Change 1 88
99. Performance and demonstration (fault free): § 25.1301.
a. General .
(1) Certification Plan. The certification plan should identify the specific functionality provided by the FGS. The flight test and/or simulator program will typically assess this functionality under representative operational conditions, including applicable airplane configurations and a representative range of airplane weight, center of gravity (CG), and operational envelope.
(2) Evaluating Performance. The performance of the FGS in each of its guidance and control modes should be evaluated. The acceptability of the performance of the FGS may be based on test pilot assessment, taking into account the experience acquired from similar equipment capabilities and the general behavior of the airplane.
The FGS should be evaluated for its low and high maneuvering capability. AC 25-7C, Flight Test Guide for Certification of Transport Category Airplanes, provides additional information on FGS test procedures.
(3) Evaluating Compatibility of Mode Controls, Indications, and Alerts. The acceptability of mode controls and annunciations, any associated alerts, and general compatibility with cockpit displays should be evaluated. The FGS should be free from unexpected disengagement, and no confusion should result from FGS mode changes.
Additional considerations relating to the assessment of human factors is provided in Chapter 9, paragraph 103, Assessment of Human Factors.
b. Normal Performance.
(1) Demonstration. Normal performance is considered to be performance during operations well within the airplane’s flight envelope and with routine atmospheric and environmental conditions. Normal performance should be demonstrated over a range of conditions that represent typical conditions experienced in operational use.
(2) Evaluation. The FGS should be evaluated to determine the acceptability of the following characteristics:
(a) Stability and tracking of automatic control elements.
(b) Controllability and tracking of guidance elements.
(c) Acquisition of fli ght paths for capture modes.
(d) Consistency of integrat ion of modes (of this chapter).
(3) Expected Errors. Performance should be assessed in the presence of errors that can reasonably be expected in operation (for example, the incorrect selection of approach speed).
c. Performance in “Other Than Normal” Conditions. Other than normal conditions are the combination of “rare normal” and “non-normal” conditions. Performance in “other than normal conditions” is considered to be performance of the system under conditions that are experienced infrequently by the airplane during operational use.
Examples of rare normal and non-normal conditions are given in Chapter 5, paragraphs 54, Performance in Rare Normal Conditions, and 56, Performance in Non-Normal Conditions.
(1) Test Program. The test program should assess the FGS performance in more challenging environmental conditions (for example, winds, wind gradients, and various levels of turbulence) as the opportunity presents itself. Rare environmental conditions may require the FGS to operate at the limits of its capabilities. The intent of the evaluation is to assess the performance of the FGS under more demanding conditions that may be experienced infrequently in-service. Due to the severity of some environmental conditions, such as severe and extreme turbulence or flights into severe windshear, it is neither recommended nor required that the FGS flight evaluations include demonstration under those conditions. Those conditions are more appropriately addressed by simulator evaluation.
(2) Evaluation of FGS. The FGS should be evaluated to determine the acceptability of the following characteristics:
(a) Stability of automatic contro l elements and ability to resume tracking following any upset.
(b) Controllability of guidance elements and ability to resume tracking following any upset.
(c) Acceptability of mode transitions and overall cockpit system integration.
(3) Additional Guidance for Windshear. If the FGS provides windshear escape guidance, performance demonstration requirements should be conducted consistent with AC 25-12, Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category Airplanes.
d. Specific Performance Conditions. The following paragraphs identify specific performance conditions requiring evaluation by flight test and/or simulation.
(1) Icing Considerations. The FGS performance and safety in icing conditions should be demonstrated by flight test and/or simulation tests and be supported by analysis where necessary. The implications of continued use of the automatic flight control 89
elem ents of the FGS in icing conditions should be assessed. Ice accumulation on the airplane wings and surfaces can progressively change the aerodynamic characteristics and stability of the airplane. Even though the FGS may perform safely under these conditions, its continued use may mask this change, which, in turn, can lead to pilot handling difficulties and potential loss of control, should the autopilot become disengaged (either automatically or manually).
(a) Test Program. A test program should assess the potential vulnerability of the FGS to icing conditions by evaluating autopilot performance during artificial ice shape tests or during natural icing tests.
1 Sufficient autopilot testing a nd analysis should be conducted to ensure that the autopilot's performance is acceptable. This testing and analysis should include evaluation of the low speed protection threshold in the event that stall warning parameters are adjusted to account for icing conditions. See Chapter 5, paragraph 55, Icing Considerations in Normal and Rare Normal Conditions, for more information.
2 In general, it is not necessary to conduct an autopilot evaluation that encompasses all weights, CG positions (including lateral asymmetry), altitudes, and deceleration device configurations. However, if the autopilot performance with ice accretion shows a significant difference from the non–contaminated airplane or testing indicates marginal performance, additional tests may be necessary.
3 If significant autopilot inputs ar e required to compensate for the icing conditions, then the acceptability of the indication of a significant out of trim condition should be assessed, and the subsequent response of the airplane when the autopilot disengages (manual or automatic) should be determined. See Chapter 3, paragraph 27b, Autopilot Disengagement, and Chapter 4, paragraph 45d, Awareness of Potential Significant Transient Condition (“Bark Before Bite”), for more information.
(b) De-icing. If the airplane is configured with a de-icing system, the autopilot should demonstrate satisfactory performance during the shedding of ice from the airplane.
(c) Airplane Flight Manual (AFM) Limitations. Where degradation is noted which is not significant enough to require changes to the autopilot system or to de-icing or anti-icing systems, appropriate limitations and procedures should be established and presented in the AFM.
(2) Low-Speed Protection. The FGS should be assessed for the acceptability of the low speed protection performance under the following conditions:
(a) High altitude cruise w ith a simulated engine failure.
(b) Climb to altitude capture at lo w altitude with a simulated engine failure during capture.
(c) Vertical speed with insufficient climb power.
(d) Approach with speed abuse.
(3) High-Speed Protection. The FGS should be assessed for the acceptability of the high-speed protection performance under the following conditions:
(a) High altitude level f light with autothrust function.
(b) High altitude level f light without autothrust function.
(c) High altitude descending flight with autothrust function.
(4) Go-Around.
(a) Mode Assessment. The objective of the Go–Around mode (see Chapter 6, paragraph 65b, Go-Around Mode) is to quickly change the flight path of the airplane from approach to landing to a safe climbout trajectory. The mode has specific utility in low visibility conditions when operations are predicated on a DA/H, and a go-around is necessary if visual references are not acquired at the DA/H. Therefore, the assessment of the Go-Around mode may be conducted in conjunction with the evaluation of the FGS to support low visibility operations, using additional criteria contained in AC 120-28D and AC 120-29A.
(b) Flight Evaluation. The flight evaluation should be conducted to assess the rotation characteristics of the airplane and the performance of the airplane in acquiring and maintaining a safe flight path. The acceptability of the operation if contact is made with the runway during the missed approach or balked landing should be established.
1 Factors to be considered. A demonstration program should be established that confirms acceptable operation when the following factors are considered:
(aa) Airplane weight and CG.
(bb) Various landing configurations.
(cc) Use of manual thrust or autothrust.
(dd) Consequences of thrust de–rates with selection of Go-Around mode.
(ee) An engine failu re at the initiation of go-around.
Change 1
(ff) An engine failure during go–around after go–around power is reached.
(gg) Initiation altitude (f or example, in ground effect, not in ground effect during flare).
2 Characteristics to be evaluated:
(aa) The pitch response of th e airplane during the initial transition.
(bb) Speed performance dur ing airplane reconfiguration and climbout.
(cc) Integrated aut opilot and autothrust operation.
(dd) Transition to missed approach altitude.
(ee) Lateral performance during an engine failure.
3 Go-Around Initiation Heights. Where height loss during a go– around maneuver is significant or is required to support specific operational approval, demonstrated values for various initiation heights should be included in the AFM.
(5) Steep Approach [special authorization].
(a) Flight Test/Simulator Demonstration. Typical approach operations include glidepath angles between 2.75 and 3.77 degrees. Application for approval to conduct operations on glidepath angles of greater than 3.77 degrees requires additional evaluation. See AC 120-29A, section 4.3, Landing, for further discussion. For such an approval, the FGS flight test and simulator demonstration should include the following:
1 Approach path capture, tracking, and speed control.
2 Recovery of the system from a buse cases (for example, glidepath angle and speed).
3 Assessment of autopilot disengagement transient.
4 Demonstration of Go–Around mode from a steep approach.
(b) Autopilot Use on Steep Approaches. For autopilot use at approach angles greater than 4.5 degrees, the criteria of AC 25-7C, Flight Test Guide for Certification of Transport Category Airplanes, Chapter 8, Airworthiness-Miscellaneous Items, should be satisfied. This advisory material contains airworthiness and transition criteria for steep approaches. In addition, the criteria of AC 120-29A, Criteria for 92
Approval of Category I and II W eather Minima for Approach, paragraph 6.2.8, Approach Ban Applicability, should be assessed depending on the operational and low visibility requirements.
(6) Indication Of and Response To an Out Of Trim Condition. An assessment should be performed to determine the acceptability of the out of trim annunciation and subsequent response to disengagement. (See Chapter 4, paragraph 45d, Awareness of Potential Significant Transient Condition (“Bark Before Bite”)).
e. Flight Director (FD)/Head Up Display (HUD).
(1) General. The guidance aspect of an FGS may be provided by a head down FD or a HUD. Head down displays (HDD) normally utilize FD guidance cues that provide steering commands—such as a cross pointer or single “V”—for the pilot to follow. HUDs normally display a flight path vector that represents the instantaneous flight path. The vector is based on the aircraft energy state and directional vectors.
Various new display media are evolving (for example, enhanced vision system (EVS) and simulated vision system) that may integrate guidance elements with situational elements.
(a) Flight Test or Simulator Program. The flight test or simulator program should demonstrate that the FD or HUD guidance elements provide smooth, accurate, and damped guidance in all applicable modes to achieve satisfactory control task performance without pilot compensation or excessive workload.
(b) Performance. The FD guidance should provide adequate performance for operations under the conditions listed below. Some pilot compensation may be acceptable for these conditions:
1 Stability augmentation off.
2 Alternate fly-by-wire control m odes (for example, direct law), if any.
3 An engine inoperative.
(c) Non–Stationary Tracking Reference. Flight directors designed to work with a non-stationary tracking reference (such as a flight path angle or flight path vector which are commonly used with HUD guidance) should be evaluated in conditions which bring these guidance symbols to the field of view limits of the display. Crosswinds and certain combinations of airspeed, gross weight, CG, and flap/slat/gear configurations might cause such conditions. At these limits the dynamics of the guidance response to pilot control inputs can differ, with potentially adverse affects on tracking performance, pilot compensation, and workload.
(d) Primary Instrument References. It should be demonstrated that movement of the FD and its tracking reference do not interfere with primary instrument references throughout their range of motion. The pilot’s ability to interpret the guidance and essential flight information should not be adversely affected by the movement dynamics or range of motion.
(2) Specific Demonstrations For HUD.
(a) Compliance. These demonstrations are intended to show compliance with the following paragraphs of this AC:
1 Chapter 3, paragraph 28, FD Engagement, Disengagement, and Indications
2 Chapter 4, paragraph 44, FGS Mode Selection, Annunciation, and Indication
3 Chapter 4, paragraph 46, FGS Considerations for Head Up Displays (HUD)
4 Chapter 5, paragraph 53, Normal Performance (specifically, criteria for FD guidance)
(b) Demonstrations Required. When the pilot flying (PF) is using the HUD, the HUD is where the pilot is looking for the basic flight information, and the pilot is less likely to be scanning the head down instruments. Therefore, the following should be demonstrated:
1 The location and presentation of the HUD information (for example, guidance, flight information, and alerts/annunciations) does not distract the pilot or obscure the pilot’s outside view. For example, the pilot should be able to track the guidance to the runway without having the view of runway references or hazards along the flight path obscured by the HUD symbology.
2 Pilot awareness of primary f light information, annunciations, and alerts is satisfactory when using any HUD display mode. Some display modes that are designed to minimize “clutter” could degrade pilot awareness of essential information.
For example, a “digital–only” display mode may not provide sufficient speed and altitude awareness during high–speed descents.
3 It should be demonstrated that the pilot can positively detect cases when conformal symbology is field of view limited.
4 Approach mode guidance, if provided, should be satisfactory throughout the intended range of conditions, including at the minimum approach speed and maximum crosswind with expected gust components, for which approval is sought.
5 Visual cautions and warnings associated with the FGS can be immediately detected by the PF while using the HUD.
6 The PF can immediately respond to windshear warnings, ground proximity warnings, TCAS warnings, and other warnings requiring immediate flight control action, such as a go–around, while using the HUD without having to revert to a head down flight display.
(c) Pilot Not Flying (PNF). In certain phases of flight, it is important that the PNF and the flightcrew be aware of problems with the HUD used by the PF.
Therefore, it should also be demonstrated that the PNF can immediately be made aware of any visual cautions and warnings associated with the HUD for applicable phases of flight.
(d) Approach Mode. If Approach mode guidance is provided, satisfactory performance should be demonstrated throughout the intended range of operating conditions for which approval is sought. For example, performance should be demonstrated at the minimum approach speed and maximum crosswind with expected gust components.
(e) Recovery Guidance. If recovery guidance is provided, it should be demonstrated that the pilot can immediately detect and recover from unusual attitudes when using the HUD. Specialized unusual attitude recovery symbology, if provided, should be shown to provide unequivocal indications of the attitude condition (for example, sky/ground, pitch, roll, and horizon) and to correctly guide the pilot to the nearest horizon. The stroke presentation of flight information on a HUD may not be as inherently intuitive for recognition and recovery as the conventional HDD (for example, contrasting color, area fill, shading vs. line strokes). The HUD display design needs to be able to compensate for these differences to provide adequate pilot recognition and recovery cues.
(3) Simulator Demonstration for HUD. If a pilot-in-the-loop flight simulation is used for some demonstrations, then a high fidelity, engineering quality facility is typically required. The level of simulator may vary with the functionality being provided and the types of operation being conducted. Factors for validation of the simulation for demonstration purposes include the following:
(a) Guidance and control system interfaces.
(b) Motion base suitability.
(c) Adequacy of stab ility derivative estimates used.
(d) Adequacy of any simplificati on assumptions used for the equations of motion.
(e) Fidelity of flight controls a nd consequent simulated aircraft response to control inputs. (A correlation of the simulator performance to flight test results should be made.)
(f) Fidelity of the simulation of ai rcraft performance. (A correlation of the simulator performance to flight test results should be made.)
(g) Adequacy of flight deck instruments and displays.
(h) Adequacy of simulator and di splay transient response to disturbances or failures (for example, engine failure, auto-feather, electrical bus switching).
(i) Visual reference av ailability, fidelity, and delays.
(j) Suitability of visibility restriction models, such as appropriate calibration of visual references for the tests to be performed for day, night, and dusk conditions.
(k) Fidelity of any other signifi cant factor or limitation relevant to the validity of the simulation.
f. Flightcrew Override of the FGS. A flight evaluation should be conducted to demonstrate compliance with Chapter 3, paragraph 30, Override of the FGS. The flight evaluation should consider the implication of system configuration for various flight phases and operations.
(1) Autopilot Override.
(a) Assessing Effect. The effect of flightcrew override should be assessed by applying an input on the cockpit controller (for example, the control column or equivalent) to each axis for which the FGS is designed to disengage. The evaluation should be repeated with progressively increasing rate of force application to assess FGS behavior. This assessment should include the initial application of force on the cockpit controller as well as when the force is removed from the controllers. The effects of speed and altitude should be considered when conducting the evaluation.
(b) No Automatic Disengagement. If the autopilot is designed such that it does not automatically disengage due to a pilot override, verify that no potential hazards are generated due to the override per Chapter 3, paragraph 30.
(c) Multiple Channel Engagement. If the design of the autopilot provides for multiple channel engagement for some phases of flight that results in a higher override force, these conditions should be evaluated.
97 Note: AC 120-28D, Appendix 3, Airworthiness Approval for Airborne Systems Used to Land and Rollout in Low Visibility Conditions, Section 8, Airborne Systems, contains guidance for evaluating autopilot override for systems supporting low visibility operations.
(2) Autothrust Override. The capability of the flightcrew to override the autothrust system should be conducted at various flight phases. The evaluation should include an override of the autothrust system with a single hand on the thrust levers while maintaining control of the airplane using the opposite hand on the control wheel (or equivalent). This action may not result in a potential hazard per § 25.1329(m), either during the override or after the pilot releases the thrust levers. Refer to Chapter 3, paragraph 30 of this AC for additional guidance. If the autothrust system automatically disengages due to the override, the alerts that accompany the disengagement should be assessed to ensure flightcrew awareness.
(3) Pitch Trim System Evaluation During Autopilot Override.
(a) Effect of Override. The effect of flightcrew override during automatic control on the automatic trim systems should be conducted. The pilot should also apply an input to the pitch cockpit controller below that which would cause the autopilot to disengage and verify that the automatic pitch trim system meets the intent in Chapter 3, paragraph 30.
(b) No Automatic Disengagement. If the system design is such that the autopilot does not have an automatic disengagement on override feature, the pilot should initiate an intentional override for an extended period of time. The autopilot should then be disengaged with the quick disconnect button and any transient response assessed in compliance with Chapter 3, paragraph 30. The effectiveness and timeliness of any alerts used to mitigate the effects of the override condition should be assessed during this evaluation.
100. Failure conditions requiring validation: § 25.1309.
a. General.
(1) Safety Assessment. The safety assessment process identified in Chapter 8 should identify any failure condition responses that would require pilot evaluation to assess the severity of the effect, and the validity of any assumptions used for pilot recognition and mitigation. The classification of a failure condition can vary according to flight condition and may need to be confirmed by simulator or flight test.
(2) Evaluation of Failure Conditions. This chapter provides guidance on the test criteria, including recognition considerations, for flight evaluation of these failure conditions. In addition, certain probable failures should be demonstrated to assess the performance of the FGS and the adequacy of any applicable flightcrew procedures.
Change 1
AC 25-7C, paragraph 181b(9), provides guidance on test m ethods for particular types of failure condition that have been identified by the safety assessment.
b. Validation Elements.
(1) Assessment. The safety assessment described in Chapter 8 establishes the FGS failure condition for which appropriate testing should be undertaken. Assessment of failure conditions has the following elements:
(a) Failure condition insertion.
(b) Pilot rec ognition of the effects of the failure condition.
(c) Pilot reaction time. That is , the time between pilot recognition of the failure condition and initiation of the recovery.
(d) Pilot recovery.
(2) Failure Condition.
(a) Autopilot. Failure conditions of the autopilot should be simulated such that overall response is representative of how that failure condition would affect the airplane and its systems. Failure conditions should include multi–axis failures and automatic trim failures, if those failure conditions exist (given the architecture of a specific FGS) and are relevant to the safety assessment.
(b) Flight Director (FD). FD failure conditions should be validated, if those failure conditions are relevant to the safety assessment.
(c) Most Critical Conditions. The flight conditions under which the failure condition is inserted should be the most critical. Examples of these flight conditions are CG, weight, flap setting, altitude, speed, power, and thrust. If an autothrust system is installed, the tests should be performed with the autothrust system engaged or disengaged, whichever is the more adverse case.
(3) Pilot Recognition.
(a) General. The pilot may detect a failure condition through airplane motion cues or by cockpit flight instruments and alerts. The specific recognition cues will vary with flight condition, phase of flight, and crew duties.
(b) Hardover. The recognition point should be that at which a pilot operating in non-visual conditions may be expected to recognize the need to take action.
Recognition of the effect of the failure may be through the behavior of the airplane (for example, in the pitch axis by aircraft motion and associated normal acceleration cues and in the roll axis by excessive bank angle) or an appropriate alerting system. Control 98
colum n or wheel movements alone should not be used for recognition. The recognition time should not normally be less than 1 second. If a recognition time of less than 1 second is asserted, specific justification will be required. For example, additional tests may be required to ensure that the recognition time is representative in light of the cues available to the pilot.
(c) Slowover. This type of failure condition is typically recognized by a path deviation indicated on primary flight instruments (for example, course deviation indicator (CDI), altimeter, or vertical speed indicator). It is important that the recognition criteria are agreed upon with the FAA. The following identify examples of recognition criteria as a function of flight phase:
1 En–route cruise. Recognition th rough the altitude alerting system can be assumed for vertical path deviation. The lateral motion of the airplane may go unrecognized for a significant period of time, unless a bank angle alerting system is installed and the slowover results in a bank angle in excess of the limit allowed by the alerting system.
2 Climb and descent. Recognition through increasing/decreasing vertical speed, pitch attitude, roll attitude, or heading can be assumed.
3 On an approach with vertical path reference. A displacement recognition threshold should be identified and selected for testing that is appropriate for the display(s) and failure condition(s) to be assessed.
Note 1: For an ILS or GLS approach in a significant wind gradient, a value of 1 dot on the displayed ILS/GLS deviation scale is considered a reasonable value for crew recognition. In smooth atmospheric conditions with steady state tracking with the vertical flight path typically maintained at less than a fraction of a needle width, a detection and recognition threshold even below 1/2 dot may be suitable.
Note 2: For RNAV systems that do not use dots, some multiple of needle width related to an established crew monitoring tolerance of normal performance may be appropriate (for example, three needle widths of deviation on the VNAV scale).
Note 3: Credit may be taken for excessive deviation alerts, if available.
4 On an approach without vertical path reference, criteria similar to the climb/descent condition can be assumed.
(d) Oscillatory. It is assumed that oscillatory failures that have structural implications are addressed under 14 CFR Part 25, Subpart C, and § 25.1309. It can be assumed that the flightcrew will disengage the automatic control elements of the FGS that have any adverse oscillatory effect and will not follow any adverse oscillatory 99