURE 1¾CONTINUATION Malfunction Evaluations. The airplane should be established on the ILS glide slope and localizer in the configuration(s) with the approach speed(s) specified by the applicant for approach. Simulated automatic flight control system malfunctions should be induced at critical points along the ILS taking into consideration all design variations and their limits in automatic flight control system sensitivity and authority. The malfunctions should be induced in each axis. While the pilots may know the purpose of the flight, they should not be informed when a malfunction is to be or has been applied except through a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable failure warning system. After a failure, recovery should be initiated 1 second after the pilot recognizes the failure.
a. A 3° glide slope should be used for these tests in order to determine the malfunction effects to be expected in service.
b. For use during a coupled ILS approach, the automatic control system should not fail in such a way that it causes the airplane wheels to descend below a limit line lying below the glide slope, sloping upward at 29:l from a point 15 feet above the runway threshold. With the airplane established on the glide slope in approach configuration, at approach speed, the most critical malfunction is induced at a test altitude referenced to the runway threshold. Measure the altitude loss between the test altitude and the lowest point of the manual recovery, unless instrumentation is available to measure the vertical deviation from the intended glide path to the lowest point in the recovery maneuver. The altitude loss and the known distance to the threshold from the lowest recovery altitude are compared to the limit line. The lowest test altitude from which malfunction and manual recovery can be completed, without the airplane wheels descending below the limit line, is considered the minimum height for use of the automatic flight control system.
c. Recovery from all malfunctions should be demonstrated either by overpowering or by manual use of an emergency quick disconnect device after the appropriate delay. The pilot should be able to return the airplane to its normal flight altitude under full manual control without exceeding the defined limits.
23.1331 Instruments using a power source Original Issue and Subsequent Paragraph (a) in § 23.1331 applies only to gyroscopic instruments, but paragraph (b) in this section applies to any instrument that depends on external power or external energy for proper operation.
The requirement for two independent power sources in paragraph (b)(1) in § 23.1331 applies to either vacuum or electrically driven gyroscopic instruments.
Electrical Systems When complying with paragraph (b) in this section, a single battery required for starting is acceptable if the electrical system is capable of continuous normal operation without external excitation or stability, and there is no probable failure of the battery that will adversely affect the electrical system once it is operating. However, the airplane battery cannot be accepted toward showing compliance to the power source requirements of §§ 23.1331 and 23.1351 unless the state of charge of the battery is displayed to the pilot.
A single electrical bus is unacceptable for a multiengine airplane.
The multiengine requirement is for two independent power sources. Therefore, an installation with a single primary power source for all flight instruments and a manually operated backup is not acceptable.
a. This system could conceivably fail in such a way that all the flight instruments could be simultaneously damaged or disabled (i.e., loss of voltage regulation). This would not be remedied by switching to the backup power source.
b. Also, an electrical system with a primary power source that employed a backup source with common circuitry or components is not truly independent.
Standby Vacuum Systems The intended function of a standby vacuum system is to provide a second vacuum source for the gyroscopic instruments after a failure of the primary vacuum system. The standby system should either supply sufficient vacuum to maintain the accuracy and reliability of the gyroscopic instruments throughout the phases of flight, or there should be limitations on operation in the Airplane Flight Manual (AFM). When operating on the standby system, the pilot should predicate operations on other certified systems (partial panel) and use the gyroscopic instruments as an aid, provided the pilot determines these instruments give
186 acceptable information. Also, the pilot should not manipulate the throttle, other than for normal flight, in an attempt to control vacuum pressure within the limitations.
If a second vacuum system is not required, the standby installation would be for nonrequired equipment per this rule. In addition, § 21.21(b)(2) requires there be no feature that results in an unsafe condition. To comply with these requirements, it should be shown that neither operation nor failure of the standby vacuum system interfere with the normal operation of the primary system or result in any unsafe condition. The pilot should also be kept apprised of when the standby system is in operation either by manual source selection or by red visual annunciation (§ 23.1322) if an automatic switching system is installed. To ensure that no unsafe condition will result, the standby system should be flight evaluated in each unique airplane installation. In addition, operating information, emergency procedures, and limitations should be available in an AFM Supplement, a Supplemental AFM, or placards, as appropriate. This information should meet the requirements of §§ 23.1583 and
23.1585 of this part, and it should emphasize that the standby vacuum system is for emergency use only and should not be utilized for dispatch purposes.
Amendment 23-43 and Subsequent Independent Power Sources This amendment adds the requirement for independent power sources for required instruments for single-engine as well as multiengine airplanes. This was considered appropriate due to the number of single-engine airplane accidents that were attributed to the loss of power to required flight instruments. Also, the reference to “gyroscopic” was removed to include both gyroscopic and non-gyroscopic instruments since non-gyroscopic flight instruments are in use.
a. Instruments that provide required flight information and use an external power source are now required to have two independent power sources. This requirement has the same intent for single-engine airplanes as for multiengine airplanes: to functionally isolate flight instruments such that any failure of one power source or instrument will not cause the complete loss of a required flight instrument function. Thus, in the case of failure of a heading instrument, that failure may not result in the loss of the proper supply of energy to the attitude indicator powered by the same source, and loss of a single power supply may not cause loss of any required instrument function.
b. Ship’s batteries used in normal operations are acceptable as backup power sources only if their state of the charge can be reliably verified to the pilot.
c. This regulation is not intended to apply to circuit protection devices, which are to be considered in §§ 23.1351 and 23.1357.
d. These changes are meant to apply to those instruments that rely on a power source and provide required flight information. Such instruments are those that provide information for direct control of flight that are required by the kinds of operation for which the airplane has been approved. Consequently, this section applies to all flight instruments required by 14 CFR part 23, § 23.1303 and part 91, § 91.205. So, instruments in airplanes limited to VFR operations that are not required for VFR would not have to comply with the requirements of § 23.1331. Exemptions would not be necessary or appropriate.
e. Each independent power source must provide sufficient power for normal operations throughout the approved flight envelope of the airplane and for any operations for which the airplane is approved. For example, an IFR approved airplane must have independent power sources for the display of attitude that are not limited to altitudes below the approved service ceiling of the airplane.
f. Section 23.1331(c) does not require the installation of dual alternators or vacuum systems on single engine airplanes. Other options include a dedicated battery with a 30 minute capacity for electrical instrument loads essential to continued safe flight and landing, use of differently powered types of instruments for primary and standby, or verifying the aircraft battery used for starting by a system safety analysis per § 23.1309. The last option would:
(1) Require reliability and probability data for the aircraft battery that is acceptable to the FAA (applicants have not provided such data to date); and
(2) Require that the state of charge be available to the pilot during all stages of flight and include a caution alert per § 23.1322 when the state of charge is less than 30 minutes.
23.1335 Flight director systems No policy available as of June 30, 2001.
23.1337 Powerplant instruments installation Original Issue and Subsequent No specific criteria have been established for the minimum orifice size for fuel and oil lines.
We believe that .020 inches for fuel lines and .060 inches for oil lines can be accepted (per Air Force Systems Command Manual 80-1, Part C, Chapter 5, paragraphs 3.1.1.3.7 and
3.1.2.3.3).
See AC 23-16, Powerplant Guide for Certification of Part 23 Airplanes, § 23.959, for unusable fuel test procedures for guidance on § 23.1337(b)(1).
Changes to total fuel quantity by incorporation of a fuel tank filler connection (§ 23.973) outboard of the existing connection will require changing the fuel quantity indicator to indicate the new quantity of fuel. The new indicator should meet the accuracy as specified in TSO- C55, Fuel and Oil Quality Instruments (For Reciprocating Engine Aircraft), or MIL-G- 9798.
The rule requires that fuel quantity be calibrated as zero when only unusable fuel is left in the tank. Some fuel tank system designs can result in a lowest reading obtainable in level flight being greater than the unusable fuel supply. In this case, an equivalent level of safety is acceptable by placing a red radial at the “lowest reading obtainable in level flight,” and mounting a placard stating the amount of usable fuel remaining at the red radial.
Fuel quantity indicators are also governed by § 23.1301 as are all 14 CFR part 23, Subpart F appliances. This regulation requires the installed indicators function as designed and not create a hazard in their operation. This precludes indicators that read higher than the actual fuel level since this would constitute a hazard. 14 CFR part 23 does not require an applicant to install a TSO’d fuel quantity indicator, but when installed in a reciprocating engine airplane and produced under TSO-C55 authorization, the allowable error of the indicator is no more than three percent (3 percent) of full scale. It is believed that ground and cruise attitude(s) are the minimum attitudes required for operation within the 3 percent tolerance. Evaluation of the gauge function throughout the normal and expected operation of the airplane is needed to assess gauge indications outside the ground and cruise attitude conditions. The purpose of this evaluation is to establish that the ground and cruise attitude(s) gauge tolerance is functional and adequate for the airplane.
Amendment 23-18 and Subsequent See AC 23-8A, Flight Test Guide for Certification of Part 23 Airplanes, for guidance on fuel quantity indicators and auxiliary tanks.
ELECTRICAL SYSTEMS AND EQUIPMENT
23.1351 General Original Issue This rule does not allow a failure or malfunction of any electrical power source to impair the ability of any other source to supply essential circuits.
Amendment 23-7 and Subsequent This amendment allows one exception to the original rule. This exception would allow loss of an alternator that is dependent on a battery for initial excitation or stabilization when that battery has failed. This exception was adopted under the premise that the advantages of having a battery connected for initial excitation or stabilization for alternators needing it outweighed the consequences of that battery failing. This exception is only applicable to alternator installations that need a battery. Loss of an alternator due to battery failure was considered of no greater consequence than the intrinsic failure of the alternator itself. In the case of single-engine airplanes, loss of the battery and alternator would result in the loss of the electrical system, which would be no worse than other single failures (i.e., shorts to ground, conductor failure, etc.) that would also result in loss of the electrical system.
Wire meeting MIL-W-5086 has been removed from the listing of approved wire in AC
43.13-1B due to its flammability characteristics, corrosive vapors, and toxic gases of PVC insulation. See AC 43.13-1B, Acceptable Methods, Techniques, and PracticesAircraft Inspection and Repair, Section 3, for allowable wire in airplane manufacture and alteration.
Wire that is not listed in AC 43.13-1B should be shown by tests and analyses to meet the airworthiness requirements of § 23.863, 23.1351, 23.1359, and 23.1365 as applicable.
JAA ACJ 23.1351(a)(2) is acceptable for FAA certification.
JAA ACJ 23.1351(b)(5)(iv) is acceptable for FAA certification to 14 CFR part 23, § 23.1351(b)(4)(iv).
23.1353 Storage battery design and installation Original Issue and Subsequent See AC 43.13-1B, Acceptable Methods, Techniques, and PracticesAircraft Inspection and Repair, Section 8, for battery installation guidance. Replacement batteries would require Parts Manufacturer Approval (PMA), unless exempted under the provisions of part 21, § 21.303(b), whether the replacements are lead-acid or nickel-cadmium. The airworthiness standards of 14 CFR part 23, §§ 23.1301, 23.1309, 23.1351, and 23.1353 should be considered for replacement battery installations.
Amendment 23-49 and Subsequent Thirty Minutes of Electrical Power Requirement by § 23.1353(h) This guidance regards the 30 minutes of electrical power requirement under Title 14 Code of Federal Regulations (14 CFR) part 23 incorporated by Amendment 23-49 into § 23.1353(h). This guidance only addresses the requirement of § 23.1353(h) and not the electrical power requirements that an airplane can operate safely in VFR conditions under § 23.1351(g) or the electrical power sources requirements under § 135.163.
The requirements of § 23.1353(h) are as follows:
“In the event of a complete loss of the primary electrical power generating system, the battery must be capable of providing at least 30 minutes of electrical power to those loads that are essential to continued safe flight and landing. The 30 minute time period includes the time needed for the pilots to recognize the loss of generated power and take appropriate load shedding action.”
Per previous guidance on this issue, the airplane’s primary electrical power includes the airplane’s electrical generation system and the airplane’s starter battery when only one battery is installed. The battery for the 30-minute criteria, therefore, should be an independent power source from the airplane’s starter battery. If adequate monitoring and procedures are incorporated so the pilot knows that the airplane’s starter battery meets the 30 minute criteria after an engine start and during all other operations, an equivalent level of safety finding may be an acceptable method for using the airplane’s starter battery.
Please refer to the guidance in AC 23.1309-1C, Equipment, Systems, and Installations in Part 23 Airplanes, for determining the loads that are essential to continued safe flight and landing. Continued safe flight and landing is defined as follows:
192 “This phrase means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures, without requiring exceptional pilot skill or strength. Upon landing, some airplane damage may occur as a result of a failure condition.”
The 30-minute power bus should include all systems that could cause a catastrophic failure condition under the § 23.1309, Failure Hazard Assessment. In some cases, it may not be practical to include all systems on the 30-minute power bus that could cause a catastrophic failure condition. For example, systems with large heating loads for ice protection may not be included on the 30 minute electrical power bus; however, the possible hazards that could cause catastrophic failure conditions should be minimized.
To minimize the hazard is to reduce, lessen, or diminish to the least practical amount with current technology and materials. The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction.
Additional efforts would not result in any significant improvements to safety and would inappropriately add to the cost of the product.
Assuming operations under IFR conditions for part 91 or 135 operations, the following systems should be included on the 30-minute power bus:
• If needed to comply with § 23.1325, one airspeed indicator and altimeter with a heated pitot tube and heated static pressure source;
• The magnetic compass, and any display necessary for continued safe flight and landing, sufficiently illuminated for night operation;
• One navigation system installation appropriate to the ground facilities to be used;
• One communication installation system;
• One gyroscopic pitch and bank indicator;
• One clock;
• Any display for the powerplant parameter necessary for continued safe flight and landing; and
• Any electrical loads unique for the airplane characteristics and needed for continued safe flight and landing for the intended operations.
Tests and analyses should be considered for determining the rated operating capacity of the battery, the normal service life, and the continued airworthiness requirement of § 23.1529.
For these tests and analyses, the following should be established: