Appendix 1
Failur e conditions may result from failures within the FGS or from failure associated with aircraft interfacing systems or components (for example, NAV receivers, attitude heading reference systems, flight management systems (FMS), hydraulics, electrical systems, etc.).
3. Considerations when assessing the severity of failure condition effects.
a. Complete Definition of Failure Condition. The “failure condition” definition is complete (as defined in AC 25.1309-1A, System Design and Analysis) when the effects resulting from the failure are identified. The complete definition of the “failure condition” and its effect will then support the subsequent failure condition hazard classification.
b. Factors To Consider. When assessing the effect that results from a failure, the following factors should be considered for various phases of flight:
(1) The impact of the loss of control or unintended control on the structural integrity of the airplane as a result of simple loading or as a result of excitation of aerodynamic or structural modes—both at the time of occurrence and while the flight continues.
(2) Implications of the airplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on flightcrew performance.
(3) Degradation in the stability or other flying qualities of the airplane.
(4) The duration of the condition.
(5) The aircraft configuration.
(6) The aircraft motion cues that will be used by the flightcrew for recognition.
(7) Availability, level, and type of alerting provided to the flightcrew.
(8) Expected flightcrew corrective action on detection of the failure.
c. Possible Characteristics of Failure C onditions. Failure conditions may include the following characteristics:
(1) “Hardover” effects—typically are cons idered significant and are readily detectable by the flightcrew, based on the resulting aircraft motion or guidance cues.
(2) “Slowover” effects—typically are not readily detected by the flightcrew.
The effect may involve departures from intended flight path that are not initially A1-2
Appendix 1
detec table by aircraft motion alone and may be detectable only by motion cues when a significant flight path deviation has occurred or by an appropriate flightcrew alert.
(3) “Oscillatory” effects—typically are repetitive motions or guidance conditions not related to intended guidance or control. The magnitude, period, and duration of the condition and any mitigation considerations will determine the final effect.
(4) “Loss of” effects—typically is the removal of control, guidance or functionality that may have an immediate effect or may not be immediately apparent to the flightcrew.
Note: Chapter 9, Compliance Demonstration Using Flight Test and Simulation, provides guidance on crew recognition considerations.
4. Failure condition classification.
The following are examples of the type of failure condition effects that have been identified in previous airplane certification programs. The specific number and type of failure condition may vary with airplane type, airplane system architecture, and FGS design philosophy (for example, failure detection, redundancy management, failure annunciation, etc.).
a. Catastrophic Failure Conditions. The following effects have been assessed catastrophic in previous airplane certification programs:
(1) A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing.
(2) Unrecoverable loss of flight path control.
(3) Exceedance of VDF/ MDF (demonstrated flight dive speed/demonstrated flight dive Mach).
(4) Flutter or vibration that causes a structural failure preventing safe flight and landing.
(5) A temporary loss of control (for example, stall) where the flightcrew is unable to prevent contact with obstacles or terrain.
(6) Deviations in flight path from which the flightcrew are unable to prevent contact with obstacles, terrain, or other aircraft.
b. Hazardous Failure Conditions. The following effects have been assessed hazardous in previous airplane certification programs:
A1-3
Appendix 1
A1-4
(1) Exceedance of an airspeed halfway between VMO (maximum operating limit speed) and VDF or a Mach number halfway between MMO (maximum operating limit Mach) and MDF.
(2) A stall, even if the flightcrew is able to recover safe flight path control.
(3) A load factor less than zero.
(4) Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 1000 ft. (304.8 m above an applicable airport elevation).
(5) Degradation of the flying qualities of the airplane that excessively increases flightcrew workload.
(6) Failure that could result in a rejected takeoff (RTO) and high speed overrun (for example, 60 knots).
(7) A flight path deviation that requires a severe maneuver to prevent contact with obstacle, terrain or other aircraft.
Note: Severe maneuver includes risk of serious injury or death of a small number of occupants.
c. Major Failure Conditions. The following effects have been assessed “major” in previous airplane certification programs:
(1) A flight path deviation, including the required recovery maneuver, which may result in passenger injuries. Consideration should be given to phases of flight where the occupants may reasonably be moving about the airplane or be serving or consuming hot drinks. See Appendix 2, for the definition of significant transient.
(2) Degradation of the flying qualities of the airplane that significantly increase flightcrew workload.
Appendix 2
Appendix 2. Definitions
The following definitio ns apply to the requirements of § 25.1329 and the guidance material provided in this AC. They should not be assumed to apply to the same or similar terms used in other regulations or ACs. Terms for which standard dictionary definitions apply are not defined in this AC.
TERM DEFINITION Abnormal Condition See non-normal condition.
Advisory Crew awareness is required and subsequent crew action may be required.
Alert A generic term used to describe a flight deck indication meant to attract the attention of the flightcrew to a nonnormal operational or airplane system condition without implying the degree or level of urgency for recognition and corrective action by the crew. Warnings, cautions, and advisories are considered alerts.
Analysis The terms “analysis” and “assessment” are used throughout. Each has a broad definition and the two terms are to some extent interchangeable. However, the term analysis generally implies a more specific, more detailed evaluation, while the term assessment may be a more general or broader evaluation but may include one or more types of analysis.
Arm A condition where the intent to transition to a new mode or state has been established but the criteria necessary to make that transition has not been satisfied.
Assessment See the definition of analysis above.
A2-1
Appendix 2
TERM DEFINITION Autopilot The autopilot function provides automatic control of the airplane, typically in pitch, roll, and yaw. The term includes the sensors, computers, power supplies, servomotors/actuators and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system.
Any part of the autopilot system that remains connected to the primary flight controls when the autopilot is not in use is regarded as a part of the primary flight controls.
Autothrust The autothrust function provides automatic control of the thrust of the airplane. The term includes the sensors, computers, power supplies, servo-motors/actuators and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system. Any part of the autothrust that remains connected to the engine controls when the autothrust is not in use is regarded as a part of the engine control system.
Caution A flight deck indication that alerts the flightcrew to a nonnormal operational or airplane system condition that requires immediate crew awareness. Subsequent pilot corrective compensatory action will be required.
Cognitive Task Analysis An analysis that focuses on the mental processes, skills, strategies, and use of information required for task performance.
Complex A system is complex when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods.
Conformal Positioned and scaled with respect to the outside view.
A2-2
Appendix 2
TERM DEFINITION Control Wheel Steering (CWS) A flight guidance system (FGS) function which, when engaged, enables the pilot/first officer to manually fly the airplane by positioning the flight control surfaces using the autopilot servos. The positions of the flight deck controls (for example, control column, control wheel) are determined by the FGS, which converts them into autopilot servo commands. The autopilot servos, in turn, drive the appropriate flight control surfaces.
Conventional A system is considered to be conventional if its functionality, the technological means used to implement its functionality, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used.
Engage A steady state that exists when a flightcrew request for mode or system functionality has been satisfied.
Error An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
Failure
Note:
An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Errors may cause failures, but are not considered to be failures.
Failure Condition A condition having an effect on the airplane and/or its occupants, either direct or consequential, which is caused or contributed to by one or more failures or errors, considering flight phase and relevant adverse operational or environmental conditions, or external events.
Fail Operational System A system capable of completing an operation, following the failure of any single element or component of that system, without pilot action.
A2-3
Appendix 2
TERM DEFINITION Fail Passive System A system which, in the event of a failure, results in:
(a) no significant deviation in the aircraft flight path or attitude, and
(b) no out-of-trim condition at disengagement that is not easily controlled by the pilot.
Flight Director (FD) A visual cue or set of cues that are used during manual control of the airplane as command information to direct the pilot how to maneuver the airplane, usually in pitch, roll and/or yaw, to track a desired flight path. The FD, displayed on the pilot's primary head down attitude indicator (ADI) or head up display (HUD), is a component of the flight guidance system (FGS) and is integrated with airborne attitude, air data, and navigation (NAV) systems.
Flight Guidance System (FGS) A system consisting of one or more of the following elements:
autopilot flight director (FD), and automatic thrust control.
A flight guidance system (FGS) also includes any interactions with stability augmentation and trim systems.
Flight Management System (FMS) An aircraft area navigation (RNAV) system and associated displays and input/output devices(s) having complex multiwaypoint lateral (LNAV) and vertical (VNAV) capability (or equivalent), data entry capability, data base memory to store route and instrument flight procedure information, and display readout of NAV parameters. The flight management system (FMS) provides guidance commands to the FGS for the purpose of automatic navigation and speed control when the FGS is engaged in an appropriate mode or modes (for example, VNAV, LNAV, RNAV).
A2-4
Appendix 2
TERM DEFINITION Head Up Display (HUD) A transparent optical display system located level with and between the pilot and the forward windscreen. The HUD displays a combination of control, performance, navigation (NAV), and command information superimposed on the external field of view. It includes the display element, sensors, computers and power supplies, indications and controls. It is integrated with airborne attitude, air data and navigation NAV systems, and as a display of command information is considered a component of the flight guidance system (FGS).
Inadvertent A condition or action that was not planned or intended.
Latent Failure A failure is latent until it is made known to the flightcrew or maintenance personnel. A significant latent failure is one which would, in combination with one or more specific failures or events, result in a hazardous or catastrophic failure condition.
Limit Flight Envelope The outermost flight envelope of the airplane, normally associated with the limit loads of the airplane structure.
Minimum Engage Height The minimum height after takeoff at which the flightcrew is permitted to engage the autopilot. Also referred to as minimum use height takeoff. See “minimum use height.”
Minimum Use Height (MUH) A height specified during airworthiness demonstration or review above which, under standard or specified conditions, a probable failure of a system is not likely to cause a significant path displacement unacceptably reducing flight path clearance from specified reference surfaces (for example, airport elevation) or specified obstacle clearance surfaces.
Minor Transient See “Transient.”
Mode A mode is system configuration that corresponds to a single (or set of) FGS behavior(s).
A2-5
Appendix 2
TERM DEFINITION Mode Reversion An automatic mode change that returns the FGS to a previously engaged mode or to a pre-determined “default” mode for that condition. This may occur due to several reasons, such as specific criteria becoming satisfied or because the FGS cannot perform the currently selected operation. This type of mode change is not requested by the flightcrew and therefore may be unexpected.
Non-Normal Condition A condition or configuration of the airplane that would not normally be experienced during routine flight operations— usually due to failures. Also includes unusual airplane ferry configurations, such as transporting a spare engine or landing gear locked down ferry flight.
Normal Condition Any fault free condition typically experienced in normal flight operations. Operations typically well within the aircraft flight envelope, and with routine atmospheric and environmental conditions.
Normal Flight Envelope The range of altitude and operating speeds that are defined by the airplane manufacturer as consistent with conducting flight operations for which the airplane is designed. This envelope is generally associated with practical, routine operation and/or prescribed conditions, whether all-engine or engine inoperative.
Other Than Normal Condition
The summation of rare normal and non-normal conditions.
Override (of engaged FGS functions) An action taken by the flightcrew intended to prevent, oppose, or alter an operation being conducted by a flight guidance function, without first disengaging that function.
Rare Normal Condition A fault-free condition that is experienced infrequently by the airplane due to severe environmental conditions (for example, significant wind, turbulence, or asymmetric icing).
Redundancy The presence of more than one independent means for accomplishing a given function or flight operation.
A2-6
Appendix 2 A2-7
TERM DEFINITION Select The flightcrew action of requesting functionality or an end state condition.
Significant Transient See “Transient.”
Stability Augmentation System Automatic systems that provide or enhance stability for specific aerodynamic characteristics of an airplane (for example, yaw damper, longitudinal stability augmentation system, Mach trim).
System A combination of components, parts, and elements that are inter-connected to perform one or more specific functions.
Transient A disturbance in the control or flight path of the airplane that is not consistent with response to flightcrew inputs or environmental conditions.
Minor Transient: A transient that would not significantly reduce safety margins and which involves flightcrew actions that are well within their capabilities involving a slight increase in flightcrew workload or some physical discomfort to passengers or cabin crew.
Significant Transient: A transient that would lead to a significant reduction in safety margins, an increase in flightcrew workload, discomfort to the flightcrew, or physical distress to passengers or cabin crew, possibly including non-fatal injuries.
Note: The flightcrew should be able to respond to any significant transient without:
Exceptional piloting skill, alertness, or strength, Forces greater than those given in § 25.143(d), and Accelerations or attitudes in the airplane that might result in further hazard to secured or non-secured occupants.
Warning A flight deck indication that alerts the flightcrew to a nonnormal operational or airplane system requiring immediate recognition. Immediate corrective or compensatory action by the flightcrew is required.
Appendix 3
Appendix 3. Acrony ms
AC Advisory Circular ADI Attitude Director Indicator AFM Airplane Flight Manual AGL Above Ground Level AIM Airman’s Information Manual ARP Aerospace Recommended Practice ATC Air Traffic Control AWO All Weather Operations CDI Course Deviation Indicator CG Center of Gravity CFR Code of Federal Regulations CWS Control Wheel Steering DA Decision Altitude DA(H) Decision Altitude (Height) DME Distance Measuring Equipment EFIS Electronic Flight Instrument System EVS Enhanced Vision System FAA Federal Aviation Administration FCOM Flightcrew Operations Manual FD Flight Director FGS Flight Guidance System FL Flight Level FMA Flight Mode Annunciator FMS Flight Management System GA Go-Around GBAS Ground-Based Augmentation System GLS GBAS Landing System GPWS Ground Proximity Warning System HDD Head Down Display HUD Head Up Display IAS Indicated Airspeed ICAO International Civil Aviation Organization ILS Instrument Landing System IMA Integrated Modular Avionics IMC Instrument Meteorological Conditions LNAV Lateral Navigation A3-1
Appendix 3 A3-2 LOC Instrument Landing System Localizer MDA(H) Minimum Descent Altitude (Height) MLS Microwave Landing System MSL Mean Sea Level MSP Mode Select Panel MUH Minimum Use Height [autopilot] NAV Navigation ND Navigation Display NDB Non Directional Beacon NPRM Notice of Proposed Rulemaking PAN-OPS Procedures for Air Na vigation Services–Operations PF Pilot Flying PFD Primary Flight Display PNF Pilot Not Flying RNAV Area Navigation RNP Required Navigation Performance RTO Rejected Takeoff RVSM Reduced Vertical Separation Minimum SAE Society of Automotive Engineers TCAS Traffic Alert and Collision Avoidance System TCS Touch Control Steering TERPS Terminal Instrument Procedures TO Takeoff TOGA Takeoff or Go–Around VDF/ MDF Demonstrated Flight Dive Speed/Demonstrated Flight Dive Mach VMO/ MMO Maximum Operating Limit Speed/Maximum Operating Limit Mach VR Rotation Speed VSR Reference Stall Speed (See § 25.103) V2 Takeoff Safety Speed VMC Visual Meteorological Conditions VNAV Vertical Navigation VOR Very High Frequency Omnirange Station WAT Weight Altitude Temperature xLS ILS, MLS, or GLS