(L) The airplane should be instrumented such that parameters appropriate to the tests are recorded (e.g., normal acceleration, airspeed, altitude, pitch and roll attitude, automatic pilot engagement discrete).
(ii) Monitored/Voted Automatic Systems.
(A) Earlier autopilot certifications dealt with systems using torque-limited servos as a means of compliance. Modern systems use such techniques as electronic limiters, g-limiters, rate limiters, etc.; force voting, rate voting, etc.; monitors that disengage the system, monitors that revert to operating channels, etc.; in order to increase the system capability and meet the malfunction requirements. These systems should be expected to exhibit malfunction characteristics equal to, or better than, the torque-limited servo systems.
(B) The applicant's analysis and iron bird testing of monitored and/or voted systems should tend to reduce flight evaluation. Evaluation at selected flight conditions should be performed to substantiate proper system operation and correlation of analysis.
(iii) Oscillatory Tests.
(A) An investigation should be made to determine the effects of an oscillatory signal of sufficient amplitude to saturate the servo amplifier of each device that can move a control surface. The investigation should cover the range of frequencies that can be induced by a malfunction of the automatic pilot system and systems functionally connected to it, including an open circuit in a feedback loop. The investigated frequency range should include the highest frequency that results in apparent movement of the system driving the control surface to the lowest elastic or rigid body response frequency of the airplane. Frequencies less than 0.2 Hz may, however, be excluded from consideration. The investigation should also cover the normal speed and configuration ranges of the airplane. The results of this investigation should show that the peak loads imposed on the parts of the airplane by the application of the oscillatory signal are within the limit loads for these parts. Autopilot systems that contain integral performance envelope limiting cut-out functions may be exempt from this requirement, provided the integrity of the monitor is demonstrated in the normal way.
(B) The investigation may be accomplished largely through analysis with sufficient flight data to verify the analytical studies, or largely through flight tests with analytical studies extending the flight data to the conditions that impose the highest percentage of limit load to the parts.
(C) When flight tests are conducted in which the signal frequency is continuously swept through a range, the rate of frequency change should be slow enough to permit determination of the amplitude of response of any part under steady frequency oscillation at any critical frequency within the test range.
(iv) Climb, Cruise and Descent Flight Regimes.
(A) The more critical of the following should be induced into the automatic pilot system. If autothrottles are installed, they should be operating, and vertical gyro mechanical failures should not be considered:
(1) A signal about any axis equivalent to the cumulative effect of any single failure, including autotrim, if installed.
(2) The combined signals about all affected axes, if multiple axis failures can result from the malfunction of any single component.
(B) Corrective action should not be initiated until three-seconds after the pilot has become aware, either through the behavior of the airplane or a reliable failure warning system, that a malfunction has occurred.
(C) The simulated failure and the subsequent corrective action should not result in normal accelerations below zero g or above 2 g's, speeds beyond VFC/MFC, or result in dangerous dynamic conditions or deviations from the flight path. The positive "g" limitation may be increased up to the positive design limit maneuvering load factor, provided adequate analysis and flight test measurements are conducted to establish that no resultant airplane load is beyond limit loads for the structure, including a critical assessment and consideration of the effects of structural loading parameter variations, (i.e., center of gravity, load distribution, control system variations, etc.). Analysis alone may be used to establish that limit loads are not exceeded where the airplane loads are in the linear range of loading, (i.e., aerodynamic coefficients for the flight condition are adequately established and no significant nonlinear air loading exists). If significant nonlinear effects could exist (e.g., buffet loads), flight loads survey measurements may be necessary to substantiate that the limit loads are not exceeded.
(D) The power or thrust for climb should be the most critical of that used:
(1) In the performance climb demonstrations;
(2) In the longitudinal stability tests; or
(3) For normal operational speeds.
(E) The altitude loss for the cruise condition is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
(v) Maneuvering Flight.
(A) Maneuvering flight tests should include turns with the malfunctions introduced when maximum bank angles for normal operation of the system have been established, and in the critical airplane configuration and/or stages of flight likely to be encountered when using the automatic pilot.
(B) A one second delay time following pilot recognition of the malfunction, through the behavior of the airplane or a reliable failure warning system, should be used for maneuvering flight malfunction testing.
(C) The altitude loss, for maneuvering flight testing, is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
(vi) Automatic Pilot Instrument Landing System (ILS) Approach.
(A) All ILS approach malfunctions must be conducted on an ILS facility having a 3-degree glide path.
(B) Throughout an approach, no signal or combination of signals simulating the cumulative effect of any single failure or malfunction in the automatic pilot system, except vertical gyro mechanical failures, should provide hazardous deviations from the flight path or any degree of loss of control if corrective action is initiated one second after the pilot has become alerted to the malfunction.
(C) The airplane should be flown down the ILS in the configuration and at the approach speed specified by the applicant for approach. Simulated autopilot malfunctions should be induced at critical points along the ILS, taking into consideration all possible variations in autopilot sensitivity and authority. The malfunctions should be induced about each axis. A simulator may be adequate for this test.
(D) Automatic pilot system ILS approach malfunctions should be conducted at a safe altitude in "under-the-hood" simulated Instrument Meteorological Conditions (IMC).
(E) The automatic pilot system should be capable of continuing the approach without retrimming the airplane after failure of the critical engine; however, a change in heading at a rate not greater than 3 degrees per second (averaged over a five-second period) would be acceptable. The rate of heading change encountered should be described in the normal or abnormal procedures section of the AFM, whichever is appropriate. The engine failure should not produce hazardous attitudes.
(F) If approval is sought for ILS approaches initiated with one engine inoperative and the airplane trimmed at glideslope intercept, the automatic pilot should be capable of conducting the approach without further trimming. For airplanes with three or more engines, the loss of a second critical engine should not cause a rate of lateral deviation from the ILS course greater than 3 degrees per second, or produce hazardous attitudes.
(G) For coupled and uncoupled approaches, recoveries should be initiated one second after the pilot recognizes the autopilot failure under simulated IFR conditions. The airplane should be on glideslope center when malfunctions are introduced. The altitude loss, measured from the glideslope path to a point where maximum vertical deviation from glideslope exists, should be recorded and presented in the AFM. This is the critical altitude loss from the standpoint of obstacle and ground clearance.
(H) The method used to measure altitude loss during (ILS) approach should be shown to be accurate to within ±5 ft. for both coupled and uncoupled approaches, except that for uncoupled approaches where an applicant demonstrates autopilot malfunctions at Category I minimums, and elects to accept a restriction against the use of the autopilot below those minimums, he need not show that the method of measuring altitude loss meets the ±5 ft.
accuracy requirement.
(I) A malfunction of the autopilot during a coupled ILS approach should not place the airplane in an attitude that would preclude conducting a satisfactory go-around or landing.
(J) The flight path and altitude loss data, determined in accordance with the procedures described in this section, should be used to substantiate that if a hardover were to occur at 80 percent of the minimum decision height, the lowest part of the airplane will not penetrate the 29:1 minimum operational tolerance line that extends upward from a point 15 ft.
above the runway threshold. It would, however, be permissible for the wheels to make contact with the runway in either a landing or go-around recovery maneuver.
(8) Airplane Flight Manual Information. The following information should be placed in the AFM:
(i) Operating Limitations Section: airspeed and other applicable operating limitations for use with the autopilot.
(ii) Operating Procedures Section: the normal operation information.
(iii) Emergency Operating Procedures Section: A statement of the maximum altitude loss experienced during malfunction tests in the cruise and maneuvering flight regimes.
A statement of the altitude loss should be provided. Further, it should be stated that a 3-degree glideslope was used, and the altitude loss was measured from the glideslope path to a point where maximum vertical deviation from the glideslope exists.
[182. - 185.] [RESERVED]
Section 3. ELECTRICAL SYSTEMS AND EQUIPMENT
186. GENERAL - § 25.1351.
a. Explanation. Section 25.1351(a) requires that the electrical generating capacity, and number and kinds of power sources, be determined by an electrical load analysis, and meet the requirements of § 25.1309.
b. Procedures.
(1) Section 25.1351(a) - Electrical System Capacity. Section 25.1351(a) requires the generating capacity, and number and kinds of power sources, to be determined by an electrical loads analysis and meet the requirements of § 25.1309. Additionally, verify by flight test that cooling is satisfactory to maintain component temperatures within the manufacturer's limits, both on the ground and in flight, with the electrical system operating at maximum limit load.
(2) Section 25.1351(b)(1) - Electrical Power Configuration.
(i) Verify that electrical power sources function properly when independent and when connected in combination.
(ii) For airplanes with autoland capability, verify proper electrical power reconfiguration for each available autoland mode.
(iii) Verify that no hazardous airplane systems reaction occurs, to a partial loss of the electrical distribution system by simulating loss of individual busses. Simulate loss of individual busses by opening circuit breakers/relays.
(iv) Verify proper transfer of electrical power between the different power sources
(i.e., external power, APU, engines).
(3) Section 25.1351(b)(2) - Failure of Power Source. Verify proper operation of system during simulated power failures by flight test functional demonstrations. It must be shown by design analysis or laboratory demonstration, that no failure or malfunction of any power source, including the battery can create a hazard or impair the ability of remaining sources to supply essential loads.
(4) Section 25.1351(b)(3) - System Voltage and Frequency. For probable operating conditions, verify that system voltage and frequency, as applicable, at the terminals of all essential load equipment can be maintained within the limits for which the equipment is designed. This may be accomplished in a laboratory environment.
(5) Section 25.1351(b)(4) - System Transients. It must be shown by design analysis, laboratory demonstration, and/or flight demonstration that system transients due to switching, fault clearing, or other causes during normal operations do not make essential loads inoperative, and do not cause a smoke or fire hazard. Flight test recordings may be useful to verify laboratory
demonstrations of system transients and electromagnetic interference (EMI) during normal operations.
(6) Section 25.1351(b)(5) - Power Source Disconnection.
(i) Verify that there are means accessible in flight, to the appropriate crewmembers, for the individual and collective disconnection of the electrical power sources from the system.
(ii) Demonstrate that the airplane can be flown with one less generator than allowed by the Master Minimum Equipment List (MMEL). Also verify that prior to switching off the non-essential electrical loads specified in the AFM, the remaining generators' short term (up to 5 minutes) capacity is not exceeded.
(7) Section 25.1351(b)(6) - Power Source Indicators.
(i) Verify that there are means to indicate, to the appropriate crewmembers, the generating system quantities essential for the safe operation of the system, such as the voltage and current supplied by each power source, if appropriate to type of aircraft, i.e., glass cockpit design may provide information on MFD (ECAM, EICAS, etc.)
(ii) Verify proper operation of electrical power system warning, caution, and advisory indications, if any, and that these indications comply with §§ 25.1309(c) and 25.1322.
(8) Section 25.1351(c) - External Power. If provisions are made for connecting external power to the airplane, and that external power can be electrically connected to equipment other than that used for engine starting, verify that a means is provided to ensure that no external power supply having a reverse polarity, a reverse phase sequence, overvoltage, or reverse phase/neutral can supply power to the airplane's electrical system. This demonstration may be accomplished in a laboratory environment.
(9) Section 25.1351(d) - Operation Without Normal Electrical Power. It must be demonstrated that the airplane can be operated safely in Visual Flight Rule (VFR) conditions, for a period of not less than five minutes, with the normal electrical power (electrical power sources excluding the battery) inoperative, with critical type fuel (from the standpoint of flameout and restart capability), and with the airplane initially at the maximum certificated altitude.
(10) Emergency Electrical Power System.
(i) For airplanes with a type certification basis that includes Amendment 25-23, the FAA has applied a general requirement that following total failure of the electrical power system, if not shown to be extremely improbable, emergency electrical power must be available to power instrument displays, systems, equipment, or parts of the airplane essential for safety of flight during Instrument Meteorological Condition (IMC) operations for at least 30 minutes. It may also be advisable to check that in the event when normal operation is reestablished following the use of emergency power devices, such devices can withstand, or at least do not adversely affect, the subsequent reversion to "normal" operation.
(A) Thirty (30)-Minute Requirement Test. Accomplish ground and/or flight testing to verify that the main battery/non time-limited power source (e.g., auxiliary power unit (APU), ram air turbine, pneumatic or hydraulic motor, etc.) is sufficient to power the essential loads required for safety of flight during IMC operations for at least 30 minutes. If the emergency power is provided by a non time-limited power source, the main battery capacity should be sufficient for at least 5 minutes to show compliance with § 25.1351(d). Essential loads for safety of flight during IMC operations are considered to include the following:
(1) Those essential for continued safe flight and landing during Visual Meteorological Conditions (VMC) operations.
(2) One display of attitude, direction, airspeed and altitude as specifically stated in § 25.1333(b), a free-air temperature indicator, and pitot/static heat capability, if required.
(3) Communication, intercommunication, and navigation capability (for IMC operations)necessary cockpit and instrument lighting, and any other instrument displays, systems, equipment, or parts of the airplane that are necessary to safely complete the flight.
(B) Perform a VMC approach and landing with the airplane powered with emergency electrical power only. Verify acceptable operation of the emergency equipment.
(C) Perform a simulated night IMC approach and landing with the airplane powered with emergency electrical power only. Verify acceptable visibility and operation of the emergency equipment. This test can be accomplished on a simulator.
(ii) (Time-Limited Emergency Electrical Power Supply.) [RESERVED]
187. ELECTRICAL EQUIPMENT AND INSTALLATIONS - § 25.1353.
a. Explanation. None.
b. Procedures.
(1) Section 25.1353(a) - Equipment Interference. Verify by design analysis, laboratory demonstration, or airplane functional tests that the operation of each electrical unit, or system of units, will not adversely affect simultaneous operation of any other unit or system essential to the safe operation of the airplane.
(2) [RESERVED]
(3) Section 25.1353(c)(1) - Storage Batteries. Verify, for all storage batteries, that during any probable charging and discharging condition, including when the battery is recharged after previous complete discharge, the cell temperatures and pressures of the batteries are safely maintained:
(i) During maximum regulated voltage or power;
(ii) During a flight of maximum duration; and
(iii) Under the most adverse cooling condition likely to occur in service.
(4) Section 25.1353(c)(2) - Compliance with § 25.1353(c)(1). Compliance with § 25.1353(c)(1), above, must be shown by test, unless experience with similar batteries and installations has shown that maintaining safe cell temperatures and pressures is not a problem.
(5) Section 25.1353(c)(3) - Storage Battery Gases. Verify by design analysis, laboratory demonstration, or airplane functional tests that no explosive or toxic gases emitted by any battery in normal operation, or as a result of any probable malfunction in the charging system or battery installation, accumulate in hazardous quantities within the airplane.
(6) Section 25.1353(c)(4) - Equipment Adjacent to Storage Batteries. Verify by design review that no corrosive fluids or gases that may escape from the battery may damage surrounding airplane structures or adjacent essential equipment.
(7) Section 25.1353(c)(5) - Storage Battery Heat. Verify by design analysis, or laboratory demonstration, that each nickel-cadmium battery installation, has provisions to prevent any hazardous effect on structure or essential systems that may be caused by the maximum amount of heat the battery can generate during a short circuit of the battery or its individual cells.
(8) Section 25.1353(c)(6) - Storage Batteries Used for Engine Start. Verify by design analysis, laboratory demonstration, or airplane functional tests that any nickel-cadmium battery installation capable of being used to start an engine or auxiliary power unit has one or more of the following:
(i) A system to control the charging rate of the battery automatically to prevent battery overheating;
(ii) A battery temperature sensing and over-temperature warning system with a means for disconnecting the battery from its charging source in the event of an over-temperature condition; or
(iii) A battery failure sensing and warning system with a means for disconnecting the battery from its charging source in the event of battery failure.
188. DISTRIBUTION SYSTEM - § 25.1355.
a. Explanation. Section 25.1355(a) defines the distribution system, including the distribution busses, their associated feeders, and each control and protective device.
b. Procedures. Section 25.1355(c) - Independent Power Sources. For equipment or systems that are required to have two independent sources of electrical power, verify by airplane demonstration that in the event of a failure of one power source for such equipment or system, another power source (including its separate feeder) is automatically provided or can be manually selected to maintain equipment or system operation.
189. CIRCUIT PROTECTIVE DEVICES - § 25.1357. [RESERVED]
190. ELECTRICAL SYSTEM TESTS - § 25.1363.
a. Explanation. Laboratory tests are conducted to verify that the control, regulation, protection, and automatic operation of the electrical system comply with §§ 25.1351 through
25.1357. Laboratory tests must be conducted on a mockup using the same type and length of feeder wires, and generating equipment, that will be installed in the airplane. Additionally, the generator drives must simulate the actual prime movers on the airplane with respect to their reaction to generator loading, including loading due to faults. Section 25.1363(b) states that for each flight condition that cannot be adequately simulated in the laboratory or by ground tests on the airplane, a flight test must be conducted.
b. Procedures. Negative Acceleration Performance - Verify that no hazardous malfunctions of the electrical power system occur when the airplane is operated at the negative accelerations within the flight envelope prescribed in § 25.333. This must be shown for the greatest duration expected for the acceleration. This test is normally conducted in conjunction with the engine negative acceleration test to comply with § 25.943.
Section 4. LIGHTS
191. INSTRUMENT LIGHTS - § 25.1381.
a. Explanation. None.
b. Procedure. Under actual or simulated nighttime conditions, evaluate instrument lighting for the following characteristics:
(1) Illumination of adequate intensity is provided for all appropriate cockpit instruments/controls/equipment.
(2) Illumination is of appropriate color, intensity is evenly distributed, and is free of objectionable flicker, glare, or reflection.
(3) Dimming capability allows smoothly adjustable illumination intensity between appropriate limits.
192. LANDING LIGHTS - § 25.1383.
a. Explanation. None
b. Procedure. The landing gear lights should be evaluated to determine that they:
(1) Are aimed properly, provide sufficient intensity to facilitate night landings, and are acceptable at different pitch attitudes during landing approach with various cg, flap settings and airspeed;
(2) Are not a source of objectionable glare or halation;
(3) Are functional in MMEL configurations and during operations in adverse weather.
193. POSITION LIGHT SYSTEM INSTALLATION - § 25.1385.
a. Explanation. Section 25.1385(a) requires the position light system to comply with detailed technical specifications contained in §§ 25.1387 through 25.1397. These sections define location, color, visibility, and intensity requirements with considerable precision. An indepth examination of the installed position light system with regard to these requirements is not necessarily considered appropriate or within the scope of a flight test evaluation, unless it becomes apparent while accomplishing the following procedures that further examination is warranted.
b. Procedures.
(1) Operate the position light system. Verify that general locations and color are as prescribed in §§ 25.1385(b) and (c).
(2) Verify that position light illumination does not cause objectionable glare to the flightcrew.
[194. - 200.] [RESERVED]
201. ANTICOLLISION LIGHT SYSTEM - § 25.1401
a. Explanation. Section 25.1401(a)(2) requires the anti-collision light system to comply with the detailed specifications contained in §§ 25.1401(b) through (f). These sections define coverage, color, flash rate, and intensity requirements with some precision. An indepth examination of the installed anti-collision system, with regard to all of these requirements, is not necessarily considered appropriate or within the scope of a flight test evaluation, unless it becomes apparent while accomplishing the following procedures that further examination is warranted.
b. Procedure.
(1) Operate the anti-collision light system. Verify that one or more red or white lights are installed in locations that appear to provide the required visibility and which flash at the appropriate rates.
(2) Verify that the anti-collision lights do not cause objectionable glare to the flightcrew.
(4) Evaluate anti-collision lights during flight in clouds.
202. WING ICING DETECTION LIGHTS - § 25.1403.
a. Explanation. If the airplane is intended to be certificated for night flight into known icing conditions, a means for visually or otherwise determining the extent of icing on critical surfaces must be provided.
b. Procedure. The wing icing detection lights, if required, should be evaluated to determine that they:
(1) Are aimed properly toward the appropriate surfaces, and are of sufficient intensity for required illumination.
(2) Are not a source of objectionable glare, reflection, or halation.
Section 5. SAFETY EQUIPMENT [203. - 207.] [RESERVED]