253 pitch axis control law may be an angle-of-attack control law system, but most modern systems will have control laws for speed control. The speed should be compatible with that used for a manually controlled go-around without guidance.
(c) Under no circumstances should the system command a go-around speed less than 1.13 VSR1 for the go-around flap setting (which equates to approximately 1.3 VSR0 + 3 knots for the landing flap setting) or other firmly established minimum control speed (e.g., VMCL) established for that particular airplane. In making this evaluation, consideration should be given to the autopilot roll axis control law and its effect on minimum control speeds; if the autopilot employs a wings-level control law, the minimum control speeds will be considerably increased over the pilot flying values that are determined with some degree of bank into the operating engine(s).
(d) Evaluate go-around performance with normal conditions for each landing flap setting through a full range of gross weight and center of gravity conditions. Use normal cleanup procedures to the appropriate approach climb flap setting.
(e) Evaluate go-around performance with simulated engine failure conditions occurring:
1 Just prior to go-around initiation;
2 Just after go-around initiation; and
3 During climb-out, both before and after initiation of altitude capture mode.
(f) If engine-out approach/landing approval is sought by the applicant, then evaluate go-around performance initiated from an engine-out approach.
(g) It should be demonstrated that the autopilot will command the correct speed to accomplish a go-around for the conditions in the testing described in paragraphs (d), (e), and
(f), above.
(h) Flight path control following an engine failure during go-around should not require exceptional piloting skill or alertness.
(i) Conduct go-arounds with and without, as applicable, automatic throttles, yaw damper, automatic ground spoilers, control wheel steering, and any other equipment configurations, and combinations thereof, for which the applicant is seeking certification credit.
Include all sensor and instrument switching combinations.
(j) Evaluate Slow/Fast display behavior, if applicable, in conjunction with these go-around tests.
(k) Evaluate the autopilot behavior with both series and parallel rudder (if available) configurations, particularly in conjunction with simulated engine failure tests.
(l) Evaluate “fade-out” of parallel rudder (with simulated engine failure) during autopilot go-around mode transition to automatic altitude captures (if this feature is available).
(m) Verify that when automatic go-around is engaged, subsequent momentary ground contact will not cause its disengagement or a mode reversion out of go-around.
(n) Structure the test program such that altitude loss during the go-around maneuver can be determined as a function of height above the ground at go-around initiation.
Altitude loss during the maneuver is directly proportional to the rate of descent on initiation of go-around.
(o) Go-around altitude loss is defined as the difference in altitude between the selection of the go-around mode and the minimum height above the ground achieved during the maneuver.
(p) If the airplane is to be approved for Category III operations, the go-around altitude loss information should be included in the AFM (see appendix 6 of AC 120-28D). The preferred format for presentation of this information in the AFM is as a cross-plot of altitude loss (ordinate of the crossplot) versus altitude of mode initiation (abscissa of the crossplot) as shown below.
Figure 181-1 Altitude Loss versus Altitude Go-Around Mode
EXAMPLE ALTITUDE LOSS DURING GO-AROUND (FT) go-around initiated at 50 feet is The expected altitude loss during between 38 feet and 45 feet.
50 40 These data are derived from tests to 30 determine altitude losses during go arounds.
They were conducted with the autopilot 20 engaged, with all engines functional and with simulated engine failures, and at all 10 approved flap settings. There is essentially no difference in results, regardless of aircraft configuration.
20 40 60 80 100
ALTITUDE AT GO-AROUND INITIATION (FT)
(q) Evaluate the go-around maneuver under conditions with automatic spoilers armed and go-around initiated at a low altitude, which results in wheel contact with the runway surface. Verify that momentary deployment of the ground spoilers under these conditions is acceptable.
(r) In addition to evaluation of speed performance to the criteria shown in Table 2 of AC 25-15, "Approval of Flight Management Systems in Transport Category Airplanes," evaluate command bar flyability, the dynamics of the airplane while following the commanded guidance, etc. The control action and flight path during the initial rotation should not be significantly different from those of a manually controlled go-around without command guidance.
(s) The go-around from any point on the approach to touchdown should not require exceptional piloting skill, alertness, or strength, and should ensure that the airplane remains above the obstacle limitation surface specified in AC 120-29A, "Criteria for Approval of Category I and Category II Weather Minima for Approach."
(t) Evaluate pitch axis go-around mode behavior with simultaneous heading select turns during climb-out.
(u) Evaluate mode transitions from go-around to other approved modes using flight director, HGS, and automatic pilot guidance (i.e., from pitch axis go-around mode to IAS Hold or Vertical Speed or Altitude Hold or VNAV; from roll axis go-around mode to Heading Select or VOR or LNAV; etc.).
(v) Evaluate all reversion modes appropriate to the design. Most speed command go-around modes will be fail-passive (or “fail-soft”) and will probably contain reversion modes.
Consult the system description, the FMEA, and the responsible system engineer for definition of the appropriate evaluation. It may be possible to perform this testing in a simulator.
(w) Evaluate adequacy of mode annunciations and controls and displays associated with the go-around maneuver.
(x) Evaluate the go-around pitch attitude limit (if applicable) for compatibility and command harmony.
(y) “Fixed Pitch Go-Around.” Missed approaches using the calibrated attitude markings on the Attitude Director Indicator (ADI) should be demonstrated to be an acceptable alternative technique for low visibility operations (CAT II & CAT III), in the event that automatic or flight director go-around modes are not available. A sufficient sample size should be collected to establish the transitional altitude loss. The target attitude for go-around (13 to 17 degrees is usually the target) should be established by the applicant. Use normal cleanup procedures. Simulate various failure conditions that would force the pilot to revert to this configuration. (e.g., simultaneous loss of autoland and go-around computation).
(z) Quantitative time-history data should be derived with an on-board data system to facilitate post-flight evaluation of performance and to provide TIR records.
(5) Instrument Landing System (ILS) Approach Mode .
(a) A complete and comprehensive description of flight test evaluation for automatic pilot and flight director system ILS approach mode approval, including HUDs, is contained in AC 120-29A, “Criteria for Approval of Category I and Category II Weather Minima for Approach,” and in AC 91-16, “Category II Operations - General Aviation Airplanes.”
Further guidance is provided below:
(b) For airworthiness approval to Category I (CAT I) minimums:
1 Conduct a series of approaches (usually 4 or more) on CAT I rated ILS beams to a radio altitude of 160 ft. (20 percent below the CAT I decision height of 200 ft).
2 Conduct the approaches with and without automatic throttles, with and without yaw damper, alternate flap setting and so forth, for all configurations and combinations of equipment for which the applicant seeks approval.
257 3 At least three CAT I beams should be included in the evaluation, one of which should exhibit very noisy localizer and glideslope characteristics.
4 Failure modes/conditions described in paragraph 181b(7)(f) of this AC, appropriate to ILS approach modes, should be conducted.
5 The definition of a successful approach is one that positions the airplane at the decision height (DH), such that the airplane can be safely landed.
(c) For airworthiness approval to Category II (CAT II) minimums for each candidate system (automatic pilot, flight director and HUD):
1 Conduct a series of approaches on CAT II rated ILS beams to a radio altitude of 100 feet.
2 For initial system approval, approximately 20 approaches (total for each affected system) are required to examine each configuration/combinations of equipment for which the applicant seeks credit.
3 At least three CAT II beams should be included in the evaluation.
4 When relatively minor changes are made to the approach control laws or when a different display (i.e., flight director instrument) is incorporated with the system, approximately 9 approaches (total for each affected system) have been found to be sufficient
(i.e., 3 each on 3 different ILS beams).
5 The approaches should be made in conditions chosen to show that the performance is satisfactory within the permitted extremes of weight, center of gravity, wind speed, localizer capture angles, glideslope captures from below and above (if appropriate) the beam, captures at various ranges from runway threshold, etc.
(d) If approval is sought for ILS approaches initiated with one engine inoperative, and with the airplane trimmed at the point of glide path intercept, the automatic flight control system should be capable of conducting the approach without further manual trimming. For airplanes with three or more engines, the loss of a second critical engine should not cause a rate of lateral deviation from the ILS course greater than 3° per second (averaged over a 5-second period), or produce hazardous attitudes.
(e) Unless it is shown that failure of the automatic pilot system to disengage during the approach, when the pilot operates the quick release control on the control wheel, is improbable, then it should be demonstrated that the pilot can control the airplane manually without operating any of the other disengagement controls.
(f) It is possible that many of the above tests can be performed in a simulator environment.
(6) Control Wheel Steering (CWS) .
(a) It should be possible for the pilot to overpower the automatic pilot system, and achieve the maximum available control surface deflection, without using forces that exceed the pilot control force limits specified in § 25.143(d).
(b) The maximum bank and pitch attitudes that could be achieved without overpowering the automatic pilot system should be limited to those necessary for the normal operation of the airplane. Typically ±35° in roll and +20° to -10° in pitch.
(c) It should be possible to carry out all normal maneuvers and to counter normal changes of trim due to change of configuration etc., within the range of flight conditions in which control wheel steering may be used, without encountering excessive discontinuities in control force that might adversely affect the flight path.
(d) The stall and stall recovery characteristics of the airplane should remain acceptable with control wheel steering in use.
(e) In showing compliance with § 25.143(f), account should be taken of such adjustment to trim as may be carried out by the automatic pilot system in the course of maneuvers that can reasonably be expected. Some alleviation may be acceptable in the case of unusually prolonged maneuvers, provided the reduced control forces would not be hazardous.
(f) If the use of this mode for takeoff and landing is to be permitted, it should be shown that:
1 Sufficient control, both in amplitude and rate, is available without encountering force discontinuities;
2 Reasonable mishandling is not hazardous (e.g., engaging the autopilot while the elevators or ailerons are held in an out-of-trim position); and
3 Runaway rates and control forces are such that the pilot can readily overpower the automatic pilot with no significant error in flight path.
(7) Failure Modes/Malfunction Tests .
(a) General .
1 Failure conditions of the system should be simulated in such a manner as to represent the overall effect, and worse case effect, of each failure condition about all axes.
2 Investigations should include the effects of any failure, and any combination of failures, not shown to be extremely improbable.
259 3 During malfunction testing, the recognition point should be that at which a line pilot in non-visual conditions may be expected to recognize the need to take action, and not that at which the test pilot does so. Recognition of the malfunction may be through the behavior of the airplane or a reliable failure warning system, and the recognition point should be identified. Control column or wheel movements alone should not be used for recognition.
4 A three-second delay added to the measured time increment between pilot recognition of an automatic pilot malfunction and pilot corrective action has been considered acceptable for climb, cruise, and descent phases of flight. Similarly, a one-second delay has been applied during ILS low approach autopilot malfunction testing. For control wheel steering (CWS) mode of operation during takeoff, go-around, and landing, no delay time need be applied.
Since present operating procedures require that at least one pilot monitor the behavior of the airplane and associated autopilot performance at all times, these delay times are considered reasonable. Finally, autoland and go-around mode hardovers (below Category II minimums) should be “no-delay” events.
5 The area of normal maneuvering flight (turning flight) has not been specified for evaluation of the effects of autopilot malfunctions, although autopilots are commonly used in turning flight. A one-second delay is considered reasonable, following pilot recognition of a malfunction, prior to undertaking corrective action.
6 It is necessary to establish satisfactory airplane response to autopilot hardovers throughout the entire certificated airspeed/altitude flight envelope. Since loading limitations of the test airplane preclude investigation of the entire flight envelope for which certification is requested, simulation results may be used to validate response in the unreachable center of gravity vs. weight combinations.
7 The nominal worst-case weight/c.g. combinations achievable by the test airplane, as predicted by simulation results, should be flight tested. The justification for selection of the weight/c.g. combinations proposed for testing should be submitted for FAA review prior to type inspection authorization (TIA) issuance.
8 The analysis should also present a comprehensive exploration of airplane “g” responses throughout the weight-c.g.-airspeed-altitude flight envelope, including worst case and envelope boundary conditions. The analysis should include flight test and simulator responses adjusted for the presence of worst-case system tolerance effects.
9 During recovery from an automatic pilot system malfunction, the pilot may overpower the autopilot or disengage it. The pilot should be able to return the airplane to its normal flight attitude under full manual control, without exceeding the loads or speed limits appropriate to the flight condition, without engaging in any dangerous maneuver during recovery, and without control forces exceeding the values given in § 25.143(d).
1 0 In general, malfunction demonstrations may be restricted to hardovers (and, possibly, automatic trim failures), unless the autopilot is intended to be engaged in the takeoff and go-around modes at altitudes below 1,000 ft. AGL (if applicable), or if the automatic
260 ILS approach mode of operation is intended to be extended below 100 ft. radio altitude in a nonfail passive configuration. In these cases, malfunction at runaway rates lower than a hardover
(i.e., slowovers) should also be investigated. Verification of failure effects may be permissible in the simulator environment.
1 1 If an automatic throttle system (ATS ) is installed, the malfunctions should be examined with and without the ATS operating.
1 2 The airplane should be instrumented such that parameters appropriate to the tests are recorded (e.g., normal acceleration, airspeed, altitude, pitch and roll attitude, automatic pilot engagement discrete).
(b) Monitored/Voted Automatic Systems .
1 Earlier autopilot certifications dealt with systems using torque-limited servos as a means of compliance. Modern systems use such techniques as electronic limiters, g-limiters, rate limiters, etc.; force voting, rate voting, etc.; monitors that disengage the system, monitors that revert to operating channels, etc.; in order to increase the system capability and meet the malfunction requirements. These systems should be expected to exhibit malfunction characteristics equal to, or better than, the torque-limited servo systems.
2 The applicant’s analysis and iron bird testing of monitored and/or voted systems should tend to reduce flight evaluation. Evaluation at selected flight conditions should be performed to substantiate proper system operation and correlation of analysis.
(c) Oscillatory Tests .
1 An investigation should be made to determine the effects of an oscillatory signal of sufficient amplitude to saturate the servo amplifier of each device that can move a control surface. The investigation should cover the range of frequencies that can be induced by a malfunction of the automatic pilot system and systems functionally connected to it, including an open circuit in a feedback loop. The investigated frequency range should include the highest frequency that results in apparent movement of the system driving the control surface to the lowest elastic or rigid body response frequency of the airplane. Frequencies less than 0.2 Hz may, however, be excluded from consideration. The investigation should also cover the normal speed and configuration ranges of the airplane. The results of this investigation should show that the peak loads imposed on the parts of the airplane by the application of the oscillatory signal are within the limit loads for these parts. Autopilot systems that contain integral performance envelope limiting cut-out functions may be exempt from this requirement, provided the integrity of the monitor is demonstrated in the normal way.
2 The investigation may be accomplished largely through analysis with sufficient flight data to verify the analytical studies, or largely through flight tests with analytical studies extending the flight data to the conditions that impose the highest percentage of limit load to the parts.
261 3 When flight tests are conducted in which the signal frequency is continuously swept through a range, the rate of frequency change should be slow enough to permit determination of the amplitude of response of any part under steady frequency oscillation at any critical frequency within the test range.
(d) Climb, Cruise and Descent Flight Regimes .
1 The more critical of the following should be induced into the automatic pilot system. If autothrottles are installed, they should be operating, and vertical gyro mechanical failures should not be considered:
(aa) A signal about any axis equivalent to the cumulative effect of any single failure, including autotrim, if installed.
(bb) The combined signals about all affected axes, if multiple axis failures can result from the malfunction of any single component.
2 Corrective action should not be initiated until three-seconds after the pilot has become aware, either through the behavior of the airplane or a reliable failure warning system, that a malfunction has occurred.
3 The simulated failure and the subsequent corrective action should not result in normal accelerations below zero g or above 2 g’s, speeds beyond VFC/MFC, or result in dangerous dynamic conditions or deviations from the flight path. The positive “g” limitation may be increased up to the positive design limit maneuvering load factor, provided adequate analysis and flight test measurements are conducted to establish that no resultant airplane load is beyond limit loads for the structure, including a critical assessment and consideration of the effects of structural loading parameter variations, (i.e., center of gravity, load distribution, control system variations, etc.). Analysis alone may be used to establish that limit loads are not exceeded where the airplane loads are in the linear range of loading, (i.e., aerodynamic coefficients for the flight condition are adequately established and no significant nonlinear air loading exists). If significant nonlinear effects could exist (e.g., buffet loads), flight loads survey measurements may be necessary to substantiate that the limit loads are not exceeded.
4 The power or thrust for climb should be the most critical of that used:
(aa) In the performance climb demonstrations;
(bb) In the longitudinal stability tests; or
(cc) For normal operational speeds.
5 The altitude loss for the cruise condition is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
(e) Maneuvering Flight .
1 Maneuvering flight tests should include turns with the malfunctions introduced when maximum bank angles for normal operation of the system have been established, and in the critical airplane configuration and stages of flight likely to be encountered when using the automatic pilot.
2 A one second delay time following pilot recognition of the malfunction, through the behavior of the airplane or a reliable failure warning system, should be used for maneuvering flight malfunction testing.
3 The altitude loss, for maneuvering flight testing, is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
(f) Automatic Pilot Instrument Landing System (ILS) Approach .
1 All ILS approach malfunctions should be conducted on an ILS facility having a 3-degree glide path.
2 Throughout an approach, no signal or combination of signals simulating the cumulative effect of any single failure or malfunction in the automatic pilot system, except vertical gyro mechanical failures, should provide hazardous deviations from the flight path or any degree of loss of control if corrective action is initiated one second after the pilot has become alerted to the malfunction.
3 The airplane should be flown down the ILS in the configuration and at the approach speed specified by the applicant for approach. Simulated autopilot malfunctions should be induced at critical points along the ILS, taking into consideration all possible variations in autopilot sensitivity and authority. The malfunctions should be induced about each axis. A simulator may be adequate for this test.
4 Automatic pilot system ILS approach malfunctions should be conducted at a safe altitude in “under-the-hood” simulated IMC.
5 The automatic pilot system should be capable of continuing the approach without retrimming the airplane after failure of the critical engine; however, a change in heading at a rate not greater than 3 degrees per second (averaged over a five-second period) would be acceptable. The rate of heading change encountered should be described in the normal or abnormal procedures section of the AFM, whichever is appropriate. The engine failure should not produce hazardous attitudes.
6 If approval is sought for ILS approaches initiated with one engine inoperative and the airplane trimmed at glideslope intercept, the automatic pilot should be capable of conducting the approach without further trimming. For airplanes with three or more
263 engines, the loss of a second critical engine should not cause a rate of lateral deviation from the ILS course greater than 3 degrees per second, or produce hazardous attitudes.
7 For coupled and uncoupled approaches, recoveries should be initiated one second after the pilot recognizes the autopilot failure under simulated IFR conditions. The airplane should be on glideslope center when malfunctions are introduced. The altitude loss, measured from the glideslope path to a point where maximum vertical deviation from glideslope exists, should be recorded and presented in the AFM. This is the critical altitude loss from the standpoint of obstacle and ground clearance.
8 The method used to measure altitude loss during (ILS) approach should be shown to be accurate to within ±5 ft. for both coupled and uncoupled approaches, except that for uncoupled approaches where an applicant demonstrates autopilot malfunctions at Category I minimums, and elects to accept a restriction against the use of the autopilot below those minimums, he need not show that the method of measuring altitude loss meets the ±5 ft.
accuracy requirement.
9 A malfunction of the autopilot during a coupled ILS approach should not place the airplane in an attitude that would preclude conducting a satisfactory go-around or landing.
1 0 The flight path and altitude loss data, determined in accordance with the procedures described in this section, should be used to substantiate that if a hardover were to occur at 80 percent of the minimum decision height, the lowest part of the airplane will not penetrate the 29:1 minimum operational tolerance line that extends upward from a point 15 ft.
above the runway threshold. It would, however, be permissible for the wheels to make contact with the runway in either a landing or go-around recovery maneuver.
(8) Airplane Flight Manual Information . The following information should be placed in the AFM:
(a) Operating Limitations Section: airspeed and other applicable operating limitations for use with the autopilot.
(b) Operating Procedures Section: the normal operation information.
(c) Emergency Operating Procedures Section: A statement of the maximum altitude loss experienced during malfunction tests in the cruise and maneuvering flight regimes.
A statement of the altitude loss should be provided. Further, it should be stated that a 3-degree glideslope was used, and the altitude loss was measured from the glideslope path to a point where maximum vertical deviation from the glideslope exists.
[182. - 185.] [Reserved]
264 Section 3. Electrical Systems and Equipment
186. General - § 25.1351.
a. Explanation . Section 25.1351(a) requires that the electrical generating capacity, and number and kinds of power sources, be determined by an electrical load analysis, and meet the requirements of § 25.1309.
b. Procedures .
(1) Section 25.1351(a) - Electrical System Capacity . Section 25.1351(a) requires the generating capacity, and number and kinds of power sources, to be determined by an electrical loads analysis and meet the requirements of § 25.1309. Additionally, verify by flight test that cooling is satisfactory to maintain component temperatures within the manufacturer’s limits, both on the ground and in flight, with the electrical system operating at maximum limit load.
(2) Section 25.1351(b)(1) - Electrical Power Configuration .
(a) Verify that electrical power sour ces function properly when independent and when connected in combination.
(b) For airplanes with autoland capability, verify proper electrical power reconfiguration for each available autoland mode.
(c) Verify that no hazardous airplane systems reaction occurs, to a partial loss of the electrical distribution system by simulating loss of individual busses. Simulate loss of individual busses by opening circuit breakers/relays.
(d) Verify proper transfer of electrical power between the different power sources
(i.e., external power, APU, engines).
(3) Section 25.1351(b)(2) - Failure of Power Source . Verify proper operation of system during simulated power failures by flight test functional demonstrations. The applicant must show by design analysis or laboratory demonstration, that no failure or malfunction of any power source, including the battery can create a hazard or impair the ability of remaining sources to supply essential loads.
(4) Section 25.1351(b)(3) - System Voltage and Frequency . For probable operating conditions, verify that system voltage and frequency, as applicable, at the terminals of all essential load equipment can be maintained within the limits for which the equipment is designed. This may be accomplished in a laboratory environment.
(5) Section 25.1351(b)(4) - System Transients . The applicant must show by design analysis, laboratory demonstration, and/or flight demonstration that system transients due to switching, fault clearing, or other causes during normal operations do not make essential loads