33.7.8 Procedures: FGS Control Wheel Steering (CWS).
33.7.8.1 It should be possible for the pilot to overpower the automatic pilot system, and achieve the maximum available control surface deflection, without using forces that exceed the pilot control force limits specified in § 25.143(d).
33.7.8.2 The maximum bank and pitch attitudes that could be achieved without overpowering the automatic pilot system should be limited to those necessary for the normal operation of the airplane. Typically, these attitudes are ±35° in roll and +20° to -10° in pitch.
33.7.8.3 It should be possible to carry out all normal maneuvers and to counter normal changes of trim due to change of configuration etc., within the range of flight conditions in which control wheel steering may be used, without encountering excessive discontinuities in control force that might adversely affect the flight path.
33.7.8.4 The stall and stall recovery characteristics of the airplane should remain acceptable with control wheel steering in use.
33.7.8.5 In showing compliance with § 25.143(f), account should be taken of such adjustment to trim as may be carried out by the automatic pilot system in the course of maneuvers that can reasonably be expected. Some alleviation may be acceptable in the case of unusually prolonged maneuvers, provided the reduced control forces would not be hazardous.
33.7.8.6 If the use of this mode for takeoff and landing is to be permitted, it should be shown that:
Sufficient control, both in amplitude and rate, is available without encountering force discontinuities;
Reasonable mishandling is not hazardous (e.g., engaging the autopilot while the pitch or roll controls are held in an out-of-trim position); and Runaway rates and control forces are such that the pilot can readily overpower the automatic pilot with no significant error in flight path.
33.7.9 Procedures: Environmental Conditions.
33.7.9.1 Some environmental conditions have created operational problems during FGS operations. The flight demonstration program should expose the FGS to a range of environmental conditions as the opportunity presents itself.
These include winds, mountain-wave, turbulence, icing, etc. However, some specific test conditions may have to be flown to find operational conditions that are not readily achieved during the normal flight test program 33-19
AC 25-7D CHG 1
33.7.9.2 FGS use in icing conditions may mask the onset of an airplane condition
(e.g., out of trim condition) that would present the pilot with handling difficulties if the FGS is disengaged, particularly if the FGS suddenly disengages automatically. The opportunity should be taken during the flight test program to evaluate the FGS during natural icing conditions, including during shedding of the ice, as applicable. The operation of the FGS should also be evaluated during basic airplane performance and handling qualities compliance flight tests with simulated ice accretions installed. (See AC 25-25A for examples of a flight test program for evaluating airplane performance and handling qualities in icing conditions and for guidance on ice accretions to use for flight testing.) The following test conditions should also be considered for evaluating FGS performance in icing conditions:
33.7.9.2.1 Low Speed Protection.
1. With all high lift devices retracted, slow down at a rate not to exceed 1 knot per second until either the autopilot automatically disengages (with an associated alert) or a low speed protection function engages (which may be a low speed alert).
2. Recovery should be initiated no less than three seconds after the onset of an appropriate alert.
3. The airplane should exhibit no hazardous characteristics.
33.7.9.2.2 Coupled Approach.
If the autopilot has the ability to fly a coupled instrument approach and go-around, the following test conditions should be evaluated:
1. Instrument approach, using all normal flap selections.
2. Go-around, using all normal flap selections.
3. Glideslope capture from above the glidepath.
33.7.9.2.3 If the airplane accretes or sheds ice asymmetrically, it should be possible to disengage the autopilot at any time without unacceptable out-of-trim forces.
33.7.9.2.4 General maneuverability should be assessed, including normal turns, and the maximum angle of bank commanded by the FGS in one direction followed by a rapid reversal of command reference to the maximum FGS angle of bank in the other direction.
33.7.10 Procedures: Failure Modes/Malfunction Tests.
33.7.10.1 General.
33.7.10.1.1 Failure conditions of the system should be simulated in such a manner as to represent the overall effect, and worse case effect, of each failure 33-20
condition about all axes. The test method for most failure conditions will require some type of fault simulation technique with controls that provide for controlled insertion and removal of the type of fault. The insertion point will typically be at a major control or guidance point on the airplane (for example, a control surface command, guidance command, or power/thrust command).
33.7.10.1.2 Investigations should include the effects of any failure conditions identified for validation by a system safety assessment conducted to show compliance with § 25.1309(d).
33.7.10.1.3 The safety assessment process may identify vulnerabilities to failure conditions involving hardovers, slowovers, or oscillatory behavior. The various types of effect will result in differing airplane responses and cues to alert the flightcrew to the failure condition. The recognition point should be that at which a line pilot in non-visual conditions may be expected to recognize the need to act. Recognition of the malfunction may be through the behavior of the airplane or a reliable alerting system. The recognition point should be identified by the test pilot. Control column or wheel movements alone should not be used for recognition.
33.7.10.1.4 After the recognition point, action by the test pilot should be delayed to simulate the time it would take for a line pilot to take control after recognizing the need for action. The test condition is considered completed when a stable state is reached as determined by the test pilot. A three-second delay added to the measured time increment between pilot recognition of an automatic pilot malfunction and pilot corrective action has been considered acceptable for climb, cruise, and descent phases of flight. A one-second delay is considered appropriate for flight phases where the crew is expected to be closely monitoring FGS control inputs, such as during approach, and for FGS use during takeoff from shortly after liftoff through flap retraction. For control wheel steering (CWS) mode of operation during takeoff, go-around, and landing, and for autoland and goaround mode hardovers, no delay time need be applied.
33.7.10.1.5 Satisfactory airplane response to autopilot hardovers should be shown throughout the entire certificated airspeed/altitude flight envelope. Since loading limitations of the test airplane preclude investigation of the entire flight envelope for which certification is requested, simulation results may be used to validate response in the unreachable CG versus weight combinations.
33.7.10.1.6 The nominal worst-case weight/CG combinations achievable by the test airplane, as predicted by simulation results, should be flight tested. The justification for selection of the weight/CG combinations proposed for 33-21
testing should be submitted for FAA review prior to type inspection authorization (TIA) issuance.
33.7.10.1.7 The analysis should also present a comprehensive exploration of airplane “g” responses throughout the weight-CG-airspeed-altitude flight envelope, including worst case and envelope boundary conditions. The analysis should include flight test and simulator responses adjusted for the presence of worst-case system tolerance effects.
33.7.10.1.8 During recovery from an automatic pilot system malfunction, the pilot may overpower the autopilot or disengage it. The pilot should be able to return the airplane to its normal flight attitude under full manual control, without exceeding the loads or speed limits appropriate to the flight condition, without engaging in any dangerous maneuver during recovery, and without control forces exceeding the values given in § 25.143(d).
33.7.10.1.9 If an autothrottle is installed, the malfunctions should be examined with and without the autothrottle operating.
33.7.10.1.10 The airplane should be instrumented such that parameters appropriate to the tests are recorded (e.g., normal acceleration, airspeed, altitude, pitch and roll attitude, automatic pilot engagement discrete).
33.7.10.2 Oscillatory Tests.
33.7.10.2.1 An investigation should be made to determine the effects of an oscillatory signal of sufficient amplitude to saturate the servo amplifier of each device that can move a control surface. The investigation should cover the range of frequencies that can be induced by a malfunction of the automatic pilot system and systems functionally connected to it, including an open circuit in a feedback loop. The investigated frequency range should include the highest frequency that results in apparent movement of the system driving the control surface to the lowest elastic or rigid body response frequency of the airplane. Frequencies less than 0.2 Hz may, however, be excluded from consideration. The investigation should also cover the normal speed and configuration ranges of the airplane. The results of this investigation should show that the peak loads imposed on the parts of the airplane by the application of the oscillatory signal are within the limit loads for these parts. Flight guidance systems that contain integral performance envelope limiting cut-out functions may be exempt from this requirement, provided the monitor is demonstrated to have sufficient integrity.
33.7.10.2.2 The investigation may be accomplished largely through analysis with sufficient flight data to verify the analytical studies, or largely through flight tests with analytical studies extending the flight data to the conditions that impose the highest percentage of limit load to the parts.
33-22
33.7.10.2.3 When flight tests are conducted in which the signal frequency is continuously swept through a range, the rate of frequency change should be slow enough to permit determination of the amplitude of response of any part under steady frequency oscillation at any critical frequency within the test range.
33.7.10.3 Climb, Cruise and Descent Flight Regimes.
33.7.10.3.1 The more critical of the following should be induced into the FGS. If autothrottles are installed, they should be operating, and vertical gyro mechanical failures should not be considered:
1. A signal about any axis equivalent to the cumulative effect of any single failure, including autotrim, if installed.
2. The combined signals about all affected axes, if multiple axis failures can result from the malfunction of any single component.
33.7.10.3.2 Corrective action should not be initiated until three-seconds after the pilot has become aware, either through the behavior of the airplane or a reliable failure warning system, that a malfunction has occurred.
33.7.10.3.3 The simulated failure and the subsequent corrective action should not result in accelerations normal to the flight path below zero g or above 2 g, speeds beyond VFC/MFC, or result in dangerous dynamic conditions or deviations from the flight path. The positive “g” limitation may be increased up to the positive design limit maneuvering load factor, provided adequate analysis and flight test measurements are conducted to establish that no resultant airplane load is beyond limit loads for the structure, including a critical assessment and consideration of the effects of structural loading parameter variations, (i.e., CG, load distribution, control system variations, etc.). Analysis alone may be used to establish that limit loads are not exceeded where the airplane loads are in the linear range of loading, (i.e., aerodynamic coefficients for the flight condition are adequately established and no significant nonlinear air loading exists). If significant nonlinear effects could exist (e.g., buffet loads), flight loads survey measurements may be necessary to substantiate that the limit loads are not exceeded.
33.7.10.3.4 The power or thrust for climb should be the most critical of that used:
In the performance climb demonstrations;
In the longitudinal stability tests; or For normal operational speeds.
33.7.10.3.5 The altitude loss for the cruise condition is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
33-23
33.7.10.4 Maneuvering Flight.
33.7.10.4.1 Maneuvering flight tests should include turns with the malfunctions introduced when maximum bank angles for normal operation of the system have been established, and in the critical airplane configuration and stages of flight likely to be encountered when using the automatic pilot.
33.7.10.4.2 A one second delay time following pilot recognition of the malfunction, through the behavior of the airplane or a reliable failure warning system, should be used for maneuvering flight malfunction testing.
33.7.10.4.3 The altitude loss, for maneuvering flight testing, is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
33.7.10.5 Approach.
There are two types of approach operations to consider—an approach with vertical path reference and one without vertical path reference. The approach with vertical path reference should be assessed against ground-based criteria using a deviation profile assessment. A height loss assessment should be used for approaches without vertical path reference.
33.7.10.5.1 Fault Demonstration Process.
First determine the worst-case malfunction for each vertical flight path mode that may be used to conduct an approach (e.g., ILS, MLS, GLS, flight management system/RNAV, vertical speed, flight path angle), based on factors such as the following:
Failure conditions identified by the system safety assessment.
System characteristics such as variations in authority or monitor operation.
Mitigation provided by any system alerts.
Aircraft flight characteristics relevant to failure recognition.
33.7.10.5.2 Once the worst-case malfunction has been determined, flight tests of the worst-case malfunction should be flown in representative conditions (for example, coupled to an ILS), with the malfunction being initiated at a safe height. The pilot should not initiate recovery from the malfunction until one second after the recognition point. The delay is intended to simulate the variability in response to effectively a “hands off” condition. It is expected that the pilot will follow through on the controls until the recovery is initiated.
33-24
33.7.10.5.3 Assessment of Approach with Vertical Path Reference.
Figure 33-2 depicts the deviation profile method. The first step is to identify the deviation profile from the worst-case malfunction. The next step is to “slide” the deviation profile down the glidepath, until it is tangential to the 1:29 line or the runway. The failure condition contribution to the minimum use height (MUH)-approach may be determined from the geometry of the airplane wheel height determined by the deviation profile, relative to the 1:29 line intersecting a point 15 feet above the threshold.
Note: The MUH-approach is based on the recovery point for the following reasons: (1) it is assumed that in service the pilot will be “hands off” until the autopilot is disengaged at the MUH in normal operation; (2) the test technique assumes a worst-case based on the pilot being “hands off” from the point of malfunction initiation to the point of recovery; and (3) a failure occurring later in the approach than the point of initiation of the worst-case malfunction described above is therefore assumed to be recovered earlier and in consequence to be less severe.
33.7.10.5.4 Assessment of Approach without Vertical Path Reference.
Figure 33-3 depicts the height loss method. A descent path of 3°, with nominal approach speed, should be used unless the autopilot is to be approved for significantly steeper descents. The vertical height loss is determined by the deviation of the aircraft wheel height relative to the nominal wheel flight path.
33-25
Figure 33-2. Deviation Profile Method
1. Failure Initiation
2. Failure Recognition by pilot Path of airplane 3. Initiation of Manual Recovery action by pilot wheels as a result 4. Point on Normal/Fault free Wheel path at which autopilot is of failure disengaged 1 sec.
3° Nominal ILS Glideslope Normal/Fault Path of airplane Free Wheel Path wheels as a result Wheel path, of failure tangent 1:29 1 sec.
Minimum Use Height (MUH)
15.2m Threshold Height
4.6m ILS Threshold GP 33-26
Figure 33-3. Height Loss Method
1. Failure Initiation
2. Failure Recognition by pilot Path of airplane 3. Initiation of Manual Recovery action by pilot wheels as a result of failure Height Loss Normal/Fault Free Wheel Path Tangential Wheel Height 33-27
33.7.10.6 Autopilot Override.
33.7.10.6.1 Initial Tests.
The initial tests to demonstrate compliance should be accomplished at an intermediate altitude and airspeed, e.g., 15,000 feet MSL and 250 knots.
With the autopilot engaged in Altitude Hold, the pilot should apply a low force to the control wheel (or equivalent) and verify that the automatic trim system does not produce motion resulting in a hazardous condition.
33.7.10.6.2 Automatic Disengagement.
Disengagement caused by flightcrew override should be verified by applying an input on the control wheel (or equivalent) to each axis for which the FGS is designed to disengage, that is, the pitch and roll yoke, or the rudder pedals (if applicable). The pilot should gradually increase the applied force to the control wheel (or equivalent) until the autopilot disengages. When the autopilot disengagement occurs, observe the transient response of the airplane. Verify that the transient response is no more than minor as required by § 25.1329(d). The inputs by the pilot should increase for each test case to a point where the input is sharp and forceful, so that the FGS can immediately be disengaged for the flightcrew to assume manual control of the airplane.
33.7.10.6.3 Non-Automatic Disengagement.
If the autopilot is designed such that it does not automatically disengage during an autopilot override—and instead provides a flight deck alert to mitigate any potentially hazardous conditions—the timeliness and effectiveness of this alert should be evaluated. The pilot should follow the evaluation procedure identified above until such time as an alert is provided. At that time, the pilot should respond to the alert in a responsive manner consistent with the level of the alert (that is, a caution, a warning) and with the appropriate flightcrew procedure defined for that alert. When the autopilot is manually disengaged, observe the transient response of the airplane and verify that the transient response is no more than minor as required by § 25.1329(d).
33.7.10.6.4 Repeated Test Conditions.
After the initial tests have been successfully completed, the above tests should be repeated at higher altitudes and airspeeds until reaching MMO at high cruise altitudes.
33.7.11 Procedures: Airplane Flight Manual Information.
The following information should be provided in the AFM:
33.7.11.1 Operating Limitations Section: Airspeed and other applicable operating limitations for use with the autopilot.
33-28
33.7.11.2 Operating Procedures Section: The normal operation information.
33.7.11.3 Non-Normal/Emergency Operating Procedures Section: A statement of the maximum altitude loss experienced during malfunction tests in the cruise and maneuvering flight regimes. A statement of the altitude loss should be provided. Further, it should be stated that a 3-degree glideslope was used, and the altitude loss was measured from the glideslope path to a point where maximum vertical deviation from the glideslope exists.
33-29
CHAPTER 34. EQUIPMENT: ELECTRICAL SYSTEMS AND EQUIPMENT
34.1 General—§ 25.1351.
34.1.1 Explanation.
Section 25.1351(a) requires that the electrical generating capacity, and number and kinds of power sources, be determined by an electrical load analysis, and meet the requirements of § 25.1309.
34.1.2 Procedures: § 25.1351(a)—Electrical System Capacity.
Section 25.1351(a) requires the generating capacity, and number and kinds of power sources, to be determined by an electrical loads analysis and meet the requirements of §
25.1309. Additionally, verify by flight test that cooling is satisfactory to maintain component temperatures within the manufacturer’s limits, both on the ground and in flight, with the electrical system operating at maximum limit load.
34.1.3 Procedures: § 25.1351(b)(1)—Electrical Power Configuration.
34.1.3.1 Verify that electrical power sources function properly when independent and when connected in combination.
34.1.3.2 For airplanes with autoland capability, verify proper electrical power reconfiguration for each available autoland mode.
34.1.3.3 Verify that no hazardous airplane systems reaction occurs to a partial loss of the electrical distribution system by simulating loss of individual busses. Simulate loss of individual busses by opening circuit breakers/relays.
34.1.3.4 Verify proper transfer of electrical power between the different power sources (i.e., external power, APU, engines).
34.1.4 Procedures: § 25.1351(b)(2)—Failure of Power Source.
Verify proper operation of system during simulated power failures by flight test functional demonstrations. The applicant must show by design analysis or laboratory demonstration, that no failure or malfunction of any power source, including the battery can create a hazard or impair the ability of remaining sources to supply essential loads.
34.1.5 Procedures: § 25.1351(b)(3)—System Voltage and Frequency.
For probable operating conditions, verify that system voltage and frequency, as applicable, at the terminals of all essential load equipment can be maintained within the limits for which the equipment is designed. This may be accomplished in a laboratory environment.
34-1