10/27/14 A C 25.1329-1C
111. Limitations. The AFM limitations section presents those FGS operating limitations appropriate to the airplane model as established in the course of the type certification process .
T he FGS operational limitations listed in the AFM (should any exist) must specify a ny c onfiguration/envelope restrictions . See §§ 25.1581(a)(1) and 25.1583.
112. Non-Normal/Emergency Procedures . The AFM must include non-normal or emergenc y pr ocedures appropriate to the FGS identified during the certification program . See § 25.1581(a)(1) and § 25.1585(a)(2) and (a)(3).
113. Normal Procedures.
a. Documentation of normal procedures. The normal procedures for use of the FGS must be documented in the AFM. See §§25.1581(a)(1) and 25.1585(a)(1). These procedures should be demonstrated during the type certification process.
b. Maximum displacement deviation. In lieu of specification of minimum engagement altitude(s) or height(s) (see paragraph 110 of this AC), the AFM may alternately specify “maximum displacement deviations” from a specified takeoff flight path or from a specified approach profile. This information may be based on typical departure or approach flight paths suited for the aircraft type and for failure conditions that are determined applicable to the type of FGS and modes suitable for use.
c. Procedures for use of FGS in icing conditions. The flight manual should include an y ne cessary procedures for the use of the FGS in icing conditions (including moderate and heavy icing conditions). In particular, the procedures should include any necessary changes in operating speeds, required either operationally or as a result of relevant design features of the speed protection function of the FGS. For example, variations in minimum speeds as a function of de/anti-icing system selection, speed increments d uring approach, and landing in turbulence should be part of the documented procedures.
d. Aircraft with published FCOMs. The AFMs for aircraft for which the manufacturer has published a FCOM must contain essential information on normal operating procedures that are considered unique to the operation of the FGS for the aircraft type or are otherwise necessary for safe operation. See § 25.1581(a)(2). FGS description and integration with the overall flight deck design philosophy, specification, and operational procedures that are normally associated with FGSs should be included in the FCOM . If applicable, a FCOM may contain the “maximum displacement deviation” information described in paragraph 110 of this AC in either numeric or graphic form.
e. Aircraft without published FCOMs. For aircraft that rely on the AFM as the sol e ope rating manual, the AFM must contain operating information sufficient for flightcrew reference. See § 25.1581(a)(2). The FGS description and integration with the overall flight deck design philosophy, specification, and operational procedures normally associated with FGSs, should be made available so that an appropriately trained flightcrew may operate the FGS under normal conditions.
10/27/14 A C 25.1329-1C Append ix A APPENDIX A. SAFETY ASSESSMENT
1. General. This appendix provides material that may be useful in supporting the safet y a ssessment activities identified in Chapter 8 of this AC.
2. Identification of Failure Conditions.
a. The following cases should be considered for applicability when establishing failure conditions, as indicated in Chapter 8 of this AC.
(1) Loss of autopilot in single or multiple axes.
(2) Loss of guidance in single or multiple axes.
(3) Loss of thrust control.
(4) Partial loss or degradation of autopilot function.
(5) Unintended autopilot commands in a single axis or multiple axes simultaneousl y ( for example, hardover, slowover, and oscillatory failure modes).
(6) Unintended guidance commands in a single axis or multiple axes.
(7) Unintended thrust control.
(8) A sustained out-of-trim condition with the autopilot engaged without an alert.
(9) Autopilot disengagement in an out -of-trim condition.
(10) Autopilot disengagement without a warning.
(11) Inability to disengage the autopilot or autothrust function.
(12) Uncommanded engagement of an autopilot or autothrust.
(13) Jamming or loading of primary flight controls.
(14) Unintended thrust asymmetry.
b. A typical failure condition statement may be of the form:
‘[Failure]’ during ‘[Phase of Flight]’ that ‘[Effect]’ when ‘[Mitigation Consideration]’
c. Failure conditions may result from failures within the FGS or from failure associate d w ith aircraft interfacing systems or components (for example, NAV receivers, attitude heading reference systems, FMS, hydraulics, electrical systems, etc.).
A-1
10/27/14 A C 25.1329-1C App endix A
3. Considerations when Assessing the Severity of Failure Condition Effects.
a. Complete definition of failure condition. The “failure condition” definition is complete when the effects resulting from the failure are identified . The complete definition of the “failure condition” and its effect will then support the subsequent failure condition hazard classification.
b. Factors to consider. When assessing the effect that results from a failure, the following factors should be considered for various phases of flight:
(1) The impact of the loss of control or unintended control on the structural integrity of the airplane as a result of simple loading or as a result of excitation of aerodynamic or structural modes—both at the time of occurrence a nd while the flight continues.
(2) Implications of the airplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on flightcrew performance.
(3) Degradation in the stability or other flying qualities of the airplane.
(4) The duration of the condition.
(5) The aircraft configuration.
(6) The aircraft motion cues that will be used by the flightcrew for recognition.
(7) Availability, level, and type of alerting provided to the flightcrew.
(8) Expected flightcrew corrective actio n on detection of the failure.
c. Possible characteristics of failure conditions. Failure conditions may include the following characteristics:
(1) “Hardover” effects. Typically, these are considered significant and are readily detectable by the flightcrew, based on the resulting aircraft motion or guidance cues.
(2) “Slowover” effects. Typically, these are not readily detected by the flightcrew . The effect may involve departures from the intended flight path that are not initially detectable by aircraft motion alone and may be detectable only by motion cues when a significant flight path deviation has occurred or by an appropriate flightcrew alert.
(3) “Oscillatory” effects . Typically, these are repetitive motions or guidance conditions not related to intended guidance or control . The magnitude, period, and duration of the condition and any mitigation considerations will determine the final effect.
(4) “Loss of” effects. Typically, this is the removal of control, guidance , or f unctionality that may have an immediate effect or may not be immediately apparent to the flightcrew.
A-2
10/27/14 A C 25.1329-1C Appe ndix A Note: Chapter 9 of this AC provides guidance on crew recognition considerations.
4. Failure Condition Classification. The following are examples of the type of failure condition effects that have been identified in previous airplane certification programs . The specific number and type of failure condition may vary with airplane type, airplane system architecture, and FGS design philosophy (for example, failure detection, redundanc y m anagement, failure annunciation, etc.).
a. Catastrophic failure conditions. The following effects have been assessed as c atastrophic in previous airplane certification programs:
(1) A load on any part of the primary structure sufficient to cause a structural failure , preventing safe flight and landing.
(2) Unrecoverable loss of flight path control.
(3) Exceedance of VDF/MDF (demonstrated flight dive speed/demonstrated flight dive Mach).
(4) Flutter or vibration that causes a structural failure , preventing safe flight and landing.
(5) A temporary loss of control (for example, stall) where the flightcrew is unable t o p revent contact with obstacles or terrain.
(6) Deviations in flight path from which the flightcrew are unable to prevent contact with obstacles, terrain, or other aircraft.
b. Hazardous failure conditions. The following effects have been assessed as hazardous in previous airplane certification programs:
(1) Exceedance of an airspeed halfway between V MO (maximum operating limit speed) and VDF or a Mach number halfway between M MO (maximum operating limit Mach) and MDF.
(2) A stall, even if the flightcrew is able to recover safe flight path control.
(3) A load factor less than zero.
(4) Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 1000 ft. (304.8 meters above an applicable airport elevation).
(5) Degradation of the flying qualities of the airplane that excessively increases flightcrew workload.
(6) Failure that could result in a rejected takeoff (RTO) and high speed overrun (for example, 60 knots).
A-3
10/27/14 A C 25.1329-1C Append ix A
(7) A flight path deviation that requires a severe maneuver to prevent contact with an obstacle, terrain, or other aircraft.
Note: Severe maneuver includes risk of serious injury or death of a small number of occupants.
c. Major failure conditions. The following effects have been assessed as “major” in previous airplane certification programs:
(1) A flight path deviation, including the required recovery maneuver, which ma y r esult in passenger injuries . Consideration should be given to phases of flight where the occupants may reasonably be moving about the airplane or be serving or consuming hot drinks .
See appendix B for the definition of significant transient.
(2) Degradation of the flying qualities of the airplane that significantly increase s flightcrew workload.
A-4
Appendix B AP PENDIX B. DEFINITIONS The following definitions apply to the requirements of § 25.1329 and the guidance material provided in this AC. You should not assume that these definitions apply to the same or similar terms used in other regulations or ACs . Terms for which standard dictionary definitions apply are not defined in this AC.
Table B-1. Terms and Definitions Abnormal Condition See Non-Normal Condition.
Alert A generic term used to describe a flight deck indication meant to attract the attention of the flightcrew to a non -normal operational or airplane system condition without implying the degree or level of urgency for recognition and corrective action by the crew. Warnings, cautions, and advisories are considered alerts.
Arm A condition where the intent to transition to a new mode or state has been established but the criteria necessary to make that transition has not been satisfied.
Autopilot The autopilot function provides automatic control of the airplane, typically in pitch, roll, and yaw . The term includes the sensors, computers, power supplies, servo-motors/actuators , and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system . Any part of the autopilot system that remains connected to the primary flight controls when the autopilot is not in use is regarded as a part of the primary flight controls.
Term Definition Advisory Crew awareness is required , and subsequent crew action may be required.
Analysis The terms “analysis” and “assessment” are used throughout .
Each has a broad definition, and the two terms are to some extent interchangeable. However, the term analysis generally implies a more specific, more detailed evaluation, while the term assessment may be a more general or broader evaluation , but may include one or more types of analysis.
Assessment See the definition of analysis above.
B-1
Appendix B Term Caution A flight deck indication that alerts the flightcrew to a non-normal operational or airplane system condition that requires immediate crew awareness . Subsequent pilot corrective compensatory action will be required.
Complex A system is complex when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods.
Control Wheel Steering A flight guidance system (FGS) function which, when (CWS) engaged, enables the pilot/first officer to manually fly the airplane by positioning the flight control surfaces using the autopilot servos. The positions of the flight deck controls (for example, control column, control wheel) are determined by the FGS, which converts them into autopilot servo commands . The autopilot servos, in turn, drive the appropriate flight control surfaces.
Engage A steady state that exists when a flightcrew request for mode or system functionality has been satisfied.
Definition Autothrust The autothrust function provides automatic control of the thrust of the airplane. The term includes the sensors, c omputers, power supplies, servo-motors/actuators , and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system. Any part of the autothrust that remains connected to the engine controls when the autothrust is not in use is regarded as a part of the engine control system.
Cognitive Task Analysis An analysis that focuses on the mental processes, skills, strategies, and use of information required for task performance.
Conformal Positioned and scaled with respect to the outside view.
Conventional A system is considered to be conventional if its functionality, the technological means used to implement its functionality, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used.
Error An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
B-2
Appendix B Term Failure An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Note: Errors may cause failures, but are not considered to be failures.
Fail Operational System A system capable of completing an operation, following the failure of any single element or component of that system, without pilot action.
(a) N o significant deviation in the aircraft flight path or attitude, and
(b) No out-of-trim condition at disengagement that is not easily controlled by the pilot.
Flight Director (FD) A visual cue or set of cues that are used during manual control of the airplane as command information to direct the pilot how to maneuver the airplane, usually in pitch, roll and/or yaw, to track a desired flight path. The FD, displayed on the pilot’ s primary head down attitude indicator (ADI) or head up display (HUD), is a component of the FGS and is integrated with airborne attitude, air data, and NAV systems.
Definition Failure Condition A condition having an effect on the airplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.
Fail Passive System A system which, in the event of a failure, results in:
Flight Guidance System (FGS) A system consisting of one or more of the following elements:
• Autopilot,
• Flight director, and
• Automatic thrust control.
A flight guidance system (FGS) also includes any interactions with stability augmentation and trim systems.
B-3
Term Flight Management System An aircraft area navigation (RNAV) system and associated (FMS) displays and input/output devices(s) having complex multi-waypoint lateral (LNAV) and vertical (VNAV) capability (or equivalent), data entry capability, database memory to store route and instrument flight procedure information, and display readout of NAV parameters . The FMS provides guidance commands to the FGS for the purpose of automatic navigation and speed control when the FGS is engaged in an appropriate mode or modes (for example, VNAV, LNAV, RNAV).
Inadvertent A condition or action that was not planned or intended.
Limit Flight Envelope The outermost flight envelope of the airplane normally associated with the limit loads of the airplane structure.
Minimum Use Height A height specified during airworthiness demonstration or (MUH) review above which, under standard or specified conditions, a probable failure of a system is not likely to cause a significant path displacement unacceptably reducing flight path clearance from specified reference surfaces (for example, airport elevation) or specified obstacle clearance surfaces.
Definition Head Up Display (HUD) A transparent optical display system located level with and between the pilot and the forward windscreen. The HUD displays a combination of control, performance, NAV, and command information superimposed on the external field of view. It includes the display element, sensors, computers , power supplies, indications , and controls. It is integrated with airborne attitude, air data, and navigation NAV systems, and as a display of command information, is considered a component of the FGS.
Latent Failure A failure is latent until it is made known to the flightcrew or maintenance personnel. A significant latent failure is one that would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition.
Minimum Engage Height The minimum height after takeoff at which the flightcrew is permitted to engage the autopilot . Also referred to as minimum use height takeoff. See “minimum use height.”
AC 25.1329 1C CHG 2 Appendix B B-4
AC 25.1329 1C CHG 2 Appendix B B-5 Term Mode A system configuration that corresponds to a single (or set of) FGS behavior(s).
Non-Normal Condition A condition or configuration of the airplane that would not normally be experienced during routine flight operations — usually due to failures. Also includes unusual airplane ferry configurations, such as transporting a spare engine or landing gear locked down ferry flight.
Normal Flight Envelope The range of altitude and operating speeds that are defined by the airplane manufacturer as consistent with conducting flight operations for which the airplane is designed. This envelope is generally associated with practical, routine operation and/or prescribed conditions, whether all -engine or engine inoperative.
Override (of engaged FGS An action taken by the flightcrew intended to prevent, oppose, functions) or alter an operation being conducted by a flight guidance function, without first disengaging that function.
Definition Minor Transient A transient that would not significantly reduce safety margins and which involves flightcrew actions that are well within their capabilities, involving a slight increase in flightcrew workload or some physical discomfort to passengers or cabin crew .
Mode Reversion An automatic mode change that returns the FGS to a previously engaged mode or to a pre-determined “default” mode for that condition. This may occur due to several reasons, such as specific criteria becoming satisfied or because the FGS cannot perform the currently selected operation . This type of mode change is not requested by the flightcrew and therefore may be unexpected.
Normal Condition Any fault-free condition typically experienced in normal flight operations. Operations typically well within the aircraft flight envelope, and with routine atmospheric and environmental conditions.
Other than Normal Condition The summation of rare normal and non-normal conditions.
Rare Normal Condition A fault-free condition that is experienced infrequently by the airplane due to severe environmental conditions (for example, significant wind, turbulence, or asymmetric icing).
Appendix B Term Redundancy The presence of more than one independent means for accomplishing a given function or flight operation.
Significant Transient A transient that would lead to a significant reduction in safety margins, an increase in flightcrew workload, discomfort to the flightcrew, or physical distress to passengers or cabin crew, possibly including non-fatal injuries.
Note: The flightcrew should be able to respond to any significant transient without:
• Exceptional piloting skill, alertness, or strength,
• Forces greater than those given in § 25.143(c), and
• Accelerations or attitudes in the airplane that might result in further hazard to secured or non -secured occupants.
Note: 14 CFR 25.143(d) is the appropriate paragraph of the regulation for a certification basis later than amendment 121.
System A combination of components, parts, and elements that are inter-connected to perform one or more specific functions.
Warning A flight deck indication that alerts the flightcrew to a non-normal operational or airplane system requiring immediate recognition. Immediate corrective or compensatory action by the flightcrew is required.
Definition Select The flightcrew action of requesting functionality or an end state condition.
Stability Augmentation System Automatic systems that provide or enhance stability for specific aerodynamic characteristics of an airplane (for example, yaw damper, longitudinal stability augmentation system, Mach trim).
Transient A disturbance in the control or flight path of the airplane that is not consistent with response to flightcrew inputs or environmental conditions.
AC 25.1329 1C CHG 2 B-6
App endix C APPENDIX C. ACRONYMS Table C-1. Acronyms and Definitions Acronym Definition AC Advisory Circular ADI Attitude Director Indicator AFM Airplane Flight Manual AGL Above Ground Level ARP Aerospace Recommended Practice ATC Air Traffic Control CDI Course Deviation Indicator CFR Code of Federal Regulations CG Center of Gravity CWS Control Wheel Steering DA Decision Altitude DA(H) Decision Altitude (Height) DME Distance Measuring Equipment EVS Enhanced Vision System FAA Federal Aviation Administration FCOM Flightcrew Operations Manual FD F light Director FGS Flight Guidance System FL Flight Level FMA Flight Mode Annunciator C-1