c. Maximum Displacement Deviation. If minimum engagement altitude(s) or height(s) are not specified, then “maximum displacement deviation” information from a pertinent takeoff flight path and approach profile should be provided in the AFM normal procedures section, or in the associated flightcrew operation manual (FCOM).
111. Limitations. The AFM limitations section presents those FGS operating limitations appropriate to the airplane model as established in the course of the type certification process. The FGS operational limitations listed in the AFM (should any exist) must specify any configuration/envelope restrictions. [See §§ 25.1581 (a)(1), and 25.1583]
112. Non-normal/emergency procedures. The AFM must include non-normal or emergency procedures appropriate to the FGS identified during the certification program.
[See §§ 25.1581(a)(1), and 25.1585(a)(2), (a)(3)]
113. Normal procedures.
a. Documentation of Normal Procedures. The normal procedures for use of the FGS must be documented in the AFM. [See §§25.1581(a)(1), and 25.1585(a)(1)] These procedures should be demonstrated during the type certification process.
b. Maximum Displacement Deviation. In lieu of specification of minimum engagement altitude(s) or height(s) (see paragraph 110, above), the AFM may alternately specify “maximum displacement deviations” from a specified takeoff flight path or from a specified approach profile. This information may be based on typical departure or approach flight paths suited for the aircraft type and for failure conditions that are determined applicable to the type of FGS and modes suitable for use.
c. Procedures for Use of FGS in Icing Conditions. The flight manual should include any necessary procedures for the use of the FGS in icing conditions (including moderate and heavy icing conditions). In particular, the procedures should include any necessary changes in operating speeds, required either operationally or as a result of relevant design features of the speed protection function of the FGS. For example, variations in minimum speeds as a function of de/anti-icing system selection, speed increments during approach, and landing in turbulence should be part of the documented procedures.
d. Aircraft With Published Flightcrew Operations Manuals (FCOM). The AFMs for aircraft for which the manufacturer has published a FCOM must contain essential information on normal operating procedures that are considered unique to the operation of the FGS for the aircraft type or are otherwise necessary for safe operation. [See § 25.1581(a)(2)] FGS description and integration with the overall flight deck design philosophy, specification, and operational procedures that are normally associated with FGSs should be included in the FCOM. If applicable, a FCOM may contain the 112
“m aximum displacement deviation” information described in paragraph 110, above, in either numeric or graphic form.
e. Aircraft Without Published FCOMs. For aircraft that rely on the AFM as the sole operating manual, the AFM must contain operating information sufficient for flightcrew reference. [See § 25.1581(a)(2)] The FGS description and integration with the overall flight deck design philosophy, specification and operational procedures normally associated with FGSs, should be made available so that an appropriately trained flightcrew may operate the FGS under normal conditions.
This page left blank.
Appendix 1
Appendix 1. Safety assessment
1. General. This appendix provides material that may be useful in supporting the safety assessment activities identified in Chapter 8, Safety Assessment.
2. Identification of failure conditions. The following cases should be considered for applicability when establishing failure conditions, as indicated in Chapter 8.
a. Loss of autopilot in single or multiple axes.
b. Loss of guidance in single or multiple axes.
c. Loss of thrust control.
d. Partial loss or degradation of autopilot function.
e. Unintended autopilot commands in a single axis or multiple axes simultaneously (for example, hardover, slowover, and oscillatory failure modes).
f. Unintended guidance commands in a single axis or multiple axes.
g. Unintended thrust control.
h. A sustained out–of–trim condition with the autopilot engaged without an alert.
i. Autopilot disengagement in an out–of–trim condition.
j. Autopilot disengagement without a warning.
k. Inability to disengage the autopilot or autothrust function.
l. Uncommanded engagement of an autopilot or autothrust.
m. Jamming or loading of primary flight controls.
n. Unintended thrust asymmetry.
A typical failure condition statement may be of the form:
‘[Failure]’ during ‘[Phase of Flight]’ that ‘[Effect]’ when ‘[Mitigation Consideration]’
A1-1
Appendix 1
Failur e conditions may result from failures within the FGS or from failure associated with aircraft interfacing systems or components (for example, NAV receivers, attitude heading reference systems, flight management systems (FMS), hydraulics, electrical systems, etc.).
3. Considerations when assessing the severity of failure condition effects.
a. Complete Definition of Failure Condition. The “failure condition” definition is complete (as defined in AC 25.1309-1A, System Design and Analysis) when the effects resulting from the failure are identified. The complete definition of the “failure condition” and its effect will then support the subsequent failure condition hazard classification.
b. Factors To Consider. When assessing the effect that results from a failure, the following factors should be considered for various phases of flight:
(1) The impact of the loss of control or unintended control on the structural integrity of the airplane as a result of simple loading or as a result of excitation of aerodynamic or structural modes—both at the time of occurrence and while the flight continues.
(2) Implications of the airplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on flightcrew performance.
(3) Degradation in the stability or other flying qualities of the airplane.
(4) The duration of the condition.
(5) The aircraft configuration.
(6) The aircraft motion cues that will be used by the flightcrew for recognition.
(7) Availability, level, and type of alerting provided to the flightcrew.
(8) Expected flightcrew corrective action on detection of the failure.
c. Possible Characteristics of Failure C onditions. Failure conditions may include the following characteristics:
(1) “Hardover” effects—typically are cons idered significant and are readily detectable by the flightcrew, based on the resulting aircraft motion or guidance cues.
(2) “Slowover” effects—typically are not readily detected by the flightcrew.
The effect may involve departures from intended flight path that are not initially A1-2
Appendix 1
detec table by aircraft motion alone and may be detectable only by motion cues when a significant flight path deviation has occurred or by an appropriate flightcrew alert.
(3) “Oscillatory” effects—typically are repetitive motions or guidance conditions not related to intended guidance or control. The magnitude, period, and duration of the condition and any mitigation considerations will determine the final effect.
(4) “Loss of” effects—typically is the removal of control, guidance or functionality that may have an immediate effect or may not be immediately apparent to the flightcrew.
Note: Chapter 9, Compliance Demonstration Using Flight Test and Simulation, provides guidance on crew recognition considerations.
4. Failure condition classification.
The following are examples of the type of failure condition effects that have been identified in previous airplane certification programs. The specific number and type of failure condition may vary with airplane type, airplane system architecture, and FGS design philosophy (for example, failure detection, redundancy management, failure annunciation, etc.).
a. Catastrophic Failure Conditions. The following effects have been assessed catastrophic in previous airplane certification programs:
(1) A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing.
(2) Unrecoverable loss of flight path control.
(3) Exceedance of VDF/ MDF (demonstrated flight dive speed/demonstrated flight dive Mach).
(4) Flutter or vibration that causes a structural failure preventing safe flight and landing.
(5) A temporary loss of control (for example, stall) where the flightcrew is unable to prevent contact with obstacles or terrain.
(6) Deviations in flight path from which the flightcrew are unable to prevent contact with obstacles, terrain, or other aircraft.
b. Hazardous Failure Conditions. The following effects have been assessed hazardous in previous airplane certification programs:
A1-3
Appendix 1
A1-4
(1) Exceedance of an airspeed halfway between VMO (maximum operating limit speed) and VDF or a Mach number halfway between MMO (maximum operating limit Mach) and MDF.
(2) A stall, even if the flightcrew is able to recover safe flight path control.
(3) A load factor less than zero.
(4) Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 1000 ft. (304.8 m above an applicable airport elevation).
(5) Degradation of the flying qualities of the airplane that excessively increases flightcrew workload.
(6) Failure that could result in a rejected takeoff (RTO) and high speed overrun (for example, 60 knots).
(7) A flight path deviation that requires a severe maneuver to prevent contact with obstacle, terrain or other aircraft.
Note: Severe maneuver includes risk of serious injury or death of a small number of occupants.
c. Major Failure Conditions. The following effects have been assessed “major” in previous airplane certification programs:
(1) A flight path deviation, including the required recovery maneuver, which may result in passenger injuries. Consideration should be given to phases of flight where the occupants may reasonably be moving about the airplane or be serving or consuming hot drinks. See Appendix 2, for the definition of significant transient.
(2) Degradation of the flying qualities of the airplane that significantly increase flightcrew workload.
Appendix 2
Appendix 2. Definitions
The following definitio ns apply to the requirements of § 25.1329 and the guidance material provided in this AC. They should not be assumed to apply to the same or similar terms used in other regulations or ACs. Terms for which standard dictionary definitions apply are not defined in this AC.
TERM DEFINITION Abnormal Condition See non-normal condition.
Advisory Crew awareness is required and subsequent crew action may be required.
Alert A generic term used to describe a flight deck indication meant to attract the attention of the flightcrew to a nonnormal operational or airplane system condition without implying the degree or level of urgency for recognition and corrective action by the crew. Warnings, cautions, and advisories are considered alerts.
Analysis The terms “analysis” and “assessment” are used throughout. Each has a broad definition and the two terms are to some extent interchangeable. However, the term analysis generally implies a more specific, more detailed evaluation, while the term assessment may be a more general or broader evaluation but may include one or more types of analysis.
Arm A condition where the intent to transition to a new mode or state has been established but the criteria necessary to make that transition has not been satisfied.
Assessment See the definition of analysis above.
A2-1
Appendix 2
TERM DEFINITION Autopilot The autopilot function provides automatic control of the airplane, typically in pitch, roll, and yaw. The term includes the sensors, computers, power supplies, servomotors/actuators and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system.
Any part of the autopilot system that remains connected to the primary flight controls when the autopilot is not in use is regarded as a part of the primary flight controls.
Autothrust The autothrust function provides automatic control of the thrust of the airplane. The term includes the sensors, computers, power supplies, servo-motors/actuators and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system. Any part of the autothrust that remains connected to the engine controls when the autothrust is not in use is regarded as a part of the engine control system.
Caution A flight deck indication that alerts the flightcrew to a nonnormal operational or airplane system condition that requires immediate crew awareness. Subsequent pilot corrective compensatory action will be required.
Cognitive Task Analysis An analysis that focuses on the mental processes, skills, strategies, and use of information required for task performance.
Complex A system is complex when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods.
Conformal Positioned and scaled with respect to the outside view.
A2-2
Appendix 2
TERM DEFINITION Control Wheel Steering (CWS) A flight guidance system (FGS) function which, when engaged, enables the pilot/first officer to manually fly the airplane by positioning the flight control surfaces using the autopilot servos. The positions of the flight deck controls (for example, control column, control wheel) are determined by the FGS, which converts them into autopilot servo commands. The autopilot servos, in turn, drive the appropriate flight control surfaces.
Conventional A system is considered to be conventional if its functionality, the technological means used to implement its functionality, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used.
Engage A steady state that exists when a flightcrew request for mode or system functionality has been satisfied.
Error An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
Failure
Note:
An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Errors may cause failures, but are not considered to be failures.
Failure Condition A condition having an effect on the airplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.
Fail Operational System A system capable of completing an operation, following the failure of any single element or component of that system, without pilot action.
A2-3
Appendix 2
TERM DEFINITION Fail Passive System A system which, in the event of a failure, results in:
(a) no significant deviation in the aircraft flight path or attitude, and
(b) no out-of-trim condition at disengagement that is not easily controlled by the pilot.
Flight Director (FD) A visual cue or set of cues that are used during manual control of the airplane as command information to direct the pilot how to maneuver the airplane, usually in pitch, roll and/or yaw, to track a desired flight path. The FD, displayed on the pilot's primary head down attitude indicator (ADI) or head up display (HUD), is a component of the flight guidance system (FGS) and is integrated with airborne attitude, air data, and navigation (NAV) systems.
Flight Guidance System (FGS) A system consisting of one or more of the following elements:
autopilot flight director (FD), and automatic thrust control.
A flight guidance system (FGS) also includes any interactions with stability augmentation and trim systems.
Flight Management System (FMS) An aircraft area navigation (RNAV) system and associated displays and input/output devices(s) having complex multiwaypoint lateral (LNAV) and vertical (VNAV) capability (or equivalent), data entry capability, data base memory to store route and instrument flight procedure information, and display readout of NAV parameters. The flight management system (FMS) provides guidance commands to the FGS for the purpose of automatic navigation and speed control when the FGS is engaged in an appropriate mode or modes (for example, VNAV, LNAV, RNAV).
A2-4
Appendix 2
TERM DEFINITION Head Up Display (HUD) A transparent optical display system located level with and between the pilot and the forward windscreen. The HUD displays a combination of control, performance, navigation (NAV), and command information superimposed on the external field of view. It includes the display element, sensors, computers and power supplies, indications and controls. It is integrated with airborne attitude, air data and navigation NAV systems, and as a display of command information is considered a component of the flight guidance system (FGS).
Inadvertent A condition or action that was not planned or intended.
Latent Failure A failure is latent until it is made known to the flightcrew or maintenance personnel. A significant latent failure is one which would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition.
Limit Flight Envelope The outermost flight envelope of the airplane, normally associated with the limit loads of the airplane structure.
Minimum Engage Height The minimum height after takeoff at which the flightcrew is permitted to engage the autopilot. Also referred to as minimum use height takeoff. See “minimum use height.”
Minimum Use Height (MUH) A height specified during airworthiness demonstration or review above which, under standard or specified conditions, a probable failure of a system is not likely to cause a significant path displacement unacceptably reducing flight path clearance from specified reference surfaces (for example, airport elevation) or specified obstacle clearance surfaces.
Minor Transient See “Transient.”
Mode A mode is system configuration that corresponds to a single (or set of) FGS behavior(s).
A2-5