Note: ACs 120-29A and AC 120-28D identify additional considerations and criteria for operating the airplan e in low visibility conditions.
(1) Takeoff. If approval is sought for engagement of the autopilot below 500 feet after liftoff, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path, the speed control, and the bank angle of the airplane should be conducted. An autopilot minimum engage height - takeoff will be established based, in part, on the characteristics of the airplane in response to the failures and the acceptability of flightcrew recognition of the condition. A pilot assessment of certain failure conditions may be required (See Chapter 9, Compliance Demonstration Using Flight Test and Simulation). The minimum engage height – takeoff based upon this assessment should be provided in the AFM.
(a) Vertical Axis Assessment.
1 The operational objective during th e initial climb is to maintain an appropriate climb profile to assure obstacle clearance and to maintain an appropriate speed profile during climbout (See Chapter 6, Characteristics of Specific Modes).
2 The FGS failure conditions s hould be assessed for the potential for a significant reduction in the net takeoff flight path below 500 feet and a significant increase in pitch attitude that results in the airplane speed dropping to unacceptable values.
3 For failure conditions that are lik ely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and documented in AFM limitations or procedures, if those failure conditions require operational limitations or flightcrew procedures.
(b) Lateral Axis Assessment.
1 The operational objective during th e initial climb is to maintain an appropriate heading or track to provide separation from potential adjacent runway operations.
2 The FGS failure conditions shoul d be assessed for the potential for producing a bank angle that results in significant deviation from the runway track or intended track.
3 For failure conditions that are lik ely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and, as necessary, documented in AFM limitations or procedures.
(2) Approach.
(a) Assessment of Failure Conditions. If the autopilot is to remain engaged below 500 feet above the touchdown zone during approach, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path, the speed control, and the bank angle of the airplane should be conducted. The lowest point on the approach appropriate for the use of the autopilot will be established based on the characteristics of the airplane in response to the failure conditions and the acceptability of flightcrew recognition of the condition. See Chapter 9 for details regarding how these failure conditions on approach should be assessed.
(b) Approach Operations.
1 A number of approach oper ations may be conducted using automatic flight control. These can include, but are not limited to, the following:
(aa) ILS, MLS, and GLS
(bb) RNAV (e.g., LNAV and VNAV)
(cc) NAV (for example, VOR, LOC, and Backcourse)
(dd) Open loop flight path management (for example, vertical speed, flight path angle, track or heading select).
2 Some operations may be conducte d with a single autopilot channel engaged, and some operations may be conducted with multiple autopilots engaged. The engagement of multiple autopilots may have the effect of mitigating the effect of certain failure conditions. The effectiveness of these mitigation methods should be established.
3 The type of operation and the prevailing visibility conditions will determine the decision altitude/decision height (DA(H)) or minimum descent altitude/height (MDA(H)) for a particular flight operation. The operation may continue using automatic flight control if the visual requirements are met.
4 The lowest altitude at which the autopilot should remain engaged may vary with the type of operation being conducted. The resultant flight path deviation from any significant failure condition would impact the autopilot minimum operational use height. The minimum use height (MUH) for approach should be provided in the AFM.
(c) Vertical Axis Assessment.
1 The operational objective during the approach is to maintain an appropriate descent profile to assure obstacle clearance and to maintain an appropriate speed profile.
2 FGS failure conditions should be assessed for the potential for a significant reduction in the approach flight path when below 500 feet above touchdown and for a significant increase in pitch attitude that results in the airplane speed dropping to unacceptable values.
3 For failure conditions that are lik ely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and documented in AFM limitations or procedures, if those failure conditions require operational limitations or flightcrew procedures.
(d) Lateral Axis Assessment.
1 The operational objective during the approach is to maintain an appropriate track to provide alignment with the runway centerline or intended flight path to support the landing.
2 The FGS failure conditions s hould be assessed for the potential for producing a bank angle that results in significant deviation from the runway track or intended track.
3 For failure conditions that are lik ely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and, as necessary, documented in AFM limitations or procedures.
c. Cruise Operations. The primary concerns during cruise operations are adverse effects that the airplane response to failure conditions may have on the structure of the airplane and to the occupants. At a minimum, the accelerations and attitude resulting from any failure condition should be assessed. The mitigation of the effect of a failure condition by the flightcrew may not be as immediate as during takeoff and landing operations. Chapter 9, Compliance Demonstration Using Flight Test and Simulation, provides guidance and considerations for this phase of flight.
d. Asymmetric Thrust During Autothrust Operation. During autothrust operation, it is possible that a failure (for example, engine failure, throttle lever jam, or thrust control cable jam) could result in a significant asymmetric thrust failure condition that may be aggravated by the continued use of the autothrust system. Because the FGS could potentially compensate for the asymmetric condition with roll (and possibly yaw) control, the pilot may not immediately be aware of the developing situation. Therefore, an alert should be considered as a means of mitigation to draw the pilot’s attention to an asymmetric thrust condition during FGS operation.
89. Failure to disengage the FGS. The requirement for quick disengagement for the autopilot and autothrust functions is intended to provide a routine and intuitive means for 82
the flightcrew to quickly disengage those functions. The im plication of failures that preclude the quick disengagement from functioning should be assessed consistent with the guidelines of AC 25.1309-1A. [See § 25.1329(b)] This assessment should consider the effects of failure to disengage the autopilot and/or autothrust functions during the approach using the quick disengagement controls. The feasibility of the use of the alternative means of disengagement defined in Chapter 3, paragraph 27b(4), Alternative Means of Autopilot Disengagement, should be assessed. If the assessment indicates the aircraft can be landed manually with the autopilot and/or autothrust engaged, this should be demonstrated in flight test.
90 — 97 [Reserved]
This page left blank.
Chapter 9 Compliance Demonstration Using Flgiht Test and Simulation
98. General.
a. Methods of Compliance Demonstration. Validation of the performance and integrity of FGS operation will typically be accomplished by a combination of analysis, laboratory test, simulation, and flight test. This chapter focuses on compliance demonstration by flight test or simulation with flightcrew participation. The chapter includes the evaluation necessary to confirm acceptable performance of intended functions, including the human-machine interface and the acceptability of failure scenarios. The specific requirements for flight or simulator evaluation will consider the specifics of the applicant’s design, the supporting engineering analysis, and the scope and depth of the applicant’s laboratory testing. The type and extent of the various validation methods may vary, depending upon the FGS functionality, certification considerations, the applicant’s facilities, and other practical and economic constraints.
b. Criteria for Establishing Compliance. The criteria to be used for establishing compliance with §§ 25.1301, 25.1309, and 25.1329 may be found in Chapters 3 through 8 of this document.
c. Elements of Certification Flight Test. The certification flight test program should investigate representative phases of flight and aircraft configurations used by the FGS. The program should evaluate all of the FGS modes through appropriate maneuvers and representative environmental conditions, including turbulence. Combinations of FGS elements (for example, autopilot engaged and autothrust disengaged) should be considered. Certain failure scenarios may require flight or simulator demonstration. The airplane should be equipped with sufficient instrumentation to record the parameters appropriate to the test. Examples of parameters that could be recorded include normal acceleration, airspeed, height, pitch, and roll angles, and autopilot engagement state. The flight test instrumentation should not affect the behavior of the FGS or any other system.
d. Pilot–in–the–Loop Evaluation. An important part of the pilot-in-the-loop evaluation is validation of human factors. A thorough evaluation of the human–machine interface is required to ensure safe, effective, and consistent FGS operation. Portions of this evaluation will be conducted during flight test. Representative simulators can be used to accomplish the evaluation of human factors and workload studies. The level and fidelity of the simulator used should be commensurate with the certification credit being sought, and its use should be agreed upon with the FAA.
Change 1
e. Other Applicable Guidance Material for FGS Ta keoff and/or Approach Modes.
(1) Criteria to Consider. The following criteria should be considered for applicability in developing the overall and integrated flight test and simulation requirements:
(a) AC 120-29A, Criteria for Approval of Category I and II Weather Minima for Approach.
(b) AC 120-28D, Criteria for A pproval of Category III Weather Minima for Takeoff, Landing, and Rollout need to be included in the requirements to be tested.
(2) Procedures to Show Compliance. Procedures that may be used to show compliance are provided in AC 25-7C, Flight Test Guide For Certification of Transport Category Airplanes (See paragraph 181, Automatic Pilot System - § 25.1329).
f. Relationship of AC Chapters. Figure 9-1 depicts the relationship between this chapter and the other chapters contained within this AC.
Change 1
Figure 9-1 Relationship Betw een AC Chapters
Safety Assessment Analysis Only FGS AnalysisCHAPTER 8 Flight Validation Failure Conditions Flight Test & Simulation
CHAPTER 10 AFM Flight Test Simulator Test Criteria CHAPTER 9 Test Methods FGS Function CHAPTERS 3 - 7
AC 25-7C
Change 1 88
99. Performance and demonstration (fault free): § 25.1301.
a. General .
(1) Certification Plan. The certification plan should identify the specific functionality provided by the FGS. The flight test and/or simulator program will typically assess this functionality under representative operational conditions, including applicable airplane configurations and a representative range of airplane weight, center of gravity (CG), and operational envelope.
(2) Evaluating Performance. The performance of the FGS in each of its guidance and control modes should be evaluated. The acceptability of the performance of the FGS may be based on test pilot assessment, taking into account the experience acquired from similar equipment capabilities and the general behavior of the airplane.
The FGS should be evaluated for its low and high maneuvering capability. AC 25-7C, Flight Test Guide for Certification of Transport Category Airplanes, provides additional information on FGS test procedures.
(3) Evaluating Compatibility of Mode Controls, Indications, and Alerts. The acceptability of mode controls and annunciations, any associated alerts, and general compatibility with cockpit displays should be evaluated. The FGS should be free from unexpected disengagement, and no confusion should result from FGS mode changes.
Additional considerations relating to the assessment of human factors is provided in Chapter 9, paragraph 103, Assessment of Human Factors.
b. Normal Performance.
(1) Demonstration. Normal performance is considered to be performance during operations well within the airplane’s flight envelope and with routine atmospheric and environmental conditions. Normal performance should be demonstrated over a range of conditions that represent typical conditions experienced in operational use.
(2) Evaluation. The FGS should be evaluated to determine the acceptability of the following characteristics:
(a) Stability and tracking of automatic control elements.
(b) Controllability and tracking of guidance elements.
(c) Acquisition of fli ght paths for capture modes.
(d) Consistency of integrat ion of modes (of this chapter).
(3) Expected Errors. Performance should be assessed in the presence of errors that can reasonably be expected in operation (for example, the incorrect selection of approach speed).
c. Performance in “Other Than Normal” Conditions. Other than normal conditions are the combination of “rare normal” and “non-normal” conditions. Performance in “other than normal conditions” is considered to be performance of the system under conditions that are experienced infrequently by the airplane during operational use.
Examples of rare normal and non-normal conditions are given in Chapter 5, paragraphs 54, Performance in Rare Normal Conditions, and 56, Performance in Non-Normal Conditions.
(1) Test Program. The test program should assess the FGS performance in more challenging environmental conditions (for example, winds, wind gradients, and various levels of turbulence) as the opportunity presents itself. Rare environmental conditions may require the FGS to operate at the limits of its capabilities. The intent of the evaluation is to assess the performance of the FGS under more demanding conditions that may be experienced infrequently in-service. Due to the severity of some environmental conditions, such as severe and extreme turbulence or flights into severe windshear, it is neither recommended nor required that the FGS flight evaluations include demonstration under those conditions. Those conditions are more appropriately addressed by simulator evaluation.
(2) Evaluation of FGS. The FGS should be evaluated to determine the acceptability of the following characteristics:
(a) Stability of automatic contro l elements and ability to resume tracking following any upset.
(b) Controllability of guidance elements and ability to resume tracking following any upset.
(c) Acceptability of mode transitions and overall cockpit system integration.
(3) Additional Guidance for Windshear. If the FGS provides windshear escape guidance, performance demonstration requirements should be conducted consistent with AC 25-12, Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category Airplanes.
d. Specific Performance Conditions. The following paragraphs identify specific performance conditions requiring evaluation by flight test and/or simulation.
(1) Icing Considerations. The FGS performance and safety in icing conditions should be demonstrated by flight test and/or simulation tests and be supported by analysis where necessary. The implications of continued use of the automatic flight control 89
elem ents of the FGS in icing conditions should be assessed. Ice accumulation on the airplane wings and surfaces can progressively change the aerodynamic characteristics and stability of the airplane. Even though the FGS may perform safely under these conditions, its continued use may mask this change, which, in turn, can lead to pilot handling difficulties and potential loss of control, should the autopilot become disengaged (either automatically or manually).
(a) Test Program. A test program should assess the potential vulnerability of the FGS to icing conditions by evaluating autopilot performance during artificial ice shape tests or during natural icing tests.
1 Sufficient autopilot testing a nd analysis should be conducted to ensure that the autopilot's performance is acceptable. This testing and analysis should include evaluation of the low speed protection threshold in the event that stall warning parameters are adjusted to account for icing conditions. See Chapter 5, paragraph 55, Icing Considerations in Normal and Rare Normal Conditions, for more information.
2 In general, it is not necessary to conduct an autopilot evaluation that encompasses all weights, CG positions (including lateral asymmetry), altitudes, and deceleration device configurations. However, if the autopilot performance with ice accretion shows a significant difference from the non–contaminated airplane or testing indicates marginal performance, additional tests may be necessary.
3 If significant autopilot inputs ar e required to compensate for the icing conditions, then the acceptability of the indication of a significant out of trim condition should be assessed, and the subsequent response of the airplane when the autopilot disengages (manual or automatic) should be determined. See Chapter 3, paragraph 27b, Autopilot Disengagement, and Chapter 4, paragraph 45d, Awareness of Potential Significant Transient Condition (“Bark Before Bite”), for more information.
(b) De-icing. If the airplane is configured with a de-icing system, the autopilot should demonstrate satisfactory performance during the shedding of ice from the airplane.
(c) Airplane Flight Manual (AFM) Limitations. Where degradation is noted which is not significant enough to require changes to the autopilot system or to de-icing or anti-icing systems, appropriate limitations and procedures should be established and presented in the AFM.
(2) Low-Speed Protection. The FGS should be assessed for the acceptability of the low speed protection performance under the following conditions:
(a) High altitude cruise w ith a simulated engine failure.
(b) Climb to altitude capture at lo w altitude with a simulated engine failure during capture.
(c) Vertical speed with insufficient climb power.
(d) Approach with speed abuse.
(3) High-Speed Protection. The FGS should be assessed for the acceptability of the high-speed protection performance under the following conditions:
(a) High altitude level f light with autothrust function.
(b) High altitude level f light without autothrust function.
(c) High altitude descending flight with autothrust function.
(4) Go-Around.
(a) Mode Assessment. The objective of the Go–Around mode (see Chapter 6, paragraph 65b, Go-Around Mode) is to quickly change the flight path of the airplane from approach to landing to a safe climbout trajectory. The mode has specific utility in low visibility conditions when operations are predicated on a DA/H, and a go-around is necessary if visual references are not acquired at the DA/H. Therefore, the assessment of the Go-Around mode may be conducted in conjunction with the evaluation of the FGS to support low visibility operations, using additional criteria contained in AC 120-28D and AC 120-29A.
(b) Flight Evaluation. The flight evaluation should be conducted to assess the rotation characteristics of the airplane and the performance of the airplane in acquiring and maintaining a safe flight path. The acceptability of the operation if contact is made with the runway during the missed approach or balked landing should be established.
1 Factors to be considered. A demonstration program should be established that confirms acceptable operation when the following factors are considered:
(aa) Airplane weight and CG.
(bb) Various landing configurations.
(cc) Use of manual thrust or autothrust.
(dd) Consequences of thrust de–rates with selection of Go-Around mode.
(ee) An engine failu re at the initiation of go-around.