colum n or wheel movements alone should not be used for recognition. The recognition time should not normally be less than 1 second. If a recognition time of less than 1 second is asserted, specific justification will be required. For example, additional tests may be required to ensure that the recognition time is representative in light of the cues available to the pilot.
(c) Slowover. This type of failure condition is typically recognized by a path deviation indicated on primary flight instruments (for example, course deviation indicator (CDI), altimeter, or vertical speed indicator). It is important that the recognition criteria are agreed upon with the FAA. The following identify examples of recognition criteria as a function of flight phase:
1 En–route cruise. Recognition th rough the altitude alerting system can be assumed for vertical path deviation. The lateral motion of the airplane may go unrecognized for a significant period of time, unless a bank angle alerting system is installed and the slowover results in a bank angle in excess of the limit allowed by the alerting system.
2 Climb and descent. Recognition through increasing/decreasing vertical speed, pitch attitude, roll attitude, or heading can be assumed.
3 On an approach with vertical path reference. A displacement recognition threshold should be identified and selected for testing that is appropriate for the display(s) and failure condition(s) to be assessed.
Note 1: For an ILS or GLS approach in a significant wind gradient, a value of 1 dot on the displayed ILS/GLS deviation scale is considered a reasonable value for crew recognition. In smooth atmospheric conditions with steady state tracking with the vertical flight path typically maintained at less than a fraction of a needle width, a detection and recognition threshold even below 1/2 dot may be suitable.
Note 2: For RNAV systems that do not use dots, some multiple of needle width related to an established crew monitoring tolerance of normal performance may be appropriate (for example, three needle widths of deviation on the VNAV scale).
Note 3: Credit may be taken for excessive deviation alerts, if available.
4 On an approach without vertical path reference, criteria similar to the climb/descent condition can be assumed.
(d) Oscillatory. It is assumed that oscillatory failures that have structural implications are addressed under 14 CFR Part 25, Subpart C, and § 25.1309. It can be assumed that the flightcrew will disengage the automatic control elements of the FGS that have any adverse oscillatory effect and will not follow any adverse oscillatory 99
Change 1 guidance. H owever, if there are any elements of the FGS that can not be disconnected in the presence of an oscillatory failure condition, the long term effects on crew workload and the occupants will need to be evaluated.
(4) Pilot Reaction Time. The pilot reaction time is considered dependent upon the pilot attentiveness, based upon the phase of flight and associated duties. The following assumptions are considered acceptable:
(a) Climb, Cruise, Descent and Holding. Recovery action should not be initiated until three seconds after the recognition point.
(b) Maneuvering Flight. Recovery action should not be initiated until one second after the recognition point.
(c) Approach. The demonstration of malfunctions should be consistent with operation in non–visual conditions. The pilot can be assumed to be carefully monitoring the airplane performance and will respond rapidly once the malfunction has been recognized. A reaction time of one second between recognition point and initiation of recovery is appropriate for this phase of flight.
Note 1: For the final phase of landing (for example, below 80 feet), the pilot can be assumed to react upon recognition without delay.
Note 2: For phases of flight where the pilot is exercising manual control using CWS, if implemented, the pilot can be assumed to commence recovery action at the recognition point.
(5) Pilot Recovery.
(a) Pilot Recovery Action. The recovery action should be commenced after the reaction time. Following such delay, the pilot should be able to return the airplane to its normal flight attitude under full manual control without engaging in any dangerous maneuvers during recovery and without control forces exceeding the values given in § 25.143(d). During the recovery, the pilot may overpower the autopilot or disengage it.
(b) Minimum Autopilot Use Height. For the purpose of determining the minimum height at which the autopilot may be used during an approach or for height loss assessments, a representative pilot recovery maneuver appropriate to the airplane type and flight condition should be performed. This maneuver should not lead to an unsafe speed excursion to resume a normal flight path. An incremental normal acceleration in the order of 0.5 g is considered the maximum for this type of maneuver.
Change 1
c. Takeoff.
(1) Worst Case Failure Condition. The primary concern for the takeoff phase of flight is the effect of the worst case failure condition identified by the safety assessment on the following:
(a) The net effect on the flight pa th of the airplane after takeoff, and
(b) The airplane’s attitude and speed during climbout.
(2) Failures to be Evaluated. Failures that would cause the airplane to pitch up, pitch down, and bank during the takeoff should be evaluated, if those failure conditions exist (given the architecture of a specific FGS) and are relevant to the safety assessment.
(3) On Runway Guidance. If the FGS provides on runway guidance for takeoff, the effect of any failures of that takeoff guidance should be assessed. See AC 120-28D for additional information.
d. Climb, Cruise, Descent, and Holding. Where the safety analysis identifies a failure condition requiring flight/simulator evaluation with pilot assessment, the height loss should be established in accordance with the method described in AC 25-7C, paragraph 181b(9)(e)4, Assessment of Approach Without Vertical Path Reference.
e. Maneuvering. Where the safety analysis identifies a failure condition that has a dynamic effect on the roll control of the airplane, the failure condition should be introduced at the bank angle for normal operation. The bank angle should not exceed 60 degrees when the pilot recognition and the recovery times identified above are applied.
f. Approach. A discussion of the operational considerations for approach operations is contained in paragraph 101, Criteria Supporting Operational Use of the Autopilot, below. This chapter identifies test criteria to support those considerations.
The safety assessment process should identify the demonstration of specific failure conditions during the approach. The fault demonstration process during approach should include the four phases identified in paragraph 100b, Validation Elements, above. The failure condition should be inserted at a safe but representative height. The deviation profile should be identified and applied as indicated in AC 25-7C, paragraph 181b(9)(e), Approach.
(1) Approach With Vertical Path Reference.
(a) xLS (that is, ILS, MLS, or GLS).
1 ILS and MLS operations are typically conducted on instrument approach procedures designed in accordance with United States Standard for Terminal 101
Change 1
Instrum ent Procedures (TERPS). See FAA Order 8260.3, United States Standard for Terminal Instrument Procedures, or the International Civil Aviation Organization (ICAO) Procedures for Air Navigation Services – Operations (PANS-OPS) criteria, or equivalent.
These criteria together with ICAO Annex 14 are generally intended to take into account obstacles beneath a reference obstacle identification surface.
Note: The FAA may establish operational criteria for GLS at a later time.
2 In assessing the implication of the effect of failures during autopilot operations, a reference 1:29 slope penetration boundary has been applied against the deviation profile to identify an appropriate altitude for continued autopilot operation. The 1:29 slope has been found to provide an acceptable margin above obstacles on an approach.
3 The worst case failure condition identified by the safety assessment (See Chapter 8, paragraph 87, Validation of Failure Conditions.) should be demonstrated against the deviation profile criteria and a minimum use height (MUH) established. (See AC 25-7C, paragraph 181b(9)(e)3, Assessment of Approach With Vertical Path Reference.)
(b) Area Navigation (RNAV).
1 For RNAV coupled approach ope rations, a vertical flight path similar to an xLS flight path will be used (for example, 3 degree path starting 50 feet above the threshold). However, due to sensor characteristics it is assumed that RNAV operations will be conducted with a DA(H) or MDA(H) that is higher than an equivalent MUH on an xLS approach to the same runway. Further, for this type of operation, it should be noted that the MUH is always in the visual segment of the approach, as the failure recognition and recovery maneuver are assumed to be conducted with the pilot having established outside visual reference.
2 In order to derive only one MUH value for simplicity of use, it is assumed that the effects of failure on the autopilot in RNAV operation are no worse than for the xLS operation. No further determination or demonstration is required. However, the applicant should show that due account has been taken in the safety assessment of the differences between the RNAV and xLS inputs to the autopilot (for example, barometric altitude input, FMS position and guidance commands, and their failure effects). If these effects can be bounded or otherwise reconciled, then the xLS demonstrated MUH may also be considered applicable to RNAV operations.
3 If these effects cannot be bounded or accounted for within those for the xLS operation, the MUH should be determined in accordance with an Approach Without Vertical Path Reference, below.
Change 1 103
(2) Approach Without Vertical Path Reference. For an approach without vertical path reference (for example, VOR, Non Directional Beacon (NBD), localizer only) the FGS mode of operation is typically vertical speed/flight path angle (that is, a cruise mode). The worst case failure condition for this type of mode should be demonstrated in the approach configuration. An appropriate height loss should then be established in accordance with the method described in AC 25-7C, paragraph 181b(9)(e)4.
(3) Steep Approach. In support of an approval to use the FGS on glidepath angles of greater than 3.77 degrees (see Chapter 9, paragraph 99d(5), Steep Approach [special authorization]), an assessment should be made of the effects of failure conditions for this type of operation. For use of autopilot, an appropriate MUH should be established in accordance with the deviation profile method described in this chapter. For this assessment, the obstacle plane associated with a nominal 3 degree glidepath angle (1:29 slope) should be adjusted, according to the maximum approach angle for which approval is sought.
g. Specific Conditions.
(1) Failure Conditions to be Evaluated. The following are failure conditions that should be considered as part of the FGS evaluation program:
(a) Engine failure during appr oach; continue approach to decision altitude/minimum descent altitude (DA/MDA).
(b) Potential fuel imbalance.
(c) Airplane system failures that affect FGS operational capabilities.
Examples include failures of hydraulic systems, electrical systems, flight controls, and FGS related sensors. When possible, these failure conditions should be evaluated with a flight test. However, some failure conditions, due to their potential hazards, may best be evaluated via a high fidelity flight simulation.
(2) Failure to Disengage. The probability of failure of an FGS element to disengage when the quick disengagement control is operated should be shown to be acceptable by the safety analysis process. If credit is to be taken for acceptable continued manual operation with the FGS elements remaining engaged, that is, without operating any of the other disengagement controls, then a flight demonstration should be conducted though approach, landing and rollout.
101. Criteria supporting operational use of autopilot.
a. Typical Flight Operations. The criteria contained in this paragraph are intended to identify how the functional capability of the FGS, established during the certification, can be utilized to support typical flight operations. The criteria are based on experience
gained f rom certification programs and functionality provided by traditional systems. A FGS providing non-traditional functionality—using new or novel technology and/or implementation techniques—may require additional criteria to be established.
b. Operations in Close Proximity to the Ground.
(1) General. During low visibility operations, multiple redundant autopilot channels may be used, and the effect of any autopilot failures on the flight path may be eliminated or substantially minimized by the protection provided by that redundancy.
The considerations in the following paragraphs apply primarily to single channel operations where performance or integrity aspects may require further consideration. See Chapter 8, paragraph 88b, FGS Operations in Close Proximity to the Ground, for specific considerations relating to autopilot operations close to the ground in the presence of failures.
(2) Considerations. The minimum engagement point for the autopilot after takeoff and the minimum use of the autopilot during approach should take into consideration the effect of the following:
(a) Failures and their eff ects (that is, failure conditions).
(b) Fault–free performance.
(c) Any specific operational considerations and/or mitigation.
(3) Autopilot Engagement Altitude/Height After Takeoff.
(a) Deviation from Flight Path. The potential deviation of the airplane from the desired flight path due to the effect of a failure condition may necessitate delaying the engagement of an autopilot to an acceptable height above the departure runway.
(b) Worst–Case Deviation Profile. To support the determination of the minimum engagement height, if autopilot failure condition(s) are identified that will cause a significant deviation below the intended vertical flight path, the worst–case deviation profile should be identified. This profile and the recovery of the airplane should not result in penetration of the net flight path as defined in § 25.115.
(c) Other Effects. If the failure condition(s) have a neutral effect on the flight path but has implications for speed control during takeoff, the acceptability of cues for the flightcrew detection of the condition should be made. The effect of any failure condition relating to the bank angle of the airplane should also be assessed. In all of the above, account should be taken of operating the airplane at the weight/altitude/temperature (WAT) limit.
(d) Minimum Engagement Height. The minimum engagement height will typically be established, based on the greatest of the following factors:
1 The lowest altitude or he ight where the flightcrew could reasonably be assumed to engage the autopilot. Consideration should be given to normal flightcrew tasks during rotation and liftoff (typically 100 feet or greater).
2 Any allowance for the acceptabi lity of the performance of the autopilot during the basic engagement/mode transition.
3 The lowest altitude or height consistent with the response of the airplane to any identified autopilot failure condition(s).
4 Activation of an armed stall identification system, such as a stick pusher (if installed).
(e) Deviation Information. If the response to the worst-case failure condition causes a significant transition below the intended vertical flight path, the deviation information should be provided in the AFM.
(4) Autopilot Engagement During Approach.
(a) Deviation from Flight Path. The potential deviation of the airplane from the desired flight path due to the effect of a failure condition may necessitate the disengagement of an autopilot at an appropriate height on the approach to landing.
(b) MUH - Approach. The operational MUH for approach will be established, based on the following considerations:
1 The altitude or he ight at which the performance of the automatic control is no longer acceptable.
2 The lowest altitude or height consistent with the response of the airplane to a subsequent autopilot failure.
3 Any specific operational consideration.
(c) Approach with Vertical Path Reference.
1 Approaches with vertical path reference can include xLS (that is, ILS, MLS or GLS) or RNAV. Operations using xLS can be assumed to be conducted with respect to a flight path prescribed or established as an integral part of navigation service provided by the State. RNAV approach operations will be conducted using an onboard database that provides a navigation flight path to the runway.
Change 1
2 The operational consideration for this type of ope ration relates to an assessment of the adequacy of continued use of the autopilot in maintaining the desired vertical flight path. Considerations include the lowest altitude consistent with the response of the airplane to an autopilot failure.
3 To support this determination, if one or more autopilot failure condition(s) is identified that causes a significant transition below the intended vertical flight path, the worst-case deviation profile should be identified using the method identified in Chapter 9, paragraph 100f(1), Approach With Vertical Path Reference. If the failure condition(s) has a neutral effect on the flight path, the acceptability of cues for the flightcrew detection of the condition should be made. The effect of any failure condition relating to the bank angle of the airplane should be assessed.
4 For the purpose of the airworthin ess assessment, the vertical flight path an xLS and RNAV approach can be assumed to be a flight path of 3 degrees that passes through the runway threshold at an altitude of 50 feet. Considerations for steep approaches are provided in paragraph Chapter 9, paragraph 99d(5), Steep Approach [special authorization].
5 The vertical flight path contro l for an xLS approach will be made with reference to the path defined by the navigation service. The RNAV vertical flight path will typically be conducted with reference to barometric altitude. An appropriate adjustment to the MUH may be necessary to take into account the vertical accuracy of RNAV operations.
Note: Temperature effect compensation should be considered as part of the operational authorization.
6 The MUH - Approach is the value identified using the method identified in AC 25-7C, paragraph 181b(9)(e), Approach.
(d) Approach Without Vertical Path Reference.
1 Flight operations with no vertical path refe rence are conducted with an appropriate visual segment for final approach path. In the interest of providing appropriate automatic control to assist in a stabilized approach, the minimum use of the autopilot should be consistent with the performance needed for the descent (for example, vertical speed/flight path angle) and the pilot detection and recovery from an autopilot failure.
2 To support this determination, if one or more autopilot failure conditions is identified that causes a significant transition below the intended vertical flight path, the worst-case deviation profile should be identified. If the failure condition has a neutral effect on the flight path but has implications for speed control during takeoff, the acceptability of cues for the flightcrew detection of the condition should be 106
Change 1
m ade. The effect of any failure condition relating to the bank angle of the airplane should be assessed.
3 For FGS that are failure protec ted (that is, fail–passive), the MUH will typically be no lower than 50 feet above runway elevation. However, when determining this limitation, account should be taken of the handling task presented to the pilot when regaining manual control, especially in limiting crosswind conditions.
4 For FGS that are not failure pr otected (that is, not fail-passive), the demonstrated MUH-Approach will typically be established based on the greater of the following considerations:
(aa) 50 feet above runway elevation.
(bb) Two times the height loss for the airplane as a result of any identified autopilot failure condition, using the method identified in AC 25-7C, paragraph 181b(9)(e), Approach.
(5) Circling Approach. For the purpose of this AC, circling approaches may be considered to have the following visual segments associated with the approach:
(a) A segment at or above the mini mums prescribed by the procedure that parallel the runway in the opposite direction of the landing runway,
(b) A turning segment to align with the runway that can be level or partially descending, and
(c) A final descending segment to landing.
Operationally, the autopilot may remain engaged even after leaving the minimum altitude (MDA(H)) for reasons related to safety and flightcrew workload relief. This operational procedure should be balanced against unacceptable performance or failure characteristics.
As this procedure is in the visual segment, no specific constraints for the use of the autopilot are considered necessary for this phase of flight, unless specific unacceptable performance or failure characteristics related to circling approach are identified during the certification program.
c. Climb, Cruise, Descent, and Holding. The value of the use of the autopilot in providing flightcrew workload relief in climb, cruise, descent, and holding phases of flight should be balanced against the failure characteristics of the autopilot. No specific constraints for the use of the autopilot are considered necessary for these phases of flight, unless specific unacceptable performance or failure characteristics related to climb, cruise, or descent are identified during the certification program.
d. Maneuvering. No specific constraints for the use of the autopilot are considered necessary for maneuvering flight, unless unacceptable performance or failure 107
characteristics are identified during the certification program . Chapter 9, paragraph 98e, Maneuvering, provides assessment criteria for maneuvering flight for autopilot failures.
102. Automatic disengagement of the autopilot. The automatic disengagement of the FGS will occur for several reasons, such as system failures, sensor failures, or unusual accelerations. The automatic disengagement characteristics of the FGS should be investigated throughout the flight envelope. These disengagement cases should be analyzed to determine the ones that can be demonstrated during the test program. For each disengagement case, the transients, warnings, and pilot workload for recovery should be evaluated, and compliance with § 25.1329(d) and (e) must be verified. The use of simulation is recommended for all conditions that are expected to result in significant transients.
103. Assessment of human factors.
a. General. The evaluation, demonstration and testing should assess the acceptability of the human–machine interface with the FGS and the potential for flightcrew errors and confusion concerning the behavior and operation of the FGS, when used by a representative range of pilots. The evaluation of normal and non–normal FGS operations should include the representative range of conditions in terms of crew mental or physical workload, required crew response timeliness, and potential for confusion or indecision. The set of test cases should represent operationally relevant scenarios and the assumptions about pilot training and skill level should be documented.
b. Flight Evaluations.
(1) During Certification. Flight evaluation during certification is a final assessment and is intended to validate the design.
(2) Prior to Certification. Evaluations prior to certification are typically conducted in a variety of ways and at different levels of fidelity in order to finalize the design. These may include the following:
(a) Engineering evaluations a nd task analyses, including cognitive and physical tasks.
(b) Mock–up evaluations and demonstrations.
(c) Part–task evaluations and demonstrations.
(d) Simulator evaluations, demonstrations, and tests.
(e) Engineering flight eval uations, demonstrations, and tests.
(3) Credit to Establish FGS Compliance. The data and experiences from these evaluations may be useful for credit to establish FGS compliance with regulations having human factors considerations. In addition, applicants have successfully used comparisons to previously certificated designs to obtain such credit (although such credit is not assured). Additional testing may be necessary for new FGS flightcrew interface designs or functions.
(4) Simulation Versus Flight Tests. In some cases, the FAA may consider that less flight testing may be required to show compliance, if the simulation evaluations have added confidence with respect to the reduced potential for crew error and confusion and other human factors attributes of the pilot/FGS interface.
(a) Selecting Methodology. In many cases the evaluation, demonstration, and test scenarios, including failures and environmental events, will determine whether the data should be obtained in simulation or in flight because of safety considerations or unavailability of the necessary environmental conditions.
(b) High Fidelity Simulation. In some test scenarios, a very high fidelity simulation will be needed. In addition to the simulation validation considerations identified in Chapter 9, paragraph 99e(3)(b), Motion Base Suitability, the simulation used may need to include the following features, depending on the functionality of the FGS:
1 Physical implementation of flight deck controls, displays, indicators, and annunciators for all flightcrew positions that are relevant to the objectives of the evaluation.
2 Adequate emulations of relevant equipment (hardware and software function), including capability to introduce failures.
3 Weather simulation, including gusts, turbulence, windshear, and visibility.
4 Representation of the opera tional environments, including interaction with air traffic services, day/night operations, etc., as relevant to the functions and pilot tasks being evaluated.
5 Data collection capabilities.
(c) Simulation Conformity. In some cases, certification credit or demonstration of compliance using simulations may not be granted due to inability to find simulation conformity. Conformity should be accounted for when seeking certification testing credit using a simulator.
c. Structured Subjective Evaluations. Simulator evaluations and tests are intended to generate objective and/or subjective data. It may not always be possible or necessary to obtain quantifiable measurements of flightcrew performance, even with high fidelity 109
flight or simulation evaluation, demonstration, or test scenarios. In these cases, evaluation procedures should be based on the use of structured subjective methods, such as rating scales, questionnaires, and/or interviews. When there is dependence on this type of data, evaluations should consider multiple data collection techniques with an appropriate number of pilot evaluators.
d. Pilot Training And Experience. In order to provide sound evaluations, pilots should be trained appropriately on the FGS operation and procedures. They should have experience in the kinds of operation and aircraft types for which the FGS is intended.
Finally, they should be familiar with the intended function of the FGS, its operational and design philosophy, and the way that this philosophy fits with the overall flight deck and its operational and design philosophy.
e. Evaluating New or Unique Design Features. Rationale should be provided for decisions regarding new or unique features in a design. It should be confirmed that the data resulting from the evaluations support acceptability of any new or unique features.
f. Certification Planning Documentation. The certification planning documentation should describe the means to show compliance with the human factors related considerations of the FGS with this AC.
104 — 108 [Reserved]