AC NO: 25.1329-1A DATE: 7/8/68
FEDERAL AVIATION ADVISORY
TO MINISTRAIO CIRCULAR
DEPARTMENT OF TRANSPORTATION
FEDERAL AVIATION ADMINISTRATION SUBJECT: AUTOMATIC PILOT SYSTEMS APPROVAL
1. PURPOSE. This circular sets forth an acceptable means by which compliance with the automatic pilot installation requirements of FAR 25.1329 may be shown. Included are relaxation of the performance of continued automatic approach following engine failure and capability for hardovers (pitch) to exceed acceleration limits of past practice if specific conditions are met. Due consideration will be given to any other means of determining compliance the applicant elects to present.
2. CANCELLATION: AC No. 25.1329-1, dated October 1, 1965.
3. REGULATIONS AFFECTED. These acceptable means of compliance refer to certain provisions of the recodified Federal Aviation Regulations (FARs) Part 25. They may be used in showing compliance with the corresponding provisions of the former Civil Air Regulations (CARs) in the case of aircraft to which those regulations are applicable. For convenience, the CAR reference is shown in parenthesis, following the FAR reference.
FAR 25.1309 Equipment Systems and Installations (4b.606) FAR 25.1329 Automatic Pilot Systems (4b.612 (d)) FAR 25.1353 Electrical Equipment and Installation (4b.625) FAR 25.1431 Electronic Equipment (4b.650)
4. DISCUSSION.
a. A three-second delay between airplane response to an automatic pilot malfunction and pilot corrective action has been considered an acceptable value on past type certification programs for transport category aircraft. The airplane response has been determined by use of an accelerometer or other instrumentation. In normal operations, the pilot does not have the instrumentation available by which to recognize airplane response. The first indication a pilot has of a malfunction of the autopilot is from a deviation Initiated by: FS-160
Page 2 AC 25.1329-1A 7/8/68 of the airplane from the intended flight path, abnormal control movements, or a reliable failure warning system. Present operating procedures require that at least one pilot monitor the behavior of the airplane and associated autopilot performance at all times.
The three-second delay applied in normal climb, cruise, and descent, and the one-second delay applied during low approaches are, therefore, reasonable delay times, provided that pilot recognition of the malfunction is the basis of these time delays.
b. The area of normal maneuvering flight (turning flight) has not been specified for evaluation of the effects of autopilot malfunctions.
Autopilots are being used in turning flight. A one-second delay is considered a reasonable time prior to undertaking corrective action provided the pilot recognizes that a malfunction has occurred.
The method of measuring altitude loss due to automatic pilot malfunction during an ILS (Instrument Landing System) approach needs to be clarified. The method which has been used, the vertical distance between the ILS glide slope and the lowest point in the recovery maneuver, is being retained. This method, however, is not considered satisfactory when the automatic pilot system includes an approach coupler and approval is desired for ILS coupled approaches.
For this reason, a method will be defined by which the maximum deviation of the airplane from the ILS flight path due to the effects of an automatic pilot malfunction can be determined.
5. ACCEPTABLE MEANS OF COMPLIANCE. The following is an acceptable means of showing compliance with FAR 25.1329 (CAR 4b.612 (d)).
a. Malfunction Tests. (See also Paragraph 5.d.)
(1) Climb, cruise, and descent flight regimes.
(a) The more critical of the following should be induced into the automatic pilot system. If auto-throttles are installed, they should be operating, and vertical gyro mechanical failures should not be considered.
1 A signal about any axis equivalent to the cumulative effect of any single failure, including autotrim, if installed.
The combined signals about all affected axis, if multiple axis failures can result from the malfunction of any single component.
Par. 4
AC 25.1329-1A Page 3 7/8/68 Corrective action should not be initiated until three seconds after the pilot has become aware, either through the behavior of the aircraft or a reliable failure warning system, that a malfunction has occurred. The simulated failure and the subsequent corrective action should not create loads in excess of structural limits or beyond an envelope of 0 to 2g, or speeds beyond VFc/MFC, whichever is. appropriate, or result in dangerous dynamic conditions or deviations from the flight path. Resultant flight loads outside the envelope of 0 to 2g will be acceptable provided adequate analysis and flight test measurements are conducted to establish that no resultant aircraft load is beyond limit loads for the structure, including a critical assessment and consideration of the effects of structural loading parameter variations (1.e. center of gravity, load distribution, control system variations, maneuvering gradients, etc.). Analysis alone may be used to establish that limit loads are not exceeded where the aircraft loads are in the linear range of loading (i.e.
aerodynamic coefficients for the flight condition are adequately established and no significant non-linear air loadings exist). If significant non-linear effects could exist, (e.g. buffet loads), flight loads survey measurements may be necessary to substantiate that the limit loads are not exceeded. The power or thrust for climb should be the most critical of (a) that used in the performance climb demonstrations, (b) that used in the longitudinal stability tests, or (c) that actually used for operational climb speeds. The altitude loss should be measured.
Maneuvering Flight. Malfunctions should also be induced into the automatic pilot system similar to paragraph a. (1). When corrective action is taken one second after the result of the malfunction has alerted the pilot, the resultant loads and speeds should not exceed the values in paragraph a. (1). Maneuvering flight tests should include turns with the malfunction induced when maximum bank angles for normal operation of the system have been established and in the critical airplane configuration and/or stages of flight likely to be encountered when using the automatic pilot. The altitude loss should be measured.
(3) Oscillatory Tests.
(a) An investigation should be made to determine the effects of an oscillatory signal of sufficient amplitude to saturate the servo amplifier of each device that can move a control surface. The investigation should cover the Par. 5
Page 4 AC 25.1329-1A 7/8/68 range of frequencies which can be induced by a malfunction of the automatic pilot system and systems functionally connected to it, including an open circuit in a feedback loop. The investigated frequency range should include the highest frequency which results in apparent movement of the system driving the control surface to the lowest elastic or rigid body response frequency of the aircraft.
Frequencies less than 0.2 cps may, however, be excluded from consideration. The investigation should also cover .
the normal speed and configuration ranges of the airplane.
The results of this investigation should show that the peak loads imposed on the parts of the aircraft by the application of the oscillatory signal are within the limit loads for these parts.
(b) The investigation may be accomplished largely through analysis with sufficient flight data to verify the analytical studies or largely through flight tests with analytical studies extending the flight data to the conditions which impose the highest percentage of limit load to the parts.
(c) When flight tests are conducted in which the signal frequency is continuously swept through a range, the rate of frequency change should be slow enough to permit determining the amplitude of response of any part under steady frequency oscillation at any critical frequency within the test range.
b. Control. Recovery should be demonstrated either by overpowering or by manual use of an emergency quick disconnect device after the appropriate delay. The pilot should be able to return the airplane to its normal flight attitude under full manual control without exceeding the loads or speed limits defined in this paragraph and without engaging in any dangerous maneuvers during August 12, 1957, an emergency quick disconnect button is not installed on the control wheel, it should be possible to overpower servo forces If, for airplanes whose certification basis is prior to plus resultant airloads in all configurations and attitudes of flight demonstrated, including maximum speed for which approval is sought and without exceeding the following transient control forces measured at the pilot's controls; pitch 50 pounds; roll 30 pounds (force applied at rim); yaw 150 pounds. The maximum servo forces used for these tests should not exceed those values shown to be within the structural limits for which the airplane was designed. The maximum altitude loss experienced during these tests should be measured.
Par. 5
AC 25.1329-1A Page 5 7/8/68 Performance of Function. The automatic pilot system should be demonstrated to perform its intended function throughout all appropriate maneuvers and environmental conditions, including turbulence, unless an appropriate operating limitation or informational statement is included in the airplane flight manual. All such maneuvers should be accomplished smoothly and without subjecting the airplane to loads greater than those described in paragraph a. (1) of this section.
d. Automatic Pilot Instrument Approach Approval.
Throughout an approach, no signal or combination of signals simulating the cumulative effect of any single failure or malfunction in the automatic pilot system, except vertical gyro mechanical failures, should provide hazardous deviations from flight path or any degree of loss of control if corrective action is initiated one second after the pilot has become alerted to the malfunction.
The aircraft should be flown down the ILS..in the configuration and at the approach speed specified by the applicant for approach.
Simulated autopilot malfunctions should be induced at critical points along the ILS, taking into consideration all possible variations in autopilot sensitivity and authority. The mal.
functions should be induced in each axis. While the pilot may know the purpose of the flight, he should not be informed when a malfunction is to be or has been applied except through airplane action, control movement, or other acceptable warning
(3) An engine failure during an automatic ILS approach should not cause a lateral deviation of the airplane from the flight path at a rate greater than three degrees per second or produce hazardous attitudes.
(4) If approval is sought for ILS approaches initiated with oneengine inoperative, the automatic pilot should be capable of conducting the approach. The deviation from the ILS course
• following the failure of a second critical engine should not be greater than three degrees per second.
Either of the following methods is acceptable for uncoupled ILS approaches. If approval is being sought for coupled ILS approaches, however, method (b) should be used.
Altitude Loss Method. Recoveries should be initiated one second after the pilot recognizes the failure. The altitude loss shall be measured as the vertical distance between the glide slope path and the lowest point in the recovery maneuver .
Par. 5
Page 6 AC 25.1329-1A 7/8/68
(b) Deviation Profile Method.
The airplane should be so instrumented that the following information is recorded: (a) the path of the airplane with respect to the normal glide path; (b) the point along the glide path when the simulated malfunction is induced; (c) point where the pilot indicates recognition of the malfunction; and (d) the point along the path of the airplane where recovery action is initiated. Data obtained from the point of the indicated malfunction to the point where the airplane has either again intersected the glide slope or is in level flight will define the deviation profile. When changes to the airplane/ autopilot configuration are made during the approach and these changes alter the deviation profile, additional data should be obtained to define each of the applicable deviation profiles. An example of a deviation profile may be found in Appendix I.
Recoveries from malfunctions should simulate under-thehood instrument conditions with a one-second time delay
• between pilot recognition of the fault and initiation of the recovery at all altitudes down to 80 percent of the minimum decision altitude for which the applicant requests approval.
Recoveries from malfunctions at altitudes between 80 percent of the minimum decision altitude for which the applicant requests approval and the minimum altitude for which the applicant requests approval to operate the autopilot may be visual with no time delay between pilot recognition of fault and initiation of recovery.
The minimum altitude at which the autopilot may be used should be determined as the altitude which results in the critical deviation profile becoming tangent with a minimum operational tolerance line. An example of this may be found in Appendix 2. The 29:1 slope of the minimum operational tolerance line provides a one percent gradient factor of safety over the 50:1 obstacle clearance line. An additional factor of safety is provided by measuring the 29:1 slope from the horizontal at a point 15 feet above the runway threshold. It is recognized that this minimum altitude will vary with glide slope angle. Information regarding these variations should be obtained and presented.
Par. 5
AC 25.1329-1A Page 7 7/8/68
(6) A malfunction of the autopilot during a coupled ILS approach should not place the airplane in an attitude which would preclude conducting a satisfactory go-around, or landing.
e. Servo Stall Forces. The automatic pilot system should be so installed and adjusted that the system tolerances established during certifiassured by conducting flight tests at the extremes of the tolerances.
Those tests conducted to determine that the automatic pilot system will adequately control the aircraft should establish the lower limit;
and those tests to determine that the automatic pilot will not impose dangerous loads or deviation from the flight path should be conducted at the upper limit. Appropriate aircraft loadings to produce the critical results should be used.
£. Airplane Flight Manual Information. The following information should be placed in the airplane flight manual:
(1) In the Operating Limitations Section: - airspeed and other applicable operating limitations for use of the autopilot.
(2) In the Operating Procedures Section, the normal operation information.
(3) In the Emergency Operation Procedures Section:
(a) A statement of the altitude loss in the cruise, climb and descent configurations and the maneuvering flight configuration in accordance with paragraphs 5.a. (1) and 5.a. (2) of this advisory circular.
(b) A statement of the altitude loss, as defined in paragraph 5d (5) (a), 1f applicable.
(c) True profiles of deviations below the glide slope or projected flare path for the critical conditions tested in accordance with paragraphs 5d. (5) (b), (See Appendix 1) and the deviation profile indicating the lowest altitude at which the autopilot can be used, as defined in paragraph 5d(5) (b)4, if applicable.
actingFlight Standards Service AS Miff Director Par. 5
NOTE: Point of change of airplane configuration may be more than one point. For instance: 7/8/68 AC 25.1329-1A Gain changes along the glide path The 200 ft. or middle marker transition Flap changes affecting autopilot authority, etc.
Point of Change of Airplane Configuration -Fault: Airplane Configuration No. 1 Point of Change Fault: Airplane to Flare Mode Configuratios No. 2
•Deviation Profile No. Projected Automatic Flare (if provided) 50:1 Obstacle Clearance Plane No. 2 Deviation Profile Fault: Airplane Configuration No. 3 Deviation Terrain Profile No. 3 Runvay Page 1 EXAMPLE DEVIATION PROFILE APPENDIX 1
AC 3/63329-14 ILS Glide Slops Critical Fault Point, -Minisus Height For •Operation of Autopilot 29:1 Minimum Operational Tolerance Deviation Profile 50:1 Obatacl 15 ft.
Terrain Runvay Page 1 Appendix 2 EXAMPLE OPERATING LIMITATION APPENDIX 2