(4) Engagement. The Go-Around mode should engage when go-around is selected by the pilot, even if the MSP selected altitude is at or below the go–around initiation point. The airplane should climb until another vertical mode is selected or the MSP altitude is adjusted to an altitude above the present aircraft altitude.
(5) All Engine and Engine Out Capability. The FGS design of the Go-Around mode should address all engine and engine–out operation. The design should consider an engine failure resulting in a go-around and the engine failure occurring during an all engine go-around.
c. Approach Mode.
(1) Final Approach Path. In the Approach mode, the FGS should capture and track a final approach lateral and vertical path, if applicable, from a navigation (NAV) or landing system, for example, ILS, MLS, GLS, RNP, area navigation (RNAV) (see AC 120-28D and AC 120-29A).
(2) Mode Annunciations. The FGS should annunciate all operationally relevant approach modes. Modes that are armed and waiting for capture criteria to be satisfied should be indicated in addition to the active pre-capture mode. A positive indication of the capture of the previously armed mode should be provided.
(3) Sub–Modes. The FGS may have sub–modes that become active without additional crew selection. An assessment of the significance of these sub-mode transitions to the flightcrew should be made. If assessed to be significant (for example, flare), positive annunciation of the transition should be provided.
(4) Mode Engagement Sequence. Glideslope capture mode engagement may occur prior to localizer capture. However, it is the flightcrew’s responsibility to ensure proper safe obstacle/terrain clearance when following vertical guidance when the airplane is not established on the final lateral path.
Note: Additional guidance and criteria are contained in AC 120-29A and AC 120-28D.
66. Autothrust modes. This paragraph discusses modes that are implemented in many FGSs that are used primarily for controlling the engines on the airplane. The criteria identified reflect operational experience gained from the use of these modes.
a. Thrust Mode. In the Thrust mode, the FGS should command the autothrust function to achieve a selected target thrust value.
b. Speed Mode. In the Speed mode, the FGS should command the autothrust function to acquire and maintain the selected target speed value, assuming that the 68
69 selected speed is within the speed range of the normal flight envelope. The autothrust system may fly a higher airspeed than the selected target speed during an approach when operating in winds or turbulent conditions.
c. Retard Mode. If a Retard mode is implemented in the FGS, it should work in the same manner for both automatic and manual landings when the autothrust function is engaged.
67. Special considerations for VNAV Approach operations related to selecting a target altitude.
a. Approach Operations. The FGS vertical modes should allow the pilot to set the target altitude to a missed approach value prior to capturing the final approach segment.
This should be possible for capturing from both above and below the final approach segment.
b. VNAV Path Operations. It should be possible to define a descent path to the final approach fix and another path from the final approach fix to the runway with the target altitude set for the missed approach altitude. Appropriate targets and descent points should be identified by the FMS.
68. Control wheel steering(CWS) [control steering through the autopilot].
a. General. In the CWS mode, the FGS allows the flightcrew to maneuver the airplane manually through the autopilot control path. CWS is considered an FGS mode, as it is a specific function of the FGS. However, during CWS operation, the pilot is in control of the aircraft, rather than the FGS. Operationally, CWS is identical to the pilot flying the airplane during manual flight. In both cases, the pilot is in control of the flight path and speed of the airplane. The only difference is the mechanization of how the actual flight control surfaces are moved. No automatic FGS commands are involved during CWS operation, with the possible exception of automatic aircraft trim function(s).
Therefore, paragraphs in this AC, such as those which discuss speed protection and performance objectives, should be applied only to those autopilot modes with which the FGS is in control of the flight path of the airplane. Such paragraphs in this AC should not be applied to CWS, unless such features are specifically provided while the FGS is in the CWS mode.
b. Design. If provided, a CWS mode should meet the following:
(1) Control Forces. It should be possible for the pilot to maneuver the airplane using the normal flight controls with the CWS mode engaged and to achieve the maximum available control surface deflection without using forces so high that the
Change 1 controllability requirem ents of § 25.143(d) are not met. Excessive discontinuities in control force that might adversely affect the flight path should not be encountered.
(2) Bank and Pitch Attitudes. The maximum bank and pitch attitudes that can be achieved during CWS operations should be limited to those necessary for the normal operation of the airplane.
Note 1: Normal operational limits are typically 35 degrees in roll and +20 degrees to –10 degrees in pitch.
Note 2: Limits that can be physically overcome with forceful control commands by the pilot are sometimes referred to as “soft limits.”
(3) Control Behavior. It should be possible to perform all normal maneuvers smoothly and accurately without nuisance oscillation. It should also be possible to counter all normal changes of trim due to change of configuration or power, within the range of flight conditions in which CWS may be used.
(4) Stall and Stall Recovery. The stall and stall recovery characteristics of the airplane should remain acceptable. It should be assumed that recovery from such a stall is made with CWS in use, unless automatic disengagement of the autopilot is provided.
(5) Adjustments to Trim. In showing compliance with § 25.143(f), consideration should be given to adjustments to trim that may be made by the autopilot in the course of maneuvers that can reasonably be expected. Some alleviation may be acceptable in the case of unusually prolonged maneuvers, provided that the reduced control forces would not be potentially hazardous.
(6) Takeoff and Landing. If the use of CWS for takeoff and landing is to be permitted, it should be shown that:
(a) Sufficient control, both in amplitude and rate, is available without encountering force discontinuities.
(b) Reasonable mishandling is not hazardous (for example, engaging the autopilot while the elevators or ailerons are held in an out-of-trim position).
(c) Runaway rates and control for ces are such that the pilot can readily overpower the autopilot with no significant deviation in flight path.
(d) Any lag in aircraft response induced by the CWS mode is acceptable for the intended maneuver.
(7) Automatic Reversion to CWS Mode. The autopilot, when engaged, should not automatically revert to the CWS mode by applying an input to the control column or wheel, unless the autopilot is in a capture mode (for example, Altitude Capture or 70
Localizer C apture). When the force is released, the autopilot should return to the previously engaged capture mode or to the Track/Heading Hold mode.
c. Terminology and Application of Advisory Material. The term “CWS” is currently used by industry to refer to several different types of systems. Several other types of systems that are similar in nature to CWS, but functionally different from it, are described below. Paragraph 68b, Design, applies to systems as described in paragraph 68a, General. It does not apply to those systems described in paragraphs 68c(1) and 68c(2), below. These descriptions are intended to be generic. Implementation may vary from airplane to airplane.
(1) Touch Control Steering (TCS). A TCS system is available on many business and commuter aircraft. With a TCS system, a pilot is able to physically disengage the autopilot servos from the flight control system, usually by pushing and holding a button on the control wheel, without causing the autopilot system itself to disengage or lose its currently selected modes. The pilot may then maneuver the airplane as desired using the aircraft’s flight control system (that is, the autopilot servos are not part of the control loop). The pilot is then able to reconnect the autopilot servos to the flight control system by releasing the TCS button. Using the new orientation of the aircraft as a basis, the autopilot will then reassume control of the airplane using the same mode selections as were present before the selection of TCS. This type of system on some aircraft is also sometimes referred to as CWS.
(2) Supervisory Override. A function available on some aircraft is referred to as a “supervisory override” of an engaged autopilot. With this function, a pilot is able to physically overpower an engaged autopilot servo by applying force to the flight deck controls. With a supervisory override, the autopilot does not automatically disengage due to the pilot input. This allows the pilot to position the airplane as desired using the flight deck controls without first disengaging the autopilot. When the pilot releases the controls, the autopilot reassumes control of the airplane using the same mode selections as were present before the supervisory override.
69. Special considerations for the integration of fly-by-wire flight control systems and FGS.
a. Speed Protection. Speed protection features may be implemented in the fly-bywire flight control system. However, if speed protection is also implemented within the FGS, it should be compatible with the envelope protection features of the fly–by–wire flight control system. The FGS speed protection (normal flight envelope) should operate to or within the limits of the flight control system (limit flight envelope).
b. System Degradation. Information should be provided to the flightcrew about the impact on the FGS following degradation of the fly-by-wire flight control systems.
70 — 74 [Reserved] 71
This page left blank.
Chapter 7 FGS Integration
75. General. T hroughout the preceding chapters of the document, FGSs and functions have been considered as being separate and distinct from other systems and functions on the aircraft. It is recognized that in complex aircraft designs, the flight guidance functions are closely integrated with other avionics functions and that the physical integration of these systems may have a bearing on how airplane level safety is assessed.
The following paragraphs provide guidance on the likely FGS system integration issues found in more complex aircraft system designs and the interfaces that should be considered within the bounds of demonstrating the intended function, performance, and safety of the FGS.
76. System integration issues.
a. Common and Cascading Failure Modes. Integration of other aircraft systems with the FGS has the potential of reducing the independence of failure effects and partitioning between functions. This is particularly the case where hardware and software resources are shared by different systems and functions (for example, aircraft data network and integrated modular avionics (IMA) architectures). In addition to considering the reliability and integrity aspects of the FGS as a separate system, it may be necessary to address the effects of FGS failures with respect to fault propagation, detection, and isolation within other systems. The overall effect on the aircraft of a combination of individual system failure conditions occurring as a result of a common or cascade failure, may be more severe than the individual system effect. For example, failure conditions classified under § 25.1309 as ”minor” or ”major” by themselves may have hazardous effects at the aircraft level when considered in combination. With regard to isolation of failures and particularly combination of failures, the ability of the alerting system to provide clear and unambiguous information to the flightcrew becomes of significant importance. (See also Chapter 8, Safety Assessment.)
b. Risk of Error. Complex and highly integrated avionics systems present greater risk for development error. With non-traditional human-machine interfaces, there is also the potential for operational flightcrew errors. Moreover, integration of systems may result in a greater likelihood of undesirable and unintended effects.
c. System Safety Analysis. When credit is taken for shared resources or partitioning schemes, these should be justified and documented within the system safety analysis. When considering the functional failures of the system, where such partitioning schemes cannot be shown to provide the necessary isolation, possible combination failure modes should be taken into account. An example of this type of failure would be multi– axis active failures, where the control algorithms for more than one axis are hosted on a single processing element. Further, the functional integration of control functions such as 73
control surface trimm ing, yaw channel, and stability augmentation, while not strictly FGS, should be considered.
77. Functional interfaces.
a. Interfacing Sensors. In its simplest form, the FGS may be considered as interfacing with sensors that provide the necessary inputs to enable computation of its various functions. Typically, these sensors will include air and inertial data, engine control, and NAV sensors such as ILS, very high frequency omni range (VOR), and distance measuring equipment (DME). In the case of engine control, a feedback loop may also be provided. The FGS may also be considered as providing inner loop closure to outer loop commands. The most common interface is with the FMS, which provides targets for LNAV and VNAV in the form of steering orders.
b. Potential Inconsistencies Between Systems. In demonstrating the intended function and performance of both the FGS and systems providing outer loop commands, the applicant needs to address potential inconsistencies between limits provided by the two different systems. One example of this is possible conflicts between FMS steering commands with basic FGS pitch and bank angle limits. Failure to address these points can result in discontinuities, mode switching, and reversions, leading to erroneous NAV and other possible safety issues (for example, buffet margin at high altitude). Similar issues arise in the inner loop, across the functional interface between FGS and flight controls. In fly–by–wire aircraft, the loss of synchronization between the two can result in mode anomalies and autopilot disengagement.
c. Function and Performance. The applicant should demonstrate the intended function and performance of the FGS across all possible functional interfaces. The alerting system should also be assessed to ensure that accurate and adequate information is provided to the flightcrew when dealing with failures across functional interfaces.
78 — 82 [Reserved]
Chapter 8 Safet y Assessment
83. General.
a. Basic Safety Requirements. Section 25.1309 defines the basic safety requirements for airworthiness approval of airplane systems and AC 25.1309-1A, System Design and Analysis, provides an acceptable means of demonstrating compliance with this rule. This chapter provides additional guidance and interpretive material for the application of § 25.1309 to the approval of FGS.
b. Safety Assessment. A safety assessment should be performed to identify the failure conditions, classify their hazard level according to the guidance of AC 25.1309-1A, and establish that the failure conditions occur with a probability corresponding to the hazard classification or are mitigated as intended. The safety assessment should include the rationale and coverage of the FGS protection and monitoring philosophies employed. The safety assessment should include an appropriate evaluation of each of the identified FGS failure conditions and an analysis of the exposure to common mode/cause or cascade failure in accordance with AC 25.1309-1A.
Additionally, the safety assessment should include justification and description of any functional partitioning schemes employed to reduce the effect/likelihood of failures of integrated components or functions.
c. Validation of Safety Assessment. There may be situations where the severity of the effect of a failure condition identified in the safety analysis needs to be validated.
Laboratory, simulator, or flight test may accomplish the validation of the assessment.
The test facility for each validation test should be chosen based on specific criteria, such as the difficulty of setting up the test conditions, potential hazard to an airplane and the test crew, and the validity of that validation test in that specific facility.
d. Coordination with the FAA. It is recommended that the safety analysis plan and the functional hazard assessment be coordinated with the FAA early in the certification program.
84. FGS Failure conditions. One of the initial steps in establishing compliance with § 25.1309 for a system is to identify the failure conditions that are associated with that system. The failure conditions are typically characterized by an undesired change in the intended function of the system. The failure condition should identify the functionality affected and the effect on the airplane and/or its occupants, specify any considerations relating to phase of flight, and identify any flightcrew action or other means of mitigation that are relevant.
a. Functionality. The primary functions of a FGS may include the following:
(1) Automatic control of the airplane’s flight path utilizing the airplane’s aerodynamic control surfaces.
(2) Guidance provided to the flightcrew to achieve a particular desired flight path or maneuver via information presented on a HUD or HDD system.
(3) Control of the thrust applied to the airplane.
b. Effect of Failure Condition. Dependent upon the functionality provided in a specific FGS, the failure conditions could potentially impact the following:
(1) Control of the airplane in the pitch, roll, and directional axes.
(2) Control of thrust.
(3) Integrity and availability of guidance and system annunciations/alerts provided to the flightcrew.
(4) Structural integrity of the airplane.
(5) Ability of the flightcrew to cope with adverse operating conditions.
(6) Flightcrew performance and workload.
(7) Safety of the occupants of the airplane.
Note: The safety assessment of a FGS for use in supporting takeoff, approach and landing operations in low visibility conditions is further addressed in AC 120-29A, Criteria for Approval of Category I and Category II Weather Minima for Approach, and AC 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout.
85. Type and severity of failure conditions.
a. Types of Failure Conditions. The type of the FGS failure conditions will depend, to a large extent, upon the architecture, design philosophy, and implementation of the system. Types of failure conditions can include the following:
(1) Loss of Function. A control or display element no longer provides control, guidance, or system annunciation/alerting.
(2) Malfunction. A control or display element performs in an inappropriate manner, including the following sub-types:
(a) Hardover. The control or display goes to full displacement in a brief period of time. The resultant effect on the flight path and occupants of the airplane and possible adverse structural effects are the primary concerns.
(b) Slowover. The control or display moves away from the correct control or display value over a relatively long period of time. The potential delay in recognizing the situation and the effect on the flight path are the primary concerns.
(c) Oscillatory. The control or display is replaced or augmented by an oscillatory element. In addition to difficulty controlling the aircraft flight path, there may be effects on structural integrity and occupant well being.
b. Cause. Failure conditions are a manifestation of malfunctions in:
(1) Primary FGS elements, such as autopilot, FD, or HUD.
(2) Interfacing sensors to the FGS, such as inertial or air data.
(3) Control and display elements, such as servos or PFDs.
(4) Interfacing systems, such as the FMS or primary flight controls.
(5) Basic aircraft services, such as electrical or hydraulic power.
c. Severity. The severity of the FGS failure conditions and their associated classifications will frequently depend on the phase of flight, airplane configuration, and the type of operation being conducted. The effect of any control system variability (for example, tolerances and rigging) on the failure conditions should be considered. The severity of the failure conditions can be mitigated by various design strategies (See paragraph 86, Mitigation of Failure Conditions, below).
d. Assessment of Failure Conditions.
(1) Functional Failures. Appendix 1, Safety Assessment, of this AC, presents some considerations for use when assessing the type and severity of condition that results from functional failures. The classifications of failure conditions that have been identified on previous airplane certification programs are identified. The classifications of failure conditions should be agreed with the FAA during the § 25.1309 safety assessment process.
(2) Airframe Loads. With the exception of the catastrophic failure condition, the classification of failure conditions leading to the imposition of airframe loads should be assessed in accordance with 14 CFR Part 25, Subpart C, Structure, and § 25.1309, 77
Equipm ent, systems, and installations. The assessment needs to account for loads occurring during the active malfunction, recovery, or continuation of the flight with the system in the failed state.
(3) Assessing Total Effect of Failure. Complex integrated systems may require that the total effect resulting from single failure be assessed. For example, some failures may result in a number of failure conditions that, if assessed individually, may be considered major effects but when considered in combination may be hazardous. Special consideration concerning complex integration of systems can be found in Chapter 7, paragraph 76, System Integration Issues.
86. Mitigation of failure conditions.
a. General. The propagation of potential failure conditions to their full effect may be nullified or mitigated by a number of methods. These methods could include, but are not limited to, the following:
(1) Failure Detection and Monitoring.
(2) Fault Isolation and Reconfiguration.
(3) Redundancy.
(4) Authority Limiting.
(5) Flightcrew Action to Intervene.
b. Identification of Methods. Means to assure continued performance of any system design mitigation methods should be identified. The mitigation methods should be described in the safety analysis/assessment document or be available by reference to another document (for example, a system description document).
c. FGS De-Selection. The design of typical FGS allows for the de–selection of control and guidance elements. The long–term effects on occupants and any structural implication of oscillatory failures can be mitigated by de–selection of the FGS.
87. Validation of failure conditions.
a. General. The method of validation of failure conditions will depend on the effect of the condition, any assumptions made, and any associated risk. The severity of some failure conditions may be obvious, and other conditions may be somewhat subjective. If flightcrew action is used to mitigate the propagation of the effect of a failure condition, the information available to the flightcrew to initiate appropriate action (for example, motion, alerts, and displays) and the assumed flightcrew response should 78
be identified. It is recom mended that there be early coordination with the FAA to identify any program necessary to validate any of these assumptions.
b. Validation Options. The validation options for failure conditions include the following:
(1) Analysis.
(2) Laboratory Testing.
(3) Simulation.
(4) Flight Test.
c. Validation Methodology. The validation testing and analysis should take account of architectural strategies (for example, redundant channels, high integrity components, rate limit/magnitude limiting, etc.). It is anticipated that the majority of failure condition can be validated by analysis to support the probability aspect of the §
25.1309 assessment. It may be necessary to substantiate the severity of a failure condition effect by ground simulation or flight test. This is particularly true where pilot recognition of the failure condition requires justification, or if there is some variability in the response of the airplane. Failure conditions that are projected to be less probable than 10-7 per flight hour, independent of effect severity, need not be demonstrated with a flight test. Guidance on the assessment of traditional failure conditions is provided in Chapter 9, Compliance Demonstration Using Flight Test and Simulation. New and novel functionality may require additional assessment methods to be agreed to with the authority.
88. Specific considerations. The following paragraphs identify specific considerations that should be given to potential failure conditions for various phases of flight.
a. FGS Action During Ground Operations. The potential hazard that may result due to inappropriate autopilot, autothrust, or other system control action during maintenance operations should be assessed. This includes while the airplane is parked at the gate and during taxi operations. System interlocks or crew or maintenance procedures and placards may mitigate these hazards.
b. FGS Operations in Close Proximity to the Ground. The response of the airplane to failures in the FGS could have implications for the safety of operations when the airplane is close to the ground. For the purpose of this AC, close to the ground can be assumed to be less than 500 feet above the liftoff point or touchdown zone or a runway.
A specific safety assessment should be performed if approval for operations where the autopilot is engaged or remains engaged in close proximity to the ground.