(1) The accuracy is not excessively affected by the airplanes vibration or magnetic fields.
(2) Deviations of more than 10 degrees in level flight are not permissible, unless a magnetic stabilized direction indicator, which does not have a deviation in level flight greater than 10 degrees on any heading, or a gyroscopic direction indicator, is installed. If a gyroscopic direction indicator is installed, it is subject to compliance with § 23.1301 in that it must perform its intended function. It must, therefore, meet the accuracy requirements of TSO-C5, which represent the minimum allowable performance for gyroscopic direction indicators.
(3) A placard should show the calibration of the instruments in level flight with the engine(s) operating and whether the calibration was made with the radio receivers on or off.
(4) If deviations of more than 10 degrees caused by operation of electrical equipment are approved, the placard should state which electrical loads or combination of loads would cause deviations of more than 10 degrees.
Amendment 23-20 and Subsequent
A proposed revision to NPRM 75-23 explains this amendment as follows: “This proposal would allow deviation (exceeding 10 degrees) in a magnetic nonstabilized direction indicator caused by operation of electrically powered systems if the airplane is equipped with another direction indicator that meets the standard specified in paragraph (b) and the airplane is placarded in accordance with proposed Sec. 23.1547(e). Under these conditions, safety would not be adversely affected.”
The proposed rule, revised by Final Rule, Docket 14625, is explained as follows:
“One commentator objected to the proposal to amend Section 23.1327 on the ground that it would allow an indefinite amount of interference, which would confuse the pilot. The FAA believes that the placard that would be required by proposed Section 23.1327(c) would serve to alert the pilot to the fact that certain electrical loads, when switched on, cause excessive deviations of the magnetic nonstabilized direction indicator. The commentator further stated that if an additional magnetic direction indicator (having a deviation less than 10 degrees) were installed, there would no longer be a need for the magnetic nonstabilized direction indicator. The FAA agrees that an additional magnetic nonstabilized direction indicator is not a practical alternative, and proposed Section 23.1327 is revised to delete that alternative. However, the FAA believes that the proposed exception is appropriate for those instances in which a magnetic stabilized direction indicator or gyroscopic direction indicator is installed along with a magnetic nonstabilized direction indicator. The commentator also contended that the gyroscopic direction indicator 242
alternative is not a practical solution because it must be reset frequently, thus increasing the pilots workload. The FAA does not believe that the need to periodically reset the gyroscopic direction indicator adds significantly to the pilot's workload. Finally, this commentator stated that proposed Section 23.1327(c) would allow interference that is contrary to current Secs. 23.1327(a) and 23.1301(a)(4).
With respect to current Section 23.1327(a), the FAA believes the comment is valid, and that paragraph is revised for clarification. In view of this change, the requirements in current Section 23.1327(a) and proposed Section 23.1327(b) are combined into Section 23.1327(a), and proposed Section 23.1327(c) is redesignated Section 23.1327(b). With respect to current Section 23.1301(a)(4), the FAA does not believe the comment is valid, since the system consisting of a magnetic nonstabilized direction indicator and either a magnetic stabilized type or a gyroscopic type would meet that requirement.”
23.1329 Automatic pilot system
The corresponding rule in CAR 3 is CAR 3.667.
The corresponding rule in the Airship Design Criteria, FAA-P-8110-2, Change 2, is section 6.12.
Original Issue and Subsequent A single malfunction may not result in a hardover signal in more than one axis.
When the result of any single malfunction is shown not to be hazardous (no hardover signals) (slowover signals are acceptable if they are determined to be easily controllable without requiring exceptional skill or strength), then multiple axes being affected is acceptable providing the following:
a. The malfunction evaluations are acceptable even with the maximum drive signal due to the limited rate of change authority of the powered controlling element and flight control surfaces,
b. The monitor/limiting device is independent of the automatic pilot element,
c. The signal is less than the hardover signal due to the monitor/limiting device; and
d. An acceptable fault analysis shows the functional hazard of a combined monitor failure and automatic pilot malfunction is not catastrophic, including:
(1) The functional hazard of a failure of a lockout device/system to inhibit autopilot engagement until the pre-engagement check is successfully completed is hazardous or less,
(2) Pre-engagement check of the monitor system is mandatory with either a manual or automatic activation means, and,
(3) Automatic pilot authority is not greater than necessary to satisfactorily control the airplane.
Alterations of increased engine horsepower (and either engine horsepower or major changes in exterior cowlings and surfaces), in part 23 airplanes, should consider the compatibility of the autopilot system with the increased horsepower. This is because the malfunction and performance tests of the autopilot are conducted with a defined amount of engine power. An increase in engine horsepower beyond 10 percent may adversely affect the autopilot system malfunctions, performance, controllability, and longitudinal stability characteristics. Therefore, flight testing may be necessary to verify the original approval of the autopilot system is still valid.
a. The results of malfunction testing determine which flight condition is most critical. The effects of autopilot runaways are more pronounced at aft CG. Also, the phase of flight with the largest contribution to adverse conditions varies with airplane model.
b. Airplane longitudinal stability is a factor in autopilot system malfunctions. There is an inverse relationship between engine horsepower and longitudinal stability.
Although the turbine engine installations replacing reciprocating engines may be flat rated, the turbine is capable of producing increased horsepower at higher temperatures and altitudes, which could reduce longitudinal stability. Therefore, autopilot performance, especially the pitch axis hardover malfunction, should be evaluated for acceptability. This policy is also applicable to power increases on airplanes with reciprocating engines, either engine replacement or engine modifications that add a turbocharger.
c. Performance and controllability evaluations should be considered, including the configuration of most forward CG and minimum autopilot authority. This configuration is used to show the airplane can be safely controlled by the autopilot when the control surface hinge moment is the highest and the autopilot controllability is at its lowest during corresponding longitudinal trim and airspeed changes.
To show compliance with part 23, § 23.1329, applicable to autopilot system installations in small airplanes, the following is acceptable.
1. RELATED REGULATIONS AND DOCUMENTS
a. Regulations These acceptable means of compliance refer to certain provisions of part 23.
They may be used in showing compliance with the corresponding provisions of the former CAR for airplanes to which the CAR regulations are applicable. For convenience, the part 3, section reference is shown in parenthesis following the part 23 section reference:
§ 23.143 (3.106) Controllability and Maneuverability, General.
§ 23.253 High speed characteristics.
§ 23.395 (3.231) Control system loads.
§ 23.397 (3.212) Limit control forces and torques.
§ 23.689 (3.345) Cable systems.
§ 23.777 (3.384) Cockpit controls.
§ 23.779 (3.384) Motion and effect of cockpit controls.
§ 23.1301 (3.651 and 3.652) Function and installation.
§ 23.1309 Equipment, systems, and installations.
§ 23.1321 (3.661 and 3.662) Arrangement and visibility.
§ 23.1322 Warning, caution, and advisory lights.
§ 23.1329 (3.667) Automatic pilot system.
§ 23.1351 (3.681) Electrical Systems and Equipment, General.
§ 23.1381 (3.696 and 3.697) Instrument lights.
§ 23.1431 (3.721) Electronic equipment.
§ 23.1555 (3.762, 3.763, and 3.765) Control markings.
§ 23.1581 (3.77) Airplane Flight Manual and Approved Manual Material, General.
§ 23.1583 (3.778) Operating limitations.
§ 23.1585 (3.779) Operating procedures.
b. Advisory Circulars AC 21-16D “RTCA Document DO-160D”, July 21, 1998.
AC 23.1309-1C “Equipment, Systems, and Installations in Part 23 Airplanes”, March 12, 1999.
c. Technical Standard Order (TSO) TSO-C9c “Automatic Pilots”, September 15, 1960.
d. Industry Documents RTCA/DO-160D “Environmental Conditions and Test Procedures for Airborne Equipment”, July 29, 1997.
RTCA/DO-178B “Software Considerations in Airborne Systems and Equipment Certification”, December 1, 1993.
2. BACKGROUND AC 23.1329-1, “Automatic Pilot Systems Approval,” which set forth an acceptable means for showing compliance with the autopilot installation requirements, was issued December 23, 1965. Although AC 23.1329-1 was inadvertently cancelled in 1977, criteria essentially equivalent to that contained in it continued to be used to show compliance with the applicable autopilot installation requirements.
AC 23.1329-1 was canceled by incorporation into this AC. The airworthiness regulations prescribe the requirements for autopilot installation approval. The following criteria have been applied and found reasonable and acceptable in previous type certification programs for complying with specific sections related to these approvals:
a. Compliance with the regulations necessitated the conversion of the force exerted by one pilot to overpower an engaged autopilot into measurable terms when either an autopilot quick disconnect or interrupt switch was not provided.
The values in the table under § 23.143 are maximums. There may be circumstances where a maximum force less than 75 pounds is required for safety. For example, if a pilot is trying to overpower a nose-up malfunction during climb and reduce power at the same time, a maximum safe force may be less than 75 pounds. Thus, these forces, as measured at the pilots' controls, were equated to the following temporary and prolonged forces:
(1) The maximum temporary force to overpower the autopilot has not been allowed to exceed 30 pounds in roll (force applied at the rim of the wheel), 50 pounds in pitch, and 150 pounds in yaw. These forces are applicable only to initially overpowering the autopilot system.
(2) The maximum prolonged force to overpower the autopilot should not exceed five pounds in roll, 10 pounds in pitch, and 20 pounds in yaw.
b. A reasonable period of time has been established for pilot recognition between the time a malfunction is induced into the autopilot system and the beginning of pilot corrective action following hands-off or unrestrained operation. The following time delays have been acceptable:
(1) A three-second delay following pilot recognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by a reliable failure warning system in the climb, cruise, and descent flight regimes.
(2) A one-second delay following pilot recognition of an autopilot system malfunction, through a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable warning system, in maneuvering and approach flight regimes.
3. ACCEPTABLE MEANS OF COMPLIANCE The following procedure, according to the forces and times above, is acceptable as a means of showing that an autopilot system installation is in compliance with the airworthiness rules:
a. Cockpit Controls Evaluation of cockpit controls should include:
(1) The location of autopilot system controls should be readily accessible to the pilot, or both pilots, if a minimum of two pilots is required.
(2) Annunciators should conform to the proper color as specified in § 23.1322.
(3) A determination the controls are usable under bright sunlight and night lighting conditions (§ 23.1381).
(4) Either a quick disconnect or interrupt switch for the autopilot system are located on the side of the control wheel opposite the throttle(s) and are red in color. A disconnect switch stops all movement of the autopilot system.
An interrupt switch momentarily interrupts all movement of the autopilot system.
(5) A determination that any automatic disconnects of the autopilot is adequately annunciated by an aural warning. If warning lights are used to supplement the aural warning, they should meet the requirements of § 23.1322. Use of a visual warning as the sole means of annunciating automatic disconnects is not considered acceptable.
(6) Motion and effect of autopilot cockpit controls should conform to the requirements of §§ 23.1329(c) and 23.779.
b. Malfunction Evaluations
(1) Malfunction evaluation flights should be conducted with the airplane loaded at the most critical weight or the most critical CG/weight combination.
Maximum untrimmed fuel imbalance should be considered during the evaluation. If autothrottles are installed, they should be operating, and autopilot servo torque should be set to the upper tolerance limit. The simulated malfunctions should be induced at various airspeeds and altitudes throughout the airplanes airspeed and altitude envelopes. These envelopes should include the maximum operating altitude for turbocharged or high altitude airplanes, or be within 10 percent of the service ceiling for normally aspirated airplanes, and when the airplane is stabilized in the normal operational attitudes. Vertical gyro mechanical failures should not be considered. The simulated failures and resulting corrective actions are not acceptable if they result in any of the following:
(i) Loads that exceed the substantiated structural design limit loads.
(ii) Acceleration that is outside the 0 to 2g envelope. The positive "g" limitation may be increased up to the positive design limit maneuvering load factor if it has been previously determined analytically that neither the simulated failure nor resulting corrective action would result in loads beyond the design limit loads of the airplane.
(iii) Speeds in excess of VNE or for airplanes with an established VMO/MMO, a speed midway between VMO/MMO and the lesser of VD/MD, or the speed demonstrated under § 23.253.
(iv) Deviations from the flight path including bank angle in excess of 60 degrees or pitch attitude in excess of + 30 degrees deviation from the attitude at which the malfunction was introduced.
(v) A hazardous dynamic condition.
(2) Normal Flight Malfunctions The airplanes performance should be evaluated when the effect caused by the most critical single failure condition that can be expected to occur to the system and can be detected by the pilot is induced into the autopilot system. Hidden or latent failures, in combination with detectable failures, should be considered when determining the most critical failure condition.
Normal flight includes climb, cruise, and descent flight regimes with the airplane properly trimmed in all axes. Airplane configurations (combinations of gear and flaps), speeds, and attitudes should be evaluated for unsafe conditions. The more critical of the following simulated malfunctions are the following:
(i) A simulated malfunction about any axis equivalent to the cumulative effect of any failure or combination of hidden failures, including manual-electric or automatic trim, if installed.
(ii) The combined signals about all affected axes, if multiple axis failures can result from the malfunction of any single component. Amendment 3-2 to part 3 of the CAR, effective August 12, 1957, requires that an autopilot system should be designed so a single malfunction will not produce a hardover signal in more than one control axis (reference §§
3.667(e) and 23.1329(e)).
NOTE 18: A three-second delay following pilot recognition of an autopilot system malfunction, as indicated in item 2b(1), should be applied for normal flight malfunction evaluations.
(3) Maneuvering and Approach Malfunction Maneuvering flight tests should include turns with the malfunction induced at the maximum bank angle for normal operation, up to the autopilot authority limits. Airplane configurations (combinations of gear and flaps), airspeeds, and altitudes should be evaluated to determine if unsafe conditions exist. Simulated malfunctions described for normal flight malfunctions as indicated in items 3b(2)(i) and (ii) (titled, “Normal 249
Flight Malfunctions”) are applicable for introduction during maneuvering flight malfunction evaluation. The resultant accelerations, loads, and speeds should be within limits described for normal flight malfunctions.
Malfunctions introduced during coupled approaches should not place the airplane in a hazardous attitude or an attitude that would prevent the pilot from conducting a missed approach or safe landing. Altitude losses resulting from the simulated malfunctions are to be measured accurately and presented in the limitations section of the AFM or approved manual material. In maneuvering and approach flight regimes, the pilot should recognize an autopilot system malfunction within one-second. This recognition should occur as the result of a deviation of the airplane from the intended flight path, abnormal control movements, or by means of a reliable warning system that is applied.
NOTE 19: Accurate measurement of altitude loss, because of an autopilot malfunction during an instrument landing approach, is essential. This altitude loss during a critical phase of flight provides the basis for establishing the minimum approach altitude during autopilot-coupled approaches. The loss should be determined by measuring from the altitude at which the malfunction is induced to the lowest altitude observed during the recovery maneuver, unless instrumentation is available to measure the vertical deviation from the intended glide path to the lowest point in the recovery maneuver. In this section, Appendix 1 contains a method of measurement for approach altitude loss. Altitude losses because of malfunctions in other flight regimes, though less critical, may be determined by measuring the deviation from the flight path in a manner similar to that used for the glide slope.
(4) Alternate Means of Compliance for Autopilots Incorporating Electronic Monitors/Limiting Devices Listed below are alternate means of compliance. These alternate means cite considerations for evaluating both monitors and limiting devices when functioning of such devices is necessary to prevent the airplane from exceeding the malfunction limits identified in paragraph 3b(1) of this AC.
(i) Alternate Means No. 1 (A) Monitor/Limiter Inhibited With the monitor/limiter inhibited, autopilot malfunction flight testing may not cause any of the following:
(1) Roll to exceed 80 degrees.
(2) Pitch to exceed +45 degrees, -35 degrees.
(3) Accelerations outside the 0g to 2.5g envelope.
(4) Airspeed exceeding VNE or for an airplane having an established VMO/MMO, a speed not greater than a speed midway between VMO/MMO and the lesser of VD/MD or the speed demonstrated under § 23.253.
(B) Reliability and Prerequisite Criteria
(1) A fault analysis should show the failure effect of a monitor failure, combined with an autopilot malfunction, is less than major; and
(2) Pre-engagement check of the monitor is mandatory. No credit is allowed for a pilot-activated pre-engagement check unless there is a lockout device or system.
(ii) Alternate Means No. 2 (A) Monitor/Limiter Inhibited With the monitor/limiter inhibited, autopilot malfunction flight testing may not cause any of the following:
(1) Roll to exceed 80 degrees.
(2) Pitch to exceed +45 degrees, -35 degrees.
(3) Accelerations outside the -0.2g to 2.5g envelope.
(4) Airspeed exceeding VNE or for an airplane having an established VMO/MMO, a speed not greater than a speed midway between VMO/MMO and the lesser of VD/MD or the speed demonstrated under § 23.253.
(B) Reliability and Prerequisite Criteria
(1) An acceptable fault analysis showing the failure effect of a combined monitor failure and an autopilot malfunction is less than hazardous. In addition, the failure effect of failure of a lockout device to inhibit autopilot engagement, as identified in Item (3) below, is less than major;
(2) Pre-engagement check of the monitor is mandatory with either a manual or automatic activation means; and
(3) Autopilot engagement is inhibited until pre-engagement check is successfully completed.
(iii) Alternate Means No. 3 (A) Flight tests with monitors inhibited are not required.
(B) Reliability and prerequisite Criteria
(1) An acceptable fault analysis showing the failure effect of a combined monitor failure and autopilot is less than catastrophic. In addition, failure of a lockout device/system to inhibit autopilot engagement, as identified in item (3) below, is less than hazardous;
(2) Pre-engagement check of the monitor is mandatory with either a manual or automatic activation means;
(3) Autopilot engagement inhibited until the pre-engagement check is successfully completed; and
(4) Autopilot authority not greater than necessary to satisfactorily control the airplane.
c. Recovery of Flight Control Evaluate the ability to recover flight control from the engaged autopilot system either by manual use of a quick disconnect or by physically overpowering the system.
d. Performance Flights Performance evaluation tests should be conducted with the airplane loaded to its most adverse CG and weight condition. Autopilot performance with the servo torque values at the lowest production torque tolerance limit should be used to demonstrate safe controllability and stability. Flight tests are necessary to ensure the autopilot system performs its intended function, including all modes of operation presented for approval (reference § 23.1301).
e. Single-Engine Approach For multiengine airplanes, an engine failure during a normal Instrument Landing System (ILS) approach should not cause a lateral deviation of the airplane from the flight path at a rate greater than three degrees per second or produce hazardous attitudes. This rate should be measured and averaged over a five-second period. If approval is sought for ILS approaches initiated with one engine inoperative, the autopilot should be capable of conducting the approach.
f. Airplane Flight Manual (AFM) Information The following information should be placed in the AFM (or, if the airplane does not have an AFM, it should be placed in the Pilots Operating Handbook (POH) or presented to the pilot in the form of placards) as follows:
(1) In the operating limitations section, the airspeed limitations, maximum altitude for operation if different from the maximum certificated altitude of the airplane, category of ILS approaches for which approval is granted, minimum approach height, and any other applicable limitations.
(2) In the operating procedures section, the normal operating information, including navigation and glide slope intercept recommendations. For those autopilot systems, which incorporate either monitors or limiter devices, the pre-engagement procedures and the means of indicating that, the preengagement has been successfully completed.
(3) In the emergency operation procedures section
(i) A statement of the altitude loss in the cruise, climb, and descent configurations; and maneuvering flight conditions, because of possible malfunctioning of the autopilot system.
(ii) A statement of the altitude loss because of malfunctions while in the approach configuration. If engine inoperative approach is approved, the altitude loss should be included.
(iii) Any other procedure related to emergency procedures associated with either the autopilot or associated systems. (See Figure 1.)