276 3 The simulated failure and the subsequent corrective action should not result in accelerations normal to the flight path below zero g or above 2 g, speeds beyond VFC/MFC, or result in dangerous dynamic conditions or deviations from the flight path. The positive “g” limitation may be increased up to the positive design limit maneuvering load factor, provided adequate analysis and flight test measurements are conducted to establish that no resultant airplane load is beyond limit loads for the structure, including a critical assessment and consideration of the effects of structural loading parameter variations, (i.e., c.g., load distribution, control system variations, etc.). Analysis alone may be used to establish that limit loads are not exceeded where the airplane loads are in the linear range of loading, (i.e., aerodynamic coefficients for the flight condition are adequately established and no significant nonlinear air loading exists). If significant nonlinear effects could exist (e.g., buffet loads), flight loads survey measurements may be necessary to substantiate that the limit loads are not exceeded.
4 The power or thrust for climb should be the most critical of that used:
(aa) In the performance climb demonstrations;
(bb) In the longitudinal stability tests; or
(cc) For normal operational speeds.
5 The altitude loss for the cruise condition is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
(d) Maneuvering Flight.
1 Maneuvering flight tests should include turns with the malfunctions introduced when maximum bank angles for normal operation of the system have been established, and in the critical airplane configuration and stages of flight likely to be encountered when using the automatic pilot.
2 A one second delay time following pilot recognition of the malfunction, through the behavior of the airplane or a reliable failure warning system, should be used for maneuvering flight malfunction testing.
3 The altitude loss, for maneuvering flight testing, is the difference between the observed altitude at the time the malfunction is introduced, and the lowest altitude observed in the recovery maneuver.
(e) Approach. There are two types of approach operations to consider – an approach with vertical path reference and one without vertical path reference. The approach with vertical path reference should be assessed against ground-based criteria using a deviation profile assessment. A height loss assessment should be used for approaches without vertical path reference.
277 1 Fault Demonstration Process. First determine the worst-case malfunction for each vertical flight path mode that may be used to conduct an approach (e.g., ILS, MLS, GLS, flight management system/RNAV, vertical speed, flight path angle), based on factors such as the following:
(aa) Failure conditions identified by the system safety assessment.
(bb) System characteristics such as variations in authority or monitor operation.
(cc) Mitigation provided by any system alerts.
(dd) Aircraft flight characteristics relevant to failure recognition.
2 Once the worst-case malfunction has been determined, flight tests of the worst-case malfunction should be flown in representative conditions (for example, coupled to an ILS), with the malfunction being initiated at a safe height. The pilot should not initiate recovery from the malfunction until one second after the recognition point. The delay is intended to simulate the variability in response to effectively a “hands off” condition. It is expected that the pilot will follow through on the controls until the recovery is initiated.
3 Assessment of Approach With Vertical Path Reference. Figure 181-2, “Deviation of Profile Method,” depicts the deviation profile method. The first step is to identify the deviation profile from the worst-case malfunction. The next step is to “slide” the deviation profile down the glidepath, until it is tangential to the 1:29 line or the runway. The failure condition contribution to the minimum use height (MUH)-approach may be determined from the geometry of the airplane wheel height determined by the deviation profile, relative to the 1:29 line intersecting a point 15 feet above the threshold.
NOTE: The MUH-approach is based on the recovery point for the following reasons:
(aa) It is assumed that in service the pilot will be “hands off” until the autopilot is disengaged at the MUH in normal operation.
(bb) The test technique assumes a worst-case based on the pilot being “hands off” from the point of malfunction initiation to the point of recovery.
(cc) A failure occurring later in the approach than the point of initiation of the worst-case malfunction described above is therefore assumed to be recovered earlier and in consequence to be less severe.
4 Assessment of Approach Without Vertical Path Reference. Figure 181-3 depicts the height loss method. A descent path of 3 degrees, with nominal approach speed, should be used unless the autopilot is to be approved for significantly steeper descents. The vertical height loss is determined by the deviation of the aircraft wheel height relative to the nominal wheel flight path.
ILS GP
3. Initiation of Manual Recovery action by pilot 4. Point on Normal/Fault free Wheel path at which autopilot is Wheel path, tangent 15.2m 4.6m Threshold
2. Failure Recognition by pilot Path of airplane wheels as a result of failure 4 Threshold Height
1. Failure Initiation disengaged Path of airplane wheels as a result of failure 1 sec. Minimum Use Height (MUH) 1 sec. 3° Nominal ILS Glideslope Normal/Fault Free Wheel Path 1:29 Figure 181-2 Deviation Profile Method 278
1. Failure Initiation 2. Failure Recognition by pilot 3. Initiation of Manual Recovery action by pilot Path of airplane wheels as a result of failure Height Loss Normal/Fault Free Wheel Path Tangential Wheel Height Figure 181-3 Height Loss Method 279
(f) Autopilot Override.
1 Initial Tests. The initial tests to demonstrate compliance should be accomplished at an intermediate altitude and airspeed, e.g., 15,000 feet MSL and 250 knots.
With the autopilot engaged in Altitude Hold, the pilot should apply a low force to the control wheel (or equivalent) and verify that the automatic trim system does not produce motion resulting in a hazardous condition.
(aa) Automatic Disengagement. Disengagement caused by flightcrew override should be verified by applying an input on the control wheel (or equivalent) to each axis for which the FGS is designed to disengage, that is, the pitch and roll yoke, or the rudder pedals (if applicable). The pilot should gradually increase the applied force to the control wheel (or equivalent) until the autopilot disengages. When the autopilot disengagement occurs, observe the transient response of the airplane. Verify that the transient response is no more than minor as required by § 25.1329(d). The inputs by the pilot should increase for each test case to a point where the input is sharp and forceful, so that the FGS can immediately be disengaged for the flightcrew to assume manual control of the airplane.
(bb) Non-Automatic Disengagement. If the autopilot is designed such that it does not automatically disengage during an autopilot override—and instead provides a flight deck alert to mitigate any potentially hazardous conditions—the timeliness and effectiveness of this alert should be evaluated. The pilot should follow the evaluation procedure identified above until such time as an alert is provided. At that time, the pilot should respond to the alert in a responsive manner consistent with the level of the alert (that is, a caution, a warning) and with the appropriate flightcrew procedure defined for that alert. When the autopilot is manually disengaged, observe the transient response of the airplane and verify that the transient response is no more than minor as required by § 25.1329(d).
(2) Repeated Test Conditions. After the initial tests have been successfully completed, the above tests should be repeated at higher altitudes and airspeeds until reaching MMO at high cruise altitudes.
(10) Airplane Flight Manual Information. The following information should be provided in the AFM:
(a) Operating Limitations Section: airspeed and other applicable operating limitations for use with the autopilot.
(b) Operating Procedures Section: the normal operation information.
(c) Non-Normal/Emergency Operating Procedures Section: A statement of the maximum altitude loss experienced during malfunction tests in the cruise and maneuvering flight regimes. A statement of the altitude loss should be provided. Further, it should be stated that a 3-degree glideslope was used, and the altitude loss was measured from the glideslope path to a point where maximum vertical deviation from the glideslope exists.
281 [182. - 185.] [Reserved]
Section 3. Electrical Systems and Equipment
186. General - § 25.1351.
a. Explanation. Section 25.1351(a) requires that the electrical generating capacity, and number and kinds of power sources, be determined by an electrical load analysis, and meet the requirements of § 25.1309.
b. Procedures.
(1) Section 25.1351(a) - Electrical System Capacity. Section 25.1351(a) requires the generating capacity, and number and kinds of power sources, to be determined by an electrical loads analysis and meet the requirements of § 25.1309. Additionally, verify by flight test that cooling is satisfactory to maintain component temperatures within the manufacturer’s limits, both on the ground and in flight, with the electrical system operating at maximum limit load.
(2) Section 25.1351(b)(1) - Electrical Power Configuration.
(a) Verify that electrical power sources function properly when independent and when connected in combination.
(b) For airplanes with autoland capability, verify proper electrical power reconfiguration for each available autoland mode.
(c) Verify that no hazardous airplane systems reaction occurs, to a partial loss of the electrical distribution system by simulating loss of individual busses. Simulate loss of individual busses by opening circuit breakers/relays.
(d) Verify proper transfer of electrical power between the different power sources
(i.e., external power, APU, engines).
(3) Section 25.1351(b)(2) - Failure of Power Source. Verify proper operation of system during simulated power failures by flight test functional demonstrations. The applicant must show by design analysis or laboratory demonstration, that no failure or malfunction of any power source, including the battery can create a hazard or impair the ability of remaining sources to supply essential loads.
(4) Section 25.1351(b)(3) - System Voltage and Frequency. For probable operating conditions, verify that system voltage and frequency, as applicable, at the terminals of all essential load equipment can be maintained within the limits for which the equipment is designed. This may be accomplished in a laboratory environment.
(5) Section 25.1351(b)(4) - System Transients. The applicant must show by design analysis, laboratory demonstration, and/or flight demonstration that system transients due to switching, fault clearing, or other causes during normal operations do not make essential loads inoperative, and do not cause a smoke or fire hazard. Flight test recordings may be useful to verify laboratory demonstrations of system transients and electromagnetic interference (EMI) during normal operations.
(6) Section 25.1351(b)(5) - Power Source Disconnection.
(a) Verify that there are means accessible in flight, to the appropriate crewmembers, for the individual and collective disconnection of the electrical power sources from the system.
(b) Demonstrate that the airplane can be flown with one less generator than allowed by the MMEL. Also verify that prior to switching off the non-essential electrical loads specified in the AFM, the remaining generators’ short term (up to 5 minutes) capacity is not exceeded.
(7) Section 25.1351(b)(6) - Power Source Indicators.
(a) Verify that there are means to indicate, to the appropriate crewmembers, the generating system quantities essential for the safe operation of the system, such as the voltage and current supplied by each power source, if appropriate to type of aircraft, i.e., glass cockpit design may provide information on multi-function display (MFD), electronic centralized aircraft monitor (ECAM), engine indicating and crew alerting system (EICAS), etc.)
(b) Verify proper operation of electrical power system warning, caution, and advisory indications, if any, and that these indications comply with §§ 25.1309(c) and 25.1322.
(8) Section 25.1351(c) - External Power. If provisions are made for connecting external power to the airplane, and that external power can be electrically connected to equipment other than that used for engine starting, verify that a means is provided to ensure that no external power supply having a reverse polarity, a reverse phase sequence, overvoltage, or reverse phase/neutral can supply power to the airplane’s electrical system. This demonstration may be accomplished in a laboratory environment.
(9) Section 25.1351(d) - Operation Without Normal Electrical Power. The applicant must demonstrate that the airplane can be operated safely in visual flight rules (VFR) conditions, for a period of not less than five minutes, with the normal electrical power (electrical power sources excluding the battery) inoperative, with critical type fuel (from the standpoint of flameout and restart capability), and with the airplane initially at the maximum certificated altitude.
(10) Emergency Electrical Power System.
(a) For airplanes with a type certification basis that includes Amendment 25-23, the FAA has applied a general policy that following total failure of the electrical power system, if not shown to be extremely improbable, emergency electrical power should be available to power instrument displays, systems, equipment, or parts of the airplane essential for safety of flight during IMC operations for at least 30 minutes. It may also be advisable to check that in the event when normal operation is reestablished following the use of emergency power devices, such devices can withstand, or at least do not adversely affect, the subsequent reversion to “normal” operation.
1 Thirty (30)-Minute Requirement Test. Accomplish ground and/or flight testing to verify that the main battery/non time-limited power source (e.g., auxiliary power unit (APU), ram air turbine, pneumatic or hydraulic motor, etc.) is sufficient to power the essential loads required for safety of flight during IMC operations for at least 30 minutes. If the emergency power is provided by a non time-limited power source, the main battery capacity should be sufficient for at least 5 minutes to show compliance with § 25.1351(d). Essential loads for safety of flight during IMC operations are considered to include the following:
(aa) Those essential for continued safe flight and landing during visual meteorological conditions (VMC) operations.
(bb) One display of attitude, direction, airspeed and altitude as specifically stated in § 25.1333(b), a free-air temperature indicator, and pitot/static heat capability, if required.
(cc) Communication, intercommunication, and navigation capability (for IMC operations) necessary cockpit and instrument lighting, and any other instrument displays, systems, equipment, or parts of the airplane that are necessary to safely complete the flight.
2 Perform a VMC approach and landing with the airplane powered with emergency electrical power only. Verify acceptable operation of the emergency equipment.
3 Perform a simulated night IMC approach and landing with the airplane powered with emergency electrical power only. Verify acceptable visibility and operation of the emergency equipment. This test can be accomplished on a simulator.
(b) Electrical Attitude, Altitude, Direction, and Airspeed Systems Using Battery Standby Power.
1 The FAA has published additional policy that applies to certification of flight instrument installations where: (1) all displays of any of the essential flight information
(e.g., altitude, attitude, airspeed, or direction) require electrical power; and (2) the back-up source of electrical power is time-limited. See Policy Statement PS-ANM100-2001-116, “Policy Statement with respect to All Electrical Attitude, Altitude, Direction and Airspeed Systems using Battery Standby Power,” dated April 27, 2001.
2 Flight evaluations of such installations should be used to make sure that all the essential safety related flight instrument parameters are displayed, that the pilots do not have to take any action to display them when normal power is lost, and that the standby display(s) can be effectively used for all flight tasks required for safe flight and landing.
187. Electrical Equipment and Installations - § 25.1353. [Reserved]
188. Distribution System - § 25.1355.
a. Explanation. Section 25.1355(a) defines the distribution system, including the distribution busses, their associated feeders, and each control and protective device.
b. Procedures. Section 25.1355(c) - Independent Power Sources. For equipment or systems that are required to have two independent sources of electrical power, verify by airplane demonstration that in the event of a failure of one power source for such equipment or system, another power source (including its separate feeder) is automatically provided or can be manually selected to maintain equipment or system operation.
189. Circuit Protective Devices - § 25.1357. [Reserved]
190. Electrical System Tests - § 25.1363.
a. Explanation. Laboratory tests are conducted to verify that the control, regulation, protection, and automatic operation of the electrical system comply with §§ 25.1351 through
25.1357. Laboratory tests must be conducted on a mockup using the same type and length of feeder wires, and generating equipment that will be installed in the airplane. Additionally, the generator drives must simulate the actual prime movers on the airplane with respect to their reaction to generator loading, including loading due to faults. Section 25.1363(b) states that for each flight condition that cannot be adequately simulated in the laboratory or by ground tests on the airplane, a flight test must be conducted.
b. Procedures. Negative Acceleration Performance - Verify that no hazardous malfunctions of the electrical power system occur when the airplane is operated at the negative accelerations within the flight envelope prescribed in § 25.333. This should be shown for the greatest duration expected for the acceleration. This test is normally conducted in conjunction with the engine negative acceleration test to comply with § 25.943.
285 Section 4. Lights
191. Instrument Lights - § 25.1381.
a. Explanation. None.
b. Procedure. Under actual or simulated nighttime conditions, evaluate instrument lighting for the following characteristics:
(1) Illumination of adequate intensity is provided for all appropriate cockpit instruments/controls/equipment.
(2) Illumination is of appropriate color, intensity is evenly distributed, and is free of objectionable flicker, glare, or reflection.
(3) Dimming capability allows smoothly adjustable illumination intensity between appropriate limits.
192. Landing Lights - § 25.1383.
a. Explanation. None
b. Procedure. The landing lights should be evaluated to determine that they:
(1) Are aimed properly, provide sufficient intensity to facilitate night landings, and are acceptable at different pitch attitudes during landing approach with various c.g., flap settings and airspeed;
(2) Are not a source of objectionable glare or halation; and
(3) Are functional in MMEL configurations and during operations in adverse weather.
193. Position Light System Installation - § 25.1385.
a. Explanation. Section 25.1385(a) requires the position light system to comply with detailed technical specifications contained in §§ 25.1387 through 25.1397. These sections define location, color, visibility, and intensity requirements with considerable precision. An in depth examination of the installed position light system with regard to these requirements is not necessarily considered appropriate or within the scope of a flight test evaluation, unless it becomes apparent while accomplishing the following procedures that further examination is warranted.
b. Procedures.
(1) Operate the position light system. Verify that general locations and color are as prescribed in § 25.1385(b) and (c).
(2) Verify that position light illumination does not cause objectionable glare to the flightcrew.
[194. - 200.] [Reserved]
201. Anti-Collision Light System - § 25.1401.
a. Explanation.
(1) Section 25.1401(a)(2) requires the anti-collision light system to comply with the detailed specifications contained in § 25.1401(b) through (f). These sections define coverage, color, flash rate, and intensity requirements with some precision. An in depth examination of the installed anti-collision system, with regard to all of these requirements, is not necessarily considered appropriate or within the scope of a flight test evaluation, unless it becomes apparent while accomplishing the following procedures that further examination is warranted.
(2) Policy statement ANM-111-06-001, “Modifications Which Impact Airplane Exterior Lighting,” dated May 14, 2007, specifies that applicants need to perform an analysis for airplane modifications involving external antenna installations in order to evaluate compliance to § 25.1401. The analysis should include an evaluation of the impact of the new installation on the anticollision light system and its associated master minimum equipment list (MMEL) dispatch relief.
b. Procedures.
(1) Operate the anti-collision light system. Verify that one or more red or white lights are installed in locations that appear to provide the required visibility and which flash at the appropriate rates.
(2) Verify that the anti-collision lights are not a source of objectionable glare or halation, to the flightcrew.
(3) Evaluate anti-collision lights during flight in clouds.
202. Wing Icing Detection Lights - § 25.1403.
a. Explanation. If the airplane is intended to be certificated for night flight into known icing conditions, a means for visually or otherwise determining the extent of icing on critical surfaces must be provided.
b. Procedures. The wing icing detection lights, if required, should be evaluated to determine that they:
(1) Are aimed properly toward the appropriate surfaces, and are of sufficient intensity for required illumination.
(2) Are not a source of objectionable glare, reflection, or halation.
Section 5. Safety Equipment
[203. - 207.] [Reserved]
Section 6. Miscellaneous Equipment
208. Electronic Equipment - § 25.1431.
a. Explanation. Section 25.1431(d) requires verification that any electronic equipment will not cause essential loads to become inoperative as a result of electrical power supply transients or transients from other causes. Although this requirement explicitly addresses electrical power supply transients, this requirement is also implicit in other part 25 requirements, specifically:
(1) Section 25.1310(a) (Power source capacity and distribution), which states that each installation whose functioning is required and that requires a power supply is considered an “essential load” on the power supply. It requires that the power sources and the system must be able to continue to supply power loads under probable critical operating combinations and for probable durations;
(2) Section 25.1351(b) (Electrical systems and equipment-- General), which requires that electrical generating systems must be designed so that no failure or malfunction of any power source can create a hazard or impair the ability of remaining sources to supply essential loads; and
(3) Section 25.1353(a) (Electrical equipment and installations), which requires that electrical equipment and controls must be installed so that operation of any one unit or system of units will not adversely affect the simultaneous operation of any other electrical unit or system essential to safe operation.
b. Procedures.
(1) Evaluate the possibility of interaction between different systems of communications and navigation equipment. Momentary deflection or flicker can be permitted if it does not result in any deviation to the aircraft flight path when flying a coupled navigation mode. (Flicker