229 3 Power Bus Transients. After the normally expected electrical bus transients due to engine failure, attitude should not be off or unstable for more than one second and should affect only displays on one side of the airplane. If power-up initialization or selftests are started by the transient, any change in attitude should not be distracting; recognizably valid pitch and roll data should be available within one second. For most airplanes, an engine failure after takeoff will simultaneously create a roll rate acceleration, new pitch attitude requirements, and an electrical transient. Attitude information is paramount; transfer to standby attitude or transfer of control of the airplane to the opposite pilot cannot be reliably accomplished under these conditions in a timely enough fashion to prevent an unsafe condition.
In testing this failure mode, switching the generator off at the control panel will usually result in the quickest switching time. Conversely, during an engine failure, as the engine speed decays, the generator output voltage and frequency each decay to a point where the bus control relays finally recognize the failure. This can be a significantly larger disturbance resulting in a different effect on the using equipment. One way to simulate this failure is with a fuel cut, at a safe altitude and airspeed. Both means should be tested.
(c) Multi-axis Failures - FMEAs generally do not rule out the combined pitch/roll attitude failures. If this failure condition can propagate through the autopilot, a need may exist for demonstrating multi-axis autopilot hardovers, as described in paragraph 181 of this AC. If the autopilot system architecture is such that the failure cannot get through to the control surface
(i.e., input sensor screening, fail-passive autopilot, reasonableness tests, etc.), the need for hardover demonstration may be eliminated. Be aware of the fact that most fail-passive cruise mode autopilots may not be truly fail-passive when reconfigured to reversionary modes.
(d) Attitude Sensor Intermix - If the applicant is seeking certification credit for sensor intermix (e.g., vertical and directional gyros (VG/DG)) on the captain’s side, and AHRS on the first officer’s side), compatibility of the two systems should be demonstrated (i.e., no excessive attitude monitor trips, no adverse influence on system availability (such as autoland) due to monitor trips, etc.). This also holds true for either mode of AHRS operation (NORMAL/BASIC or STANDBY), if this feature is available in the system.
(e) For systems that have two operational modes (NORMAL and BASIC), annunciation of the fact that the system is operating in the reversionary (BASIC) mode is largely dependent on the user system’s architecture. For example, if the airplane is equipped with a CAT III autoland system or CAT III head up display (HUD) system, the performance in these modes with Basic Attitude may be degraded to the point where airplane safety is compromised in CAT III weather conditions. There should then be clear and unmistakable annunciation of the fact that this attitude condition exists.
(f) For triple AHRS installations, switching is provided to substitute the third AHRS for either the captain’s or first officer’s system. Annunciation of the fact that the switched condition is in existence may or may not be required, depending on cockpit layout, pilot workload considerations, etc. This is an assessment generally made by the FAA project pilot. The same holds true for annunciation of whether or not the third system is inoperative.
(g) Some additional flight evaluation suggestions follow:
1 While on the ground, determine that the attitude system provides usable attitude information through 360 degrees of roll and pitch by rotating the platform through 360 degrees of roll and pitch while observing the appropriate attitude indicator.
2 Verify the system performs as intended, providing satisfactory attitude and heading information to the pilot’s and copilot’s attitude and heading instruments throughout the normal airplane flight envelope, including unusual attitudes that may be expected in service.
3 Verify that the flight control system functions properly when interfaced with the attitude system. This functional evaluation may be accomplished during a typical flight profile encompassing en route, maneuvering, and coupled approach operations.
4 Determine that loss of the air data system or airspeed input is properly annunciated and that the systems continue to provide satisfactory attitude/heading information.
5 Verify that the comparator monitor provides proper annunciation of attitude/heading disparity.
6 Verify that loss of a single power source does not cause loss of both attitude systems simultaneously.
7 Verify that attitude/heading data from each is not lost for more than 1 second following loss of a primary power source (generator, alternator, inverter, etc.)
simultaneous with loss of the associated powerplant.
8 Verify that the system can be realigned in flight after being shutdown for more than 3 minutes (if applicable).
9 Verify that each attitude system continues to operate correctly following a simulated airplane electrical power loss of X seconds (equipment specific), by removing power from each respective electrical bus.
1 0 Verify proper operation of the back-up battery (if installed) and display of appropriate flags by pulling the attitude circuit breaker. Note that the system operates correctly on back-up battery power for approximately X minutes (equipment specific) and then shuts down. Determine that the appropriate flags appear on the effected displays.
1 1 Verify that all controls, displays, and annunciations are satisfactorily identified, accessible, operable, and adequate for direct sunlight and night conditions.
NOTE: Some of the above items can be accomplished in a laboratory or simulator environment.
(h) Verify that there is no unacceptable mutual interference between the attitude system and other systems and equipment.
(3) Angle-of-attack (AOA) System .
(a) Pilot interface with this system w ill generally be a consequence of presenting a raw data readout in the cockpit and/or driving the Slow/Fast (S/F) display on the ADI, (if so equipped).
(b) Evaluate the displays during normal approaches and landings to assure reasonable/proper information is being presented for the particular flap setting and VREF speed over the gross weight and center of gravity range of the airplane (S/F should be centered).
(c) Conduct left and right sideslips that would be representative of normal operation on approach during crosswind landings or engine-out conditions.
(d) Determine that the malfunction indicators (flags) are appropriately displayed and are satisfactory annunciators.
(e) Qualitatively assess that the thresholds of displays are wide enough to permit the pilot to follow the indicators, as appropriate to the operation of the airplane.
(f) Determine that instrument presentation is sufficiently damped to permit use in turbulent air and that hysteresis, if present, is acceptable.
(g) Verify that the AOA system neither contributes to, nor is affected by, radio frequency or electromagnetic interference (RFI/EMI).
(4) Air Data System .
(a) The air data system performance, with the exception of airspeed calibration, will generally be demonstrated qualitatively by observation of the output displays.
(b) Be particularly observant of barometric altimeter and vertical speed reversals as a function of rapid pitch attitude changes (e.g., takeoff rotation).
(c) Verify that the Mach/airspeed indicators operate smoothly throughout the complete speed envelope of the airplane.
(d) Observe correct operation of the overspeed warning indicator (barber pole) while approaching VMO/MMO speeds.
(e) Observe the static and total air temperature (SAT/TAT) indicators for reasonableness of data presentation.
(f) Verify that the air data system neither contributes to, nor is affected by RFI/EMI.
(5) Radio Altimeter System .
(a) The radio altimeter system should display to the flightcrew, clearly and positively, the altitude information that indicates the airplane main landing gear wheel height above terrain.
(b) Under the measurement conditions described, verify that the altimeters:
1 Display altitude without loss of signal indications or excessive fluctuations, under the following conditions:
(aa) Pitch angle ±5 degrees about the mean approach attitude.
(bb) Roll angle zero to ±20 degrees.
(cc) Forward velocity from minimum approach speed up to 200 knots, in appropriate configurations.
(dd) At altitudes from 0 to 200 feet with sink rates of 0 to 15 feet/second, in landing, approach, and go-around configurations.
2 Track the actual altitude of the airplane over level ground without significant lag or oscillation.
(c) With the airplane at an altitude of 200 feet or less, verify that any abrupt change in terrain, representing no more than 10 percent of the airplane’s altitude, does not cause the altimeter to unlock. The indicator response to such changes should be appropriate. If the system unlocks, it should re-acquire the signal promptly without pilot intervention.
(d) Caution should be exercised on airplanes equipped with automatic landing systems if the radio altimeter system is prone to unlock while flying final approach over irregular terrain, since in all probability, the unlock will adversely affect the autoland availability requirement.
(e) If a decision height (DH) functi on is provided, verify proper operation at minimum altitudes of 200 feet, 100 feet, and 50 feet.
(f) Verify that the push-to-test self-test feature generates a simulated radio altitude of less than 500 feet, and that no other systems experience untended effects or interference. For aircraft with automatic landing systems, the self-test feature should be shown to be inhibited during the low altitude phases of the autoland.
(g) Verify that the system provides a positive failure warning display any time there is a loss of power or a failure of the altimeter to function properly.
(h) Verify that the radio altimeter system neither contributes to, nor is affected by RFI/EMI.
(6) On-Board Weight and Balance System .
(a) In conjunction with conducting the airplane flight test program, on a pre-flight and post-flight basis, continually check and record the gross weight and center of gravity indications of the system with independently and accurately derived values of gross weight and
c.g.
(b) Electromagnetic Compatibility (EMC). Verify that this system does not create adverse effects on any other required flight systems.
(7) Emergency Locator Transmitters (ELT) . Flight testing of the ELT function is not allowed; however, evaluation of the effects of inadvertent actuation of ELT on other flight systems should be made. One method is to transmit on the VHF communication system, whose antenna is closest to the ELT antenna, for a period of 3 seconds on frequencies spaced 0.5 Mhz apart throughout the VHF communication band. Verify that the ELT is not activated by any transmission, no adverse interference is generated on VOR systems due to ELT/COM/VOR interactions, and that the desired VHF communication is established.
(8) Central Aural Warning System (CAWS) .
(a) Most CAWS functions include aural (and voice, in some installations) warnings of the following typical airplane conditions:
Engine Fire Altitude Advisory APU Fire Speedbrake Overspeed Autopilot Disconnect Takeoff Flap/Slat Overspeed Stall Cabin Altitude Landing Gear Stabilizer-In-Motion Evacuation
Pilot Call and SELCAL tones may also be included, although they are advisories as opposed to warnings.
(b) The logic for this system usually resides in another computer (e.g., the flight warning computer or master caution/master warning computer) in which case the two systems should be evaluated simultaneously. However, if the logic and/or computer governing activation of the warnings, priority logic, inhibits, etc. are contained in the CAWS itself, refer to the section covering the computers noted above for additional guidance on flight evaluation. Compliance may be shown by equivalent tests in a flight simulator or by bench tests.
(c) Individual activation of each warning tone should be accomplished in flight under the most adverse noise conditions appropriate to the warning (e.g., VMO/MMO for overspeed, high speed descent for APU fire, acceleration following takeoff for flap/slat overspeed, etc.). Test switches and/or the self-test feature of the system would be an appropriate means to activate the warning.
(d) The flight evaluation will be a pilot qualitative assessment of the clarity, tone, and volume of each warning.
(9) Overspeed Warning System . This system should be demonstrated in conjunction with the airspeed system calibration and should exhibit that it is consistently within the prescribed tolerances. The system tolerance is from VMO to VMO + 6 knots in the airspeed limited range, and from MMO to MMO + 0.01M in the Mach limited range.
(10) Altitude Advisory (or Altitude Alerting) System .
(a) A ground test should be conducted to check the adequacy of the required preflight procedure provided in the AFM.
(b) A flight demonstration should be conducted at low, mid, and high altitudes to verify performance of the intended function of:
235 1 Alerting to an impending capture of a pre-selected altitude; and
2 Alerting to an uncommanded departure from an assigned (selected) altitude.
(c) Low and high rates of vertical speed should be included in the evaluation with captures from above and below the pre-selected altitude.
(d) Determine adequacy of the alert light location and its visibility under various lighting conditions, and adequacy of the aural warning.
(e) A flight simulator may be used to perform appropriate tests.
(11) Ground Proximity Warning System (GPWS) .
(a) Initial approvals of new GPWS should include flight evaluation with an instrumented airplane. The instrumented flight test of a computer type may be demonstrated on one airplane and the results made applicable to any other airplane with only a functional test being required.
(b) Initial approval of new individual TSO approved (TSO’d) sensors, which have an equivalent function and interface as previously approved sensors, and are interfaced with a previously approved computer, may be approved by ground test. Applicable sensors (systems) are the air data computer (ADC), the radio altimeter (R/A), and the airplane’s ILS equipment.
(c) Subsequent installations of identical computers and interfacing sensors in other airplane types will require a ground test and an uninstrumented functional flight test to determine proper functioning, freedom from interference, adequate sound and light levels, inhibit switch details, etc.
(d) The functional flight test should include construction of a profile to selectively actuate each mode that the applicant elects to certify (not all modes are required by the FAA).
Refer to the equipment supplier’s system description to aid in constructing the flight profile.
(e) Evaluate the GPWS warning light and other annunciators for visibility in day and night lighting conditions.
(f) Evaluate the sound level of the aural GPWS warning at V MO with headsets on and with and without simultaneous radio communications.
(g) Verify that the self-test function and the flap override switch perform their intended functions. The gear override switch should be verified as well.
(h) Simulate failures of the ADC, R/A’s and ILS systems (open circuit breakers) and verify that the GPWS detects the faults and illuminates the GPWS fail annunciator.
(i) Verify that conducting a radio altimeter self-test in flight will not induce a false GPWS failure warning.
(j) Verify that the GPWS does not adversely interfere or interact with other airplane systems.
(k) Verify that the GPWS is free of inadvertent activation during electrical bus or generator switching.
(l) Verify that the caution & warning priorities are assessed and that they include systems such as windshear. Example, windshear has priority over the traffic collision avoidance system (TCAS).
(12) Enhanced Ground Proximity Warning System (EGPWS). (RESERVED.)
(13) Master Caution/Master Warning System (MCS/MWS) .
(a) This system provides inputs to master warning (MW) and master caution (MC) lights located on the glareshield in front of each pilot and to the CAWS. (See paragraph 170e(8)). It contains the sensors, switches and logic required to assess the requirement for the warning and caution annunciations.
(b) The system may contain logic to assess priority of the various warnings in order to sequence simultaneous actuation. If so, ground, flight, or bench tests may have to be conducted to verify this logic.
(c) Some cautions may be inhibited during various phases of flight, particularly during the final stages of a Category III automatic landing operation (below alert height). If so, ground or flight tests may have to be structured to verify the inhibit logic. Also, certain warnings may be inhibited during the high speed stages of a takeoff roll. If this feature is incorporated, it too should be carefully substantiated.
(d) Simulate failure of selected sensor inputs to verify that the MCS/MWS computer detects the faults and illuminates the fail annunciator (if installed).
(e) Verify that there is no unacceptable mutual interference between the MCS/MWS and other systems and equipment.
(14) Flight Warning Computer (FWC) .
(a) The FWC is a key subset of the overall warning, caution, and alerting system on the more modern airplanes. It is a microprocessor-based system that works in conjunction with, or totally replaces, the CAWS and MC/MW systems.
(b) The FWC incorporates sufficient computer capacity to perform many more functions than the MCS/MWS and, in addition to outputting to the visual warning displays and
237 aural warning speakers, outputs hundreds of alerts/messages to other display media, most often an electronic display (multi-function CRT on the instrument panel or the CDU portion of the FMS).
(c) The added computer capacity also enables incorporating rather complex inhibit algorithms which, in turn, dictates a requirement for structuring a very complex ground test to verify operation of the inhibits. Review of the system description document will probably be required before any ground, flight, or bench tests can be defined.
(d) The flight evaluation should incorporate the tests described under CAWS and MC/MW systems.
(e) Verify that the self-test feature functions properly.
(f) Simulate failure of selected sensor inputs to verify that the FWC detects the faults and illuminates the FWC fail annunciator.
(g) Demonstrate freedom from nuisance warnings by observing and logging nuisance events as they occur throughout the flight demonstration program. Assess the status at the end of the program by examining the log.
(15) Stall Warning Computer (SWC) .
(a) The SWC should be evaluated in conjunction with the stall tests described in Chapter 2, Section 6 of this AC. Adequacy of the various warnings (stick shaker, warning light, aural (and voice) warning) should be assessed, in addition to the speed schedules.
(b) Demonstrate freedom from nuisance warnings during the takeoff, landing, and maneuvering flight tests described in Chapter 2 of this AC. Further testing may be required to show freedom from nuisance warnings by the test requirements in Chapter 8 of this AC if special airworthiness approvals are sought.
(16) Takeoff Warning System (TOW) .
(a) The TOW system is usually a subset of the CAWS or MCS/MWS or FWC and is generally inhibited at nose wheel liftoff during the takeoff maneuver. It is usually armed when the squat switch indicates that the airplane is on the ground and one or more power levers are advanced beyond a prescribed position or engine thrust setting. The system alarms if the flaps/slats/stabilizer/spoiler/brakes are not set correctly for takeoff.
(b) Determine that each event is annunciated properly by conducting a static ground test.
(c) Flight evaluation during takeoff roll should be a qualitative assessment of the clarity, tone, and volume of each warning. Some systems incorporate a TEST switch, which facilitates activation during takeoff. If this feature is not available, it may suffice to check the
238 audio level of a warning during touch and go landings (e.g., the stabilizer warning while accelerating to VR speed).
(d) Simulate failure of selected sensor inputs to verify that the TOW system detects the faults and illuminates the fail annunciator (if installed).
(e) Verify that the system’s arming status is not affected by electrical power transients, which occur when switching from ground or APU power, during engine start, following bus priority checks, etc.
(f) Verify that there is no unaccepta ble mutual interference between the TOW system and other airplane systems and equipment.
(17) Instrument Comparator System .
(a) If an instrument comparator system is installed and activated, ensure the system monitors validity of and compares (side 1 vs. side 2) pitch and roll attitude, heading, radio altitude, localizer, and glideslope deviation information used for display in the cockpit instruments.
(b) When these parameters exceed a preset threshold or trip level, or if an invalid condition is detected in any of the displayed information, an appropriate annunciator to that parameter will be illuminated.
(c) A ground test on the airplane should be conducted to demonstrate performance of intended functions and validate the detector threshold levels. If annunciation is suppressed under certain conditions, these conditions should also be checked.
(d) A flight evaluation should also be conducted to determine adequacy of the annunciator light locations and visibility under various lighting conditions and that the annunciators are properly identified.
(e) During flight, verify that the system is free from nuisance warnings and is compatible with other electronic systems.
(18) Reactive Windshear Warning System . A complete and comprehensive demonstration program (simulator and flight test) is contained in AC 25-12, “Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems In Transport Category Airplanes,” dated November 2, 1987.
(19) Traffic Alert and Collision Avoidance System . A complete and comprehensive demonstration program (laboratory/ground/flight test) is contained in AC 20-131A, “Airworthiness Approval of Traffic Alert and Collision Avoidance Systems (TCAS II) and Mode S Transponders,” dated March 29, 1993.
f. Procedures-Recording Systems .
(1) Cockpit Voice Recorder (CVR) .
(a) Demonstrate operation of the CVR self-test function and bulk erase feature.
(b) During ground operations prior to and after engine start; during takeoff, climbout, cruise at VMO / MMO, and during landing approach. Except where specifically noted, obtain the following CVR recordings:
1 Flightcrew conversations using the area microphone.
2 Flightcrew conversations using the oxygen mask microphones and the boom-microphone/handset, and the hand-held microphones in flight and during ground operations.
3 Radio transmissions by each crew member during cruise.
4 Audio signals identifying navigation aids (through cockpit speakers and on radio channels) during landing approach.
5 PA announcement during cruise.
6 Selective (based on analysis) aural warning signals (see CAWS) during appropriate flight phases.
(c) Use CVR circuit breaker to limit CVR recording to available capacity.
(d) Verify that all controls, displays, and annunciators consistent with normal and abnormal crew procedures, are satisfactorily identified, accessible, operable, and visible.
(e) EMC. Verify by observation that no adverse effects are present in the required flight systems.
(f) Following the flight, test the CVR audio recording in an appropriate laboratory, and evaluate for clarity of the recorded messages. Preferably the evaluators should not have advance information concerning the flightcrew conversations.
(g) Verify that the hot mike feature at each position allows for recording regardless of the position of the interphone transmit key switch (§ 25.1457(c)(5)).
(2) Digital Flight Data Recorder (DFDR) .
(a) Demonstrate operation of the DFDR se lf-test feature and, prior to collection of test data, set the trip number and date on the code switches of the Trip and Data Encoder, if so equipped.
(b) The certification data will be derived automatically during any appropriate flight that encompasses operation throughout the full flight envelope. Hand recorded data of heading (magnetic or true), barometric altitude, pitch attitude, indicated airspeed, and time (UTC) should be collected at several stabilized flight conditions for subsequent data correlation purposes.
(c) Following the flight, the data should be retrieved for correlation and accuracy verification.
(d) Demonstrate performance of intende d function of the DFDR for all parameters specified in the operating rules. (Refer to appendix B of part 121 for the relevant data ranges, accuracies, and recording intervals.) Accuracy will be verified at stabilized points by correlating against, and comparing with, an approved instrumentation system or manual notes.
(e) Electromagnetic Compatibility (EMC). Verify by observation that no adverse effects are present in the required flight systems.
g. Engine Interfacing Systems . [Reserved]
h. Stability Augmentation Systems . [Reserved]
i. All Weather Operation (Reduced Visibility) Systems . [Reserved]
171. Flight and Navigation Instruments - § 25.1303.
a. Explanation .
(1) Section 25.1303(b)(1) requires an airspeed indicator to be visible at each pilot station. Additionally, if airspeed limitations vary with altitude, airspeed indicators must have a maximum allowable airspeed indicator showing the variation of VMO with altitude. In practice, this maximum allowable airspeed indicator requirement is rarely complied with in a literal sense.
The variation in VMO is not normally depicted literally as a function of altitude, but rather as a radial marker on the airspeed indicator whose position varies as a function of altitude. This presentation of the maximum allowable airspeed limit, as a function of altitude, is approved based on a substantiation of equivalent safety with the literal interpretation of the rule.
(2) Production tolerances for speed warning devices at V MO/MMO are required to be taken into account in accordance with § 25.1303(c).
(3) Section 21.127(b)(2) requires each production flight test to include “An operational check of each part or system operated by the crew while in flight to establish that during flight, instrument readings are within normal range.” Nowhere in these requirements is there any inference that the finite performance or quantitative limits, defined during type certification, need to be determined for each production airplane.