10/27/14 A C 25.1329-1C 56 CHAPTER 7. FGS INTEGRATION
75. General. Throughout the preceding chapters of the document, FGSs and functions have been considered as being separate and distinct from other systems and functions on the aircraft . It i s recognized that in complex aircraft designs, the flight guidance functions are closely integrate d w ith other avionics functions and that the physical integration of these systems may have a bearing on how airplane level safety is assessed . The following paragraphs provide guidance o n t he likely FGS system integration issues found in more complex aircraft system designs and the interfaces that should be considered within the bounds of demonstrating the intended function, performance, and safety of the FGS.
76. System Integration Issues.
a. Common and cascading failure modes. Integration of other aircraft systems with the FGS has the potential of reducing the independence of failure effects and partitioning between functions. This is particularly the case where hardware and software resources are shared by different systems and functions (for example, aircraft data network and integrated modular avionics (IMA) architectures). In addition to considering the reliability and integrity aspects of the FGS as a separate system, it may be necessary to address the effects of FGS failures with respect to fault propagation, detection, and isolation within other systems . The overall effect on the aircraft of a combination of individual system failure conditions occurring as a result of a common or cascade failure, may be more severe than the individual system effect . For example, failure conditions classified under § 25.1309 as “ minor” or “major” by themselves may have hazardous effects at the aircraft level when considered in combination . With regard to isolation of failures and particularly combination of failures, the ability of the alerting system to provide clear and unambiguous information to the flightcrew becomes of significant importance. (See also Chapter 8, Safety Assessment, of this AC.)
b. Risk of error. Complex and highly integrated avionics systems present greater risk for development error. With non-traditional HMIs, there is also the potential for operational flightcrew errors. Moreover, integration of systems may result in a greater likelihood of undesirable and unintended effects.
c. System safety analysis. When credit is taken for shared resources or partitioni ng s chemes, these should be justified and documented within the system safety analysis . When considering the functional failures of the system, where such partitioning schemes cannot be shown to provide the necessary isolation, possible combination failure modes should be taken into account. An example of this type of failure would be multi -axis active failures, where the control algorithms for more than one axis are hosted on a single processing element . Further, the functional integration of control functions such as control surface trimming, yaw channel, and stability augmentation, while not strictly FGS, should be considered.
77. Functional Interfaces.
a. Interfacing sensors. In its simplest form, the FGS may be considered as interfaci ng w ith sensors that provide the necessary inputs to enable computation of its various functions.
Typically, these sensors will include air and inertial data, engine control, and NAV sensors such
as ILS, very high frequency omnidirectional range (VOR), and distance measuring equipment (DME). In the case of engine control, a feedback loop may also be provided. The FGS may also be considered as providing inner loop closure to outer loop commands . The most common interface is with the FMS, which provides targets for LNAV and VNAV in the form of steering orders.
b. Potential inconsistencies between systems. In demonstrating the intended function and performance of both the FGS and systems providing outer loop commands, the applicant needs to address potential inconsistencies between limits provided by the two different systems . One example of this is possible conflicts between FMS steering commands with basic FGS pitch and bank angle limits. Failure to address these points can result in discontinuities, mode switching, and reversions, leading to erroneous NAV and other possible safety issues (for example, buffet margin at high altitude). Similar issues arise in the inner loop, across the functional interface between FGS and flight controls. In fly-by-wire aircraft, the loss of synchronization between the two can result in mode anomalies and autopilot disengagement.
c. Function and performance. The applicant should demonstrate the intended function and performance of the FGS across all possible functional interfaces . The alerting system should also be assessed to ensure that accurate and adequate information is provided to the flightcrew when dealing with failures across functional interfaces.
78—82 [RESERVED] 57
AC 25.1329-1C CHG 2 CHAPT ER 8. SAFETY ASSESSMENT
83. General.
a. Basic safety requirements. Section 25.1309 defines the basic safety requirements for airworthiness approval of airplane systems , and FAA guidance on that rule provides acceptable general means of demonstrating compliance with it. This chapter provides additional guidance specific to showing compliance of the FGS with § 25.1309.
b. Safety assessment. A safety assessment should be performed to identify the failure conditions, classify their hazard level, and establish that the failure conditions occur with a probability corresponding to the hazard classification or are mitigated as intended. The safety assessment should include the rationale and coverage of the FGS protection and monitoring philosophies employed. The safety assessment should include an appropriate evaluation of each of the identified FGS failure conditions and an analysis of the exposure to common mode/cause or cascade failure. Additionally, the safety assessment should include justification and description of any functional partitioning schemes employed to reduce the effect/likelihood of failures of integrated components or functions.
c. Validation of safety assessment. There may be situations where the severity of the effect of a failure condition identified in the safety analysis needs to be validated . Laboratory, simulator, or flight test may accomplish the validation of the assessment . The test facility for each validation test should be chosen based on specific criteria, such as the difficulty of setting up the test conditions, potential hazard to an airplane and the test crew, and the validity of that validation test in that specific facility.
d. Coordination with the FAA. It is recommended that the safety analysis plan and the functional hazard assessment be coordinated with the FAA early in the certification program.
84. FGS Failure Conditions. One of the initial steps in establishing compliance with § 25.1309 for a system is to identify the failure conditions that are associated with that system . The failure conditions are typically characterized by an undesired change in the intended function of the system. The failure condition should identify the functionality affected and the effect on the airplane and/or its occupants, specify any considerations relating to phase of flight, and identify any flightcrew action or other means of mitigation that are relevant.
a. Functionality. The primary functions of a FGS may include the following:
(1) Automatic control of the airplane’s flight path utilizing the airplane’s aerodynamic control surfaces.
(2) Guidance provided to the flightcrew to achieve a particular desired flight path or maneuver via information presented on a HUD or HDD system.
(3) Control of the thrust applied to the airplane.
AC 25.1329-1C CHG 2
b. Effect of failure condition. Dependent upon the functionality provided in a specific FGS, the failure conditions could potentially impact the following:
(1) Control of the airplane in the pitch, roll, and directional axes.
(2) Control of thrust.
(3) Integrity and availability of guidance and system annunciations/alerts provided to the flightcrew.
(4) Structural integrity of the airplane.
(5) Ability of the flightcrew to cope with adverse operating conditions.
(6) Flightcrew performance and workload.
(7) Safety of the occupants of the airplane.
Note: The safety assessment of a FGS for use in supporting takeoff, approach, and landing operations in low-visibility conditions is further addressed in AC 20-191.
85. Type and Severity of Failure Conditions .
a. Types of failure conditions. The type of the FGS failure conditions will depend, to a large extent, upon the architecture, design philosophy, and implementation of the system . Types of failure conditions can include the following:
(1) Loss of function. A control or display element no longer provides control, guidance, or system annunciation/alerting.
(2) Malfunction. A control or display element performs in an inappropriate manner, including the following sub-types:
(a) Hardover. The control or display goes to full displacement in a brief period of time. The resultant effect on the flight path and occupants of the airplane and possible adverse structural effects are the primary concerns.
(b) Slowover. The control or display moves away from the correct control or display value over a relatively long period of time . The potential delay in recognizing the situation and the effect on the flight path are the primary concerns.
(c) Oscillatory. The control or display is replaced or augmented by an oscillatory element. In addition to difficulty controlling the aircraft flight path , there may be effects on structural integrity and occupant well-being.
b. Cause. Failure conditions are a manifestation of malfunctions in —
(1) Primary FGS elements, such as autopilot, FD, or HUD.
10/27/14 A C 25.1329-1C 60
(2) Interfacing sensors to the FGS, such as inertial or air data.
(3) Control and display elements, such as servos or PFDs.
(4) Interfacing systems, such as the FMS or primary flight controls.
(5) Basic aircraft services, such as electrical or hydraulic power.
c. Severity . The severity of the FGS failure conditions and their associated classifications will frequently depend on the phase of flight, airplane configuration, and the type of operation being conducted. The effect of any control system variability (for example, tolerances and rigging) on the failure conditions should be considered. The severity of the failure conditions can be mitigated by various design strategies . (See paragraph 86, Mitigation of Failure Conditions .)
d. Assessment of failure conditions.
(1) Functional failures. Appendix A, Safety Assessment, of this AC presents some considerations for use when assessing the type and severity of conditions that result from functional failures. The classifications of failure conditions that have been identified on previous airplane certification programs are identified . The classifications of failure conditions should be agreed upon with the FAA during the § 25.1309 safety assessment process.
(2) Airframe loads. With the exception of the catastrophic failure condition, the classification of failure conditions leading to the imposition of airframe loads should be assessed in accordance with 14 CFR part 25, Subpart C, Structure, and § 25.1309, Equipment, systems, and installations. The assessment needs to account for loads occurring during the active malfunction, recovery, or continuation of the flight with the system in the failed state.
(3) Assessing total effect of failure. Complex integrated systems may require that the total effect resulting from single failure be assessed . For example, some failures may result in a number of failure conditions that, if assessed individually, may be considered major effects , but when considered in combination, may be hazardous. Special consideration concerning complex integration of systems can be found in Chapter 7 , FGS Integration, paragraph 76, System Integration Issues, of this AC.
86. Mitigation of Failure Conditions.
a. General. The propagation of potential failure conditions to their full effect may be nullified or mitigated by a number of methods . These methods could include, but are not limited to, the following:
(1) Failure detection and monitoring.
(2) Fault isolation and reconfiguration.
(3) Redundancy.
(4) Authority limiting.
10/27/14 A C 25.1329-1C
(5) Flightcrew action to intervene.
b. Identification of methods. Means to assure continued performance of any system design mitigation methods should be identified. The mitigation methods should be described in the safety analysis/assessment document or be available by reference to another document (for example, a system description document).
c. FGS de-selection. The design of typical FGS allows for the de -selection of control a nd g uidance elements. The long-term effects on occupants and any structural implication of oscillatory failures can be mitigated by de -selection of the FGS.
87. Validation of Failure Conditions.
a. General. The method of validation of failure conditions will depend on the effect of the condition, any assumptions made, and any associated risk. The severity of some failure conditions may be obvious, and other conditions may be somewhat subjective . If flightcrew action is used to mitigate the propagation of the effect of a failure condition, the information available to the flightcrew to initiate appropriate action (for example, motion, alerts, and displays) and the assumed flightcrew response should be identified. It is recommended that there be early coordination with the FAA to identify any program necessary to validate any of these assumptions.
b. Validation options. The validation options for failure conditions include the following:
(1) Analysis.
(2) Laboratory testing.
(3) Simulation.
(4) Flight test.
c. Validation methodology. The validation testing and analysis should take into account the architectural strategies (for example, redundant channels, high integrity components, rate limit/magnitude limiting, etc.). It is anticipated that the majority of failure condition s can be validated by analysis to support the probability aspect of the § 25.1309 assessment. It may be necessary to substantiate the severity of a failure condition effect by ground simulation or flight test. This is particularly true where pilot recognition of the failure condition requires justification, or if there is some var iability in the response of the airplane . Failure conditions that are projected to be less probable than 10 -7 per flight hour, independent of effect severity, need not be demonstrated with a flight test. Guidance on the assessment of traditional failure conditions is provided in Chapter 9 of this AC. New and novel functionality may require additional assessment methods to be agreed to with the authority.
AC 25.1329-1C CHG 2 62
88. Specific Considerations. The following paragraphs identify specific considerations that should be given to potential failure conditions for various phases of flight.
a. FGS action during ground operations. The potential hazard that may result due to inappropriate autopilot, autothrust, or other system control action during maintenance operations should be assessed. This includes while the airplane is parked at the gate and during taxi operations. System interlocks, crew or maintenance procedures , and placards may mitigate these hazards.
b. FGS operations in close proximity to the ground. The response of the airplane to failures in the FGS could have implications for the safety of operations when the airplane is close to the ground. For the purpose of this AC, close to the ground can be assumed to be less than 500 feet above the liftoff point or touchdown zone on a runway. A specific safety assessment should be performed if approval for operations where the autopilot is engaged or remains engaged is in close proximity to the ground.
Note: AC 20-191 identifies additional considerations and criteria for operating the airplane in low-visibility conditions.
(1) Takeoff. If approval is sought for engagement of the autopilot below 500 feet after liftoff, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path, the speed control, and the bank angle of the airplane should be conducted. An autopilot minimum engage height - takeoff will be established based, in part, on the characteristics of the airplane in response to the failures and the acceptability of flightcrew recognition of the condition. A pilot assessment of certain failure conditions may be required.
(See Chapter 9 of this AC.) The minimum engage height - takeoff based upon this assessment should be provided in the AFM.
(a) Vertical axis assessment.
1 The operational objective during the initial climb is to maintain an appropriate climb profile to assure obstacle clearance and to maintain an appropriate speed profile during climbout. (See Chapter 6 of this AC).
2 The FGS failure conditions should be assessed for the potential for a significant reduction in the net takeoff flight path below 500 feet and a significant increase in pitch attitude that results in the airplane speed dropping to unacceptable values.
3 For failure conditions that are likely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and documented in AFM limitations or procedures, if those failure conditions requi re operational limitations or flightcrew procedures.
(b) Lateral axis assessment.
1 The operational objective during the initial climb is to maintain an appropriate heading or track to provide separation from potential adjacent runway operations.
5/24/16 A C 25.1329-1C CHG 1 2 The FGS failure conditions should be assessed for the potential for producing a bank angle that results in significant deviation from the runway track or intended track.
3 For failure conditions that are likely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and, as necessary, documented in AFM limitations or procedures.
(2) Approach.
(a) Assessment of failure conditions. If the autopilot is to remain engaged below 500 feet above the touchdown zone during approach, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path , the speed control, and the bank angle of the airplane should be conducted. The lowest point on the approach appropriate for the use of the autopilot will be established based on the characteristics of the airplane in response to the failure conditions and the acceptability of flightcrew recognition of the condition . See Chapter 9 of this AC for details regarding how these failure conditions on approach should be assessed.
(b) Approach operations.
1 A number of approach operations may be conducted using automatic flight control. These can include, but are not limited to, the following:
• ILS and GLS.
• RNAV (for example, LNAV and VNAV).
• NAV (for example, VOR, LOC, and Backcourse) .
• Open loop flight path management (for example, vertical speed, flight path angle, track or heading select).
2 Some operations may be conducted with a single autopilot channel engaged, and some operations may be conducted with multiple autopilots engaged. The engagement of multiple autopilots may have the effect of mitigating the effect of certain failure conditions. The effectiveness of these mitigation methods should be established.
3 The type of operation and the prevailing visibility conditions will determine the decision altitude (height) (DA(H)) or minimum descent altitude (height) (MDA(H)) for a particular flight operation. The operation may continue using automatic flight control if the visual requirements are met.
4 The lowest altitude at which the autopilot should remain engaged may vary with the type of operation being conducted. The resultant flight path deviation from any significant failure condition would impact the autopilot minimum operational use height . The minimum use height (MUH) for approach should be provided in the AFM.
10/27/14 A C 25.1329-1C
(c) Vertical axis assessment.
1 The operational objective during the approach is to maintain a n a ppropriate descent profile to assure obstacle clearance and to maintain an appropriate speed profile.
2 FGS failure conditions should be assessed for the potential for a significant reduction in the approach flight path when below 500 feet above touchdown and for a significant increase in pitch attitude that results in the airplane speed dropping to unacceptable values.
3 For failure conditions that are likely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and documented in AFM limitations or procedures, if those failure conditions requi re operational limitations or flightcrew procedures.
(d) Lateral axis assessment.
1 The operational objective during the approach is to maintain a n a ppropriate track to provide alignment with the runway centerline or intended flight path to support the landing.
2 The FGS failure conditions should be assessed for the potential for producing a bank angle that results in significant deviation from the runway track or intended track.
3 For failure conditions that are likely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and, as necessary, documented in AFM limitations or procedures.
c. Cruise operations. The primary concerns during cruise operations are adverse effects that the airplane response to failure conditions may have on the structure of the airplane and to the occupants. At a minimum, the accelerations and attitude resulting from any failure condition should be assessed. The mitigation of the effect of a failure condition by the flightcrew may not be as immediate as during takeoff and landing operations . Chapter 9 of this AC provides guidance and considerations for this phase of flight.
d. Asymmetric thrust during autothrust operation. During autothrust operation, it is possible that a failure (for example, engine failure, throttle lever jam, or thrust control cable jam) could result in a significant asymmetric thrust failure condition that may be aggravated by the continued use of the autothrust system . Because the FGS could potentially compensate for the asymmetric condition with roll (and possibly yaw) control, the pilot may not immediately be aware of the developing situation. Therefore, an alert should be considered as a means of mitigation to draw the pilot’s attention to an asymmetric thrust condition during FGS operation.
AC 25.1329-1C CHG 2
89. Failure to Disengage the FGS. The requirement for quick disengagement for the autopilot and autothrust functions is intended to provide a routine and intuitive means for the flightcrew to quickly disengage those functions . The implication of failures that preclude the quick disengagement from functioning should be assessed consistent with the requirements of AC 25.1309. See § 25.1329(b). This assessment should consider the effects of failure to disengage the autopilot and/or autothrust functions during the approach using the quick disengagement controls. The feasibility of the use of the alternative means of d isengagement defined in Chapter 3, paragraph 27.b(4), Alternative Means of Autopilot Disengagement , of this AC should be assessed . If the assessment indicates the aircraft can be landed manually with the autopilot and/or autothrust engaged, this should be demonstrated in flight test.
90—97 [RESERVED] 65
AC 25.1329-1C CHG 2 CHAPTER 9. COMPLIANCE DEMONSTRATION USING FLIGHT TEST AND SIMULATION
98. General.
a. Methods of compliance demonstration. Validation of the performance and integrity of FGS operation will typically be accomplished by a combination of analysis, laboratory test, simulation, and flight test. This chapter focuses on compliance demonstration by flight test or simulation with flightcrew participation . The chapter includes the evaluation necessary to confirm acceptable performance of intended functions, including the HMI and the acceptability of failure scenarios. The specific requirements for flight or simulator evaluation will consider the specifics of the applicant’s design, the supporting engineering analysis, and the scope and depth of the applicant’s laboratory testing. The type and extent of the various validation methods may vary, depending upon the FGS functionality, certification considerations, the applicant’s facilities, and other practical and economic constraints.
b. Criteria for establishing compliance. The criteria to be used for establishing compliance with §§ 25.1301, 25.1309, and 25.1329 may be found in Chapters 3 through 8 of this AC.
c. Elemen ts of certification flight test. The certification flight test program should investigate representative phases of flight and aircraft configurations used by the FGS . The program should evaluate all of the FGS modes through appropriate maneuvers and representative environmental conditions, including turbulence. Combinations of FGS elements (for example, autopilot engaged and autothrust disengaged) should be considered. Certain failure scenarios may require flight or simulator demonstration. The airplane should be equipped with sufficient instrumentation to record the parameters appropriate to the test . Examples of parameters that could be recorded include normal acceleration, airspeed, height, pitch and roll angles, and autopilot engagement state . The flight test instrumentation should not affect the behavior of the FGS or any other system.
d. Pilot-in-the-loop evaluation. An important part of the pilot -in-the-loop evaluation is validation of human factors . A thorough evaluation of the HMI is required to ensure safe, effective, and consistent FGS operation . Portions of this evaluation will be conducted during flight test. Representative simulators can be used to accomplish the evaluation of human factors and workload studies. The level and fidelity of the simulator used should be commensurate with the certification credit being sought, and its use should be agreed upon with the FAA.
e. Other applicable guidance material for FGS takeoff and/or approach modes.
(1) Criteria to consider. The following criteria should be considered for applicability in developing the overall and integrated flight test and simulation requirements:
(a) AC 20-138D or latest, Airworthiness Approval of Positioning and Navigation Systems.
(b) AC 20-191 or latest, Airworthiness Approval of Airborne Systems used for Takeoff, Precision Approach, Landing, and Rollout in L ow-Visibility Conditions.
AC 25.1329-1C CHG 2
(2) Procedures to show compliance. Procedures that may be used to show compliance are provided in AC 25 -7D. (See paragraph 33.7, Flight Guidance System § 25.1329.)
f. Relationship of AC chapters. Figure 9-1 depicts the relationship between this chapter and the other chapters contained within this AC.
Figure 9-1. Relationship between AC Chapters Safety Assessment Analysis Only Analysis Chapter 8 Flight Failure Validation Conditions Flight Test & Simulation Test Chapter 9 Criteria Test FGS Function Methods Chapters 3-7 AC 25-7D AFM Chapter 10 Simulator Flight Test FGS
99. Performance Demonstration (Fault Free): § 25.1301.
a. General.
(1) Certification plan. The certification plan should identify the specific functionality provided by the FGS. The flight test and/or simulator program will typically assess this functionality under representative operational conditions, including applicable airplane 67