Advisory U.S. Department of Transportation Circular Federal Aviation Administration Subject: APPROVAL OF FLIGHT MANAGEMENT Date: 11/20/89 AC No: 25-15 SYSTEMS IN TRANSPORT CATEGORY initiated by: ANM-110 Change:
AIRPLANES
1. PURPOSE. This advisory circular (AC) provides guidance material for the airworthiness approval of flight management systems (FMS) in transport category airplanes. Like all AC material, this AC is not mandatory and does not constitute a regulation. It is issued for guidance purposes and to outline a method of compliance with the rules. In lieu of following this method without deviation, the applicant may elect to follow an alternate method, provided the alternate method is also found by the Federal Aviation Administration (FAA) to be an acceptable means of complying with the requirements of Part 25. Because the method of compliance presented in this AC is not mandatory, the terms "shall" and "must" used herein apply only to an applicant who chooses to follow this particular method without deviation.
2. RELATED DOCUMENTS.
a. Related Federal Aviation Regulations (FAR). Portions of Part 25 and a portion of Part 121, as presently written, can be applied for the design, substantiation, and certification of FMS for transport category airplanes.
Sections which prescribe requirements for these types of systems include:
§ 25.101 Performance: General.
§ 25.103 Stalling speed.
§ 25.105 Takeoff.
§ 25.107 Takeoff speeds.
25.109 Accelerate-stop distance.
§ 25.111 Takeoff path.
§ 25.113 Takeoff distance and takeoff run.
§ 25.115 Takeoff flight path.
§ 25.117 Climb: general.
§ 25.119 Landing climb: All-engines-operating.
§ 25.121 Climb: One-engine-inoperative.
§ 25.123 En route flight paths.
§ 25.125 Landing.
§ 25.149 Minimum control speed.
§ 25.904 Automatic takeoff thrust control system (ATTS).
§ 25.1301 Function and installation.
§ 25.1303 Flight and navigation instruments.
§ 25.1305 Powerplant instruments.
25.1307 Miscellaneous equipment.
25.1309 Equipment, systems, and installations.
25.1321 Arrangement and visibility.
25.1322 warning, caution, and advisory lights.
25.1323 Airspeed indicating system.
25.1329 Automatic pilot system.
25.1331 Instruments using a power supply.
§ 25.1333 instrument systems.
§ 25.1335 Flight director systems.
25.1351 Electrical Systems and Equipment: General.
con 25.1353 Electrical equipment and installations.
25.1355 Distribution system.
25.1357 Circuit protective devices.
25.1381 Instrument lights.
25.1431 Electronic equipment.
25.1523 Minimum flightcrew.
$ 25.1585 25.1581 Airplane Flight Manual: General. Operating procedures.
Part 121 Appendix G - Doppler Radar and Inertial Navigation Systems (INS).
b. Advisory Circulars.
AC 20-129 Airworthiness Approval of Vertical Navigation Systems AC 20-XX Airworthiness Approval of RNAV Systems Using a Single Colocated VOR/DME Sensor Input AC 20-130 Airworthiness Approval of Multi-Sensor Navigation Systems AC 20-101C Airworthiness Approval of Omega/VLF Navigation Systems AC 20-115A Radio Technical Commission for Aeronautics Document RTCA/DO-178A AC 20-121A Airworthiness Approval of Loran-C Navigation Systems AC 21-16B Radio Technical Commission for Aeronautics Document RTCA/DO-160B AC 25-4 Inertial Navigation Systems (INS) AC 25.1309-1A System Design and Analysis 2 Par 2
AC 25-15 11/20/89 AC 25.1329-1A Automatic Pilot Systems Approval AC 25-11 Transport Category Airplane Electronic Display Systems AC 25-13 Reduced and Derated Takeoff Thrust (Power) Requirements AC 61-XX Procedures and Criteria for Determining the Type Rating Requirements for an Aircraft AC 120-28C Criteria for Approval of Category III Landing Weather Minima AC 120-29 Criteria for Approving Category I and Category II Landing Minima for FAR 121 Operators AC 90-82 Random Area Navigation Routes AC 91-53A Noise Abatement Departure Profile AC 120-31A Operational and Airworthiness Approval of Airborne Omega Radio Navigation Systems as a Means of Updating Self-Contained Navigation Systems AC 120-33 Operational Approval of Airborne Long-Range Navigation Systems for Flight Within the North Atlantic Minimum Performance Specifications Airspace AC 120-37 Operational and Airworthiness Approval of Airborne Omega Radio Navigational Systems as a Sole Means of Long Range Navigation Outside the United States C. Technical Standard Orders.
TSO-C60b Airborne Area Navigation Equipment Using Loran C Inputs TSO-C94a Omega Receiving Equipment Operating Within the Radio Frequency Range of 10.2 to 13.6 Kilohertz TSO-C115 Airborne Area Navigation Equipment Using Multi-Sensor Inputs TSO-C120 Airborne Area Navigation Equipment Using Omega/VLF Inputs Par 2 3
d. Industry Documents.
(1) Radio Technical Commission for Aeronautics (RTCA) document DO-160B, Environmental Conditions and Test Procedures for Airborne Equipment;
RTCA document DO-178A, Software Considerations in Airborne Systems and Equipment Certifications; RTCA document DO-180A, Minimum Operational Performance Standards for Airborne Area Navigation Equipment Using a Single Co-Located VOR/DME Sensor Input; PTCA document DO-187, Minimum Operational Performance Standards for Airborne Area Navigation Equipment Using Multi-Sensor Inputs; RTCA documents DO-190, Minimum Operational Performance Standards for Airborne Area Navigation Equipment using Omega/VLF Inputs; RICA document DO-194, Minimum Oping operationialerformance Standards for Airborne Area Navigation Equipment Usng Loran-C Inputs. These documents can be obtained from the RTCA, One McPherson Square, Suite 500, 1425 K Street Northwest, Washington, D.C. 20005.
(2) Aerospace Recommended Practice (ARP) 926A, Fault/Failure Analysis Procedure; ARP 1834, Fault/Failure Analysis Guidelines for Digital Equipment;
ARP 1068B, Flight Deck Instrumentation, Display Criteria and Associated Controls for Transport Aircraft, and ARP 1570, Flight Management Computer System. Aerospace Standard AS 8044, Takeoff Performance Monitor (TOPM) System, Airplane, Minimum Performance Standard For. These documents are available from the Society of Automotive Engineers, Inc. (SAE), 400 Commonwealth Drive, Warrendale, PA 15096.
SCOPE. The material provided in this AC addresses system design aspects, characteristics, mechanization, and the criticality of system failure cases for FMS. Although not limited to a specific technology or function, the guidance material is primarily directed towards systems which, through sensor data, compute and integrate real time performance and/or navigation information into output commands that direct the operation and flight path of the airplane. The criteria contained in this AC is in addition to that provided in the ACs referenced in paragraph 2b.
BACKGROUND. The development of today's highly integrated FMS has been an evolutionary process whose origin dates back to the mid-1970s. During that period, the advent of airborne microprocessor based systems for the first time conveniently and economically allowed the storage of relatively large amounts of airplane and engine performance data and airport and navigation facility information. As the data capacity and versatility of airborne digital avionic systems expanded, the number of FMS computational and output functions increased proportionally. In today's highly integrated systems, engine and airplane performance parameters can be computed in real time and combined with lateral and vertical position computations to provide command outputs to the autothrottle and automatic flight guidance system to establish the airplane profile at a preprogrammed speed and spatial position for most modes of flight.
Par 2
5. AIRWORTHINESS CONSIDERATIONS.
Certification Program. This AC provides guidance for the approval of FMS which process data derived from a relatively large number of onboard performance and navigation sensors. Flight management systems may also provide modes which receive and transmit or display data processed in other ground based equipment or onboard systems provided for that purpose. Also, chese systems may provide command outruts to other onboard systems, such as autothrottle and automatic flight guidance systems, which direct the operation of the engines and flight path of the airplane. The degree of system integration to perform these functions may be extensive and as a result, the applicants program should be directed toward airworthiness approval through the type certification or supplemental type certification process.
b. Certification Plan. A comprehensive certification plan should be developed by the applicant. It should include how the applicant plans to comply with the applicable regulations and should provide a listing of the substantiating data and necessary tests. Also, a comprehensive system description and an estimated time schedule should be included. A well developed plan will be of significant value both to the applicant and the FAA.
Design Guidance. Society of Automotive Engineers document ARP 1570, Flight Management Computer System, provides guidance for the design and implementation of the functions and displays of a flight management system.
d. System Integrity. Various types of system failure conditions must be addressed in consideration of the potential hazard they may induce during the course of normal system operation. Advisory Circular 25.1309-1A, System Design and Analysis, provides criteria to correlate the depth of analysis required with the type of function the system performs. Also, failure conditions which result from improper accomplishment or loss of function are addressed. System failure conditions for various functions are outlined below and when provided, each function must be considered individually and in combination with others. Since there may be any number of complex system integrations with existing airplane systems and sensors, the treatment of all the combinations possible is beyond the scope of this AC. If a reliability analysis is necessary, the equipment manufacturer should provide the reliability data for the analysis. Advisory Circular 25.1309-1A states that the flight test pilot should: (1) determine the detectability of a failure condition, (2) determine the required subsequent pilot actions, and (3) a judgment if satisfactory intervention can be expected by a properly trained In addition, failure of the FMS should not degrade the integrity of other safety related systems installed in the airplane. This includes common shared sensors.
Navigation. The FMS should be integrated with other onboard systems and functionally mechanized with the basic airplane such that all lateral, vertical, and autothrottle modes perform their intended function and permit the flightcrew to safely, readily and efficiently operate the airplane within its approved flight envelope. The functions addressed in this paragraph, particularly system status and failure annunciations, supplement those of the particular navigation system advisory circulars referenced in paragraph 2b.
Par 5 5
(1) Lateral Navigation (LNAV). The navigation accuracy required for computed position can vary significantly from one area, airspace, or mode of operation to another. The approval sought for a proposed area of system operation, such as the U.S. National Airspace System (NAS), North Atlantic Minimum Navigation Performance Specification (NAT-MNPS), other areas affected by International Civil Aviation Organization (ICAO) specifications, enroute, or non-precision approach, should be evaluated for acceptable system navigation position accuracy for both the full-up system and degraded or reversionary modes mechanized either automatically within the system or manually by the flightcrew.
Long Range Navigation. Systems which compute lateral navigation position information for extended operation over water or remote land areas using sensor inputs such as inertial, Omega/VLF, Loran C, or Global Positioning System (GPS), or combinations of such sensors, should be evaluated to demonstrate accuracy suitable for the airspace for which the approval is sought. A number of the FAA advisory circulars referenced in paragraph 2b provide guidance for the accuracy and approval of these types of sensors.
Also, systems using inertial sensor inputs that will subsequently seek approval for an operating certificate under Part 121 of the FAR must comply with the accuracy requirements of Part 121, Appendix G, for inertial based systems with or without update provisions.
(ii) United States National Airspace System Navigation. Systems which are intended for enroute, terminal and approach operations in the NAS should meet the following accuracy criteria. It is only necessary to demonstrate system accuracy in one area if it can be shown that the basic sensor accuracy is platform and position independent within specified geographic constraints.
6 Par 5
Enroute Enroute Non-Precision (Random routes) (J/V routes) Terminal Approach Equipment error + 3.8 + 2.8 + 1.7 + 0.3 nmi along and (+ 0.5 for cross track navigation (2 Sigma, data from a 95% probability) single colocated
VOR/DME station only.)
(A) Sensor Qualification. Navigation position data may be computed from a variety of individual or combined sensor inputs. Systems using multi-sensor inputs should meet the criteria of AC 20-130, Airworthiness Approval of Multi-Sensor Navigation Systems For Use In the U.S. National Airspace System (NAS) and Alaska. Systems using inputs from only one sensor should meet the criteria for the particular sensor being used. A number of FAA navigation advisory circulars are listed in paragraph 2b. They provide guidance for approval of these sensors, however, Omega/VLF navigation systems have not demonstrated sufficient accuracy to use in terminal and approach operations.
(B) Non-Precision Approach. Present RNAV instrument approach procedures provide obstruction clearance based upon flight path accuracy established by waypoints referenced to a single colocated VOR/DME facility. Flight management system equipment may provide the capability to conduct various non-precision approaches (VOR, VOR/DME, NDB, and RNAV)
(1) Use of Navaid. Other sensor inputs may be used to provide improved navigation performance, however, the specified reference facility for the approach being conducted must be utilized in the navigation solution. The applicant should demonstrate that the system accuracy is not degraded below that established by the use of the specified reference facility. Display of course guidance information should be smooth during transition among the various sensor inputs. The navigation system may be programmed with procedures for other types of non-precision approaches (VOR, NDB, etc.) This information may be displayed and used by the autopilot or flight director when conducting these types of approaches. For NDB approaches, data from the NDB which defines the approach procedures should be displayed in the pilot's primary field of view.
Par 5 7
(2) Non-Use of Navaid. Flight management system equipment may be used to conduct non-precision approaches where the specified reference facility which defines the approach is not used. In this case, it is necessary for the applicant to show that the system accuracy and failure modes are compatible with the performance requirements and terminal instrument procedures criteria associated with the type of approach being conducted.
Currently, only FMS utilizing position data from an appropriately updated inertial system or the global positioning system (GPS/NAVSTAR) are expected to be capable of meeting this criteria.
(C) Precision Approach. Navigation data for precision approaches is provided by ILS or MLS equipment. Present FMS may provide navigation information to intercept the precision approach system course, and may also provide for automatic tuning of the appropriate sensor receiver.
Experience has shown that it is highly desirable to retain the FMs map display during precision approaches and missed approaches. The map display provides situation awareness information that is not readily available from other displays. In order to provide acceptable agreement between the FMS displayed track line and the ILS/MLS course centerline, the FMS should use ILS/MLS sensor data to compute FMS position. In addition, the ILS/MLS raw data must be displayed in the ADI/EADI or primary flight display (PFD). The autopilot/flight director guidance will be based upon ILS/MLS sensor inputs as opposed to FMS inputs during precision aproaches. The transition from FMS guidance to ILS/MLS guidance (when the precision approach mode is armed for automatic capture) by the autopilot/flight director should be smooth and without significant overshoot. However, experience has shown that the transition from FMS to ILS/MLS can be difficult or significantly delayed in the case of small intercept angles.
(D) Holding Patterns. The equipment should provide the capability to proceed to a selected waypoint and hold on a specified inbound course to a waypoint with a repeated crossing of the selected waypoint. If holding patterns are pilot selectable or included in the data base, they should be defined to ensure that the pattern remains within the appropriate
• protected airspace.
North Reference Effects. Utilization of a magnetic declination computed within FMS equipment, which may ditter from the station declination used for a particular VOR station or airport facility, may result in notable differences in the flight path displayed by the FMS when compared to published routes. The most significant navigation errors are caused by the requirement to navigate with respect to a course from VOR/DME defined wa the shen is station are weich is estab fed by the breet on of the VOR antenna, may differ from the current local magnetic north computed by the FMS by several degrees. Due to the difference between the station declination and the local magnetic variation, a magnetic track of a certain number of uegrees through a station may not be the same track as a VOR radial of the same number of degrees. The difference is usually less than a few degrees, howevei, this can be significant for instrument approach considerations. Even if the magnetic track through a station and the VOR radial were identical tracks at the station, at some distance from the station the two tracks would diverge because the earth's magnetic field changes with 8
AC 25-15 11/20/89 position on the earth. Since constant error limits should be met at any distance from the way points defining the route in use, any equipment/application which has course selection in degrees ("TO-FROM" operation), such as charted airways, should have technical or operational provision to ensure that the proper north reference is used to define the desired course.
Vertical Navigation (VNAV). The vertical navigation function relates to a vertical profile defined by two waypoints. The FMS should meet the following vertical navigation performance criteria regardless of the proposed use of the computed and displayed information or its interface with the pitch axis of the flight guidance/control system. The error of the airborne VNAV (path computation) equipment, excluding altimetry, should be less than that shown below on a 99.7 percent probability basis:
Altitude Region Level Flight Segments Climb/Descent and Climb/Descent Specified Intercept of Specified Vertical Altitudes Profile (angle) At or below 5,000 ft + 50 ft + 100 ft 5000 to 10,000 †t + 50 ft + 150 ft Above 10,000 Ft + 50 ft + 220 ft Guidance on approval of VNAV systems is contained in AC 20-129, Airworthiness Approval of Vertical Navigation Systems.
(i) Cruise Altitude Departure. Adequate annunciation of an impending automatic departure from a cruise altitude should be provided for annunciation are systems that display the airplane position and top of descent/bottom of climb point continuously, as in a horizontal situation indicator map mode, or systems that continuously provide a dedicated display of distance to the top of descent/bottom of climb point or other separate and unique annunciation of "vertical waypoint alert" displayed in the flightcrew's primary field of view. Systems that provide vertical navigation modes that automatically capture a preprogrammed vertical profile should require an overt flightcrew action within 5 minutes of the top of descent/bottom of climb point to activate the descent/climb unless the system is mechanized to the altitude selector in such a manner that a transition to descent or climb will not occur unless the altitude selector has been reset by the flightcrew to the new altitude. In addition, the system should contain design features that provide overspeed/underspeed protection (may be included in the autopilot system).
(ii) Speed Selection. If the system provides for pilot selection of speed, it should not be possible to select a speed above Yo Mo or a speed below the speed 1.2 Vs for the existing airplane configuration.
(3) Navigation Data Base. An FMS with complete capabilities will generally include a nonvolatile mass storage device containing the navigation data necessary to define a flight plan anywhere within a specified geographic area. For IFR operations, the data should include information such as the Par 5 9
location, magnetic variation, frequency and elevation of navaids and Victor and Jet airways. The data base mav also include predetermined flight plans, standard terminal arrival routes (STAR), standard instrument departures (SID) and approach procedures. There should be a means for displaying to the flightcrew the dates for which the data is current and a means for updating the data base at least on a 56 day cycle. At present, there are no provisions for FAA approval or oversight of data bases as originated by manufacturers.
(i) Flight Plan. The flightcrew accesses the data base to construct a flight plan for the intended flight prior to departure or to modify an existing flight plan while in flight. The FMS should provide a means to allow the flightcrew to easily define additional waypoints and insert them into the flight plan. The accuracy of the data defining waypoints, navaids, intersections, etc., is described in navigation advisory circulars such as AC 20-121A, Airworthiness Approval of Loran-C Navigation Systems, and generally specifies the location to the nearest O.l minute of latitude and longitude or the equivalent in terms of bearing and distance from a defined location or navaid. Note that the criteria of ARP 1570, Flight Management Computer System, states that the flight plan constructed by the flightcrew should not be changed or erased by electrical transients or the loss of electrical power.
Data Base Modification. The flightcrew should not be able to modify information in the data base except to add or delete information identified as pilot defined data or to flag existing data so it will not be used when defining a flight plan.
(iii) Precision Approach Data. Precision approach procedures may be included for reference in the navigation data base and may be used by the FMS for procedures such as transition to an ILS or MLS or for missed approach procedures. However, the capabilities required for an FMS to conduct a precision approach without direct use of the ILS or MLS sensors and display has not been defined.
Controls and Display. Acceptable criteria for system controls and displays are found in paragraphs 3, 4, and 5 of SAE document ARP 1068B, Flight Deck Instrumentation, Display Criteria and Associated Controls for Transport Aircraft.
(i) Automatic Frequency Tuning. Systems may be mechanized to employ automatic navaid selection and/or tuning to enhance navigation accuracy. When provided, the implementation should not allow the automatic feature to override the frequency that has been manually selected by the flightcrew. Some systems may also provide for remote tuning of communication transcievers through the FMS. This feature is acceptable as long as a means is provided to manually tune the radios to the emergency frequencies (121.5 and/or 243.0 MHz) regardless of the frequencies tuned by the FMS.
(ii) Time and Distance Display. The display of time or distance to go should relate to a navaid or waypoint located on the programmed airplane course unless adequate annunciation is provided to the contrary. The display of the frequency of an off-track navaid previously selected by the flightcrew is not considered adequate annunciation for this purpose.
10 Par 5
(iii) System Status Display. A means should be provided to indicate upon demand, the specific sensors and/or stations currently used in the navigation calculations as well as the status of all sensors and/or stations being tracked.
Position Update. It is recommended that the ability to manually update the FMS position be provided. Individual sensor position should not be used unless recommended by its particular advisory circular.
(5) Annunciation. The FMS should provide the means to annunciate the status of the selected navigation mode and to alert the flightcrew to system failures which could attect the navigation of the airplane. In the approach mode, the lack of adequate navigation signals or sources should be annunciated
(i) Loss or Reduction of Function. Adequate annunciation should be provided for system failures that result in a loss or reduction of function. This includes the case when the system automatically reverts to a reversionary mode which can result in reduced navigation accuracy performance or a reduction in the airspace or geographical area that has been approved for normal system operation.
(ii) Mode Annunciation.
in pitch, roll, thrust or airspeed by FMS functions, the annunciation of these modes or submodes of FMS operation shall be presented in a clear and unambiguous manner in the flightcrews primary field of view.
(iii) Excessive Deviation Annunciation. It is desirable to have the FMS provide a means to annunciate a significant position deviation from the computer programmed flight path of the airplane. The annunciation threshold should consider hazardous deviations such as full-scale deflections of the course deviation indicator.
(iv) waypoint Alert. A means should be provided to annunciate an approaching waypoint crossing. In addition to a dedicated waypoint alert light, an electronic horizontal situation indicator map mode which continuously displays airplane and waypoint position, would be acceptable for the purpose.
(v) Sensor and Station Quality. The system should annunciate when the quality of the navigation signals or sources, including signal to noise ratio and station geometry, has degraded to the level where the accuracy for which the navigational mode was approved can no longer be assured.
(6) Failure Modes. An equipment installation failure modes and effects analysis should be provided; the extent of which is dependent upon the degree of integration of the navigation system with the FMS and other new or existing airplane systems and sensors.
(7) Navigation Integrity. The computation and display of hazardously misleading navigation information should be shown to be improbable. For this purpose, hazardously misleading information relates to a Par 5 11
computed navigation position with errors that exceed the accuracy criteria for the area or airspace for which the approval is sought. Guidance on this is provided in AC 25.1309-1A.
(i) Lateral Navigation. The computation and display of hazardously misleading lateral navigation information or the loss of all lateral navigation position information should be shown to be improbable.
Lateral navigation position information is not limited to that available from the FMS. It may include other information available in the airplane which the flightcrew can use to determine lateral position with an accuracy appropriate to the route being flown.
(ii) Vertical Navigation. Altimetry is the basic vertical navigation source for the airplane. The computation and display of hazardously misleading vertical navigation information on the FMS, flight director or HSI, should be shown to be improbable. The loss of the FMS VNAV function may be probable.
NOTE: The FMS and aircraft altimetry architecture can be used to preclude the display of hazardously misleading vertical navigation information by the FMS. An example would be the installation of independent altimetry systems with an appropriate comparator and display or the use of an independent altitude alerting function installed on the airplane (independent of the VNAV computer and its associated air data sensor).
(111) Long Range Navigation. When proposed as stand alone or primary means, the simultaneous computation and display of hazardously misleading information from two or more independent data sources or the loss of all navigation position infirmation should be shown to be improbable.
When used as a primary means, the integrity of the components that display navigation position information; such as alphanumeric displays, weather radar, cathode ray tubes, electronic flight instruments, etc., must be considered when evaluating the reliability of the
(v) Navigation Data Base. Corruption of the information contained in the data base is considered to be a major failure condition.
Failures of the system which results in unannunciated changes to the data must be improbable. Differences between the update of the data base and the information contained in the update medium must be improbable.
f. Performance Management. Systems are available to aid the flightcrew in computing and displaying, and in some cases setting thrust and speed schedules for achieving maximum airplane performance or best economy over the entire flight profile of the airplane. These functions are called performance management and when incorporated in a single unit are called performance management systems. The provided modes may include takeoff, climb, cruise, descent, holding patterns, approach, and go-around functions. The performance management functions may, in addition to displaying computed information, generate control signals for coupling to the autothrottle and autopilot systems to achieve the desired values of thrust and speed, in order to minimize flightcrew workload. Performance management may also provide 12 Par 5