83 2 Any allowance for the acceptability of the performance of the autopilot during the basic engagement/mode transition.
3 The lowest altitude or height consistent with the response of the airplane to any identified autopilot failure condition(s).
4 Activation of an armed stall identification system, such as a stick pusher (if installed).
(e) Deviation information. If the response to the worst-case failure condition causes a significant transition below the intended vertical flightpath, the deviation information should be provided in the AFM.
(4) Autopilot engagement during approach.
(a) Deviation from flightpath. The potential deviation of the airplane from the desired flightpath due to the effect of a failure condition may necessitate the disengagement of an autopilot at an appropriate height on the approach to landing.
(b) MUH-approach. The operational MUH for approach will be established, based on the following considerations:
1 The altitude or height at which the performance of the automatic control is no longer acceptable.
2 The lowest altitude or height consistent with the response of the airplane to a subsequent autopilot failure.
3 Any specific operational consideration.
(c) Approach with vertical path reference.
1 Approaches with vertical path reference can include xLS or RNAV.
Operations using xLS can be assumed to be conducted with respect to a flightpath prescribed or established as an integral part of navigation service provided by the State. RNAV approach operations will be conducted using an onboard database that provides a navigation flightpath to the runway.
2 The operational consideration for this type of operation relates to an assessment of the adequacy of continued use of the autopilot in maintaining the desired vertical flightpath. Considerations include the lowest altitude consistent with the response of the airplane to an autopilot failure.
3 To support this determination, if one or more autopilot failure condition(s) is identified that causes a significant transition below the intended vertical flightpath, the worst-case deviation profile should be identified using the method identified in Chapter 9, paragraph 100.f(1), Approach with Vertical Path Reference, of this AC. If the failure condition(s) has a neutral effect on the flightpath, the acceptability of cues for the flightcrew
84 detection of the condition should be made. The effect of any failure condition relating to the bank angle of the airplane should be assessed.
4 For the purpose of the airworthiness assessment, the vertical flightpath an xLS and RNAV approach can be assumed to be a flightpath of 3 degrees that passes through the runway threshold at an altitude of 50 feet. Considerations for steep approaches are provided in Chapter 9, paragraph 99.d(5) of this AC.
5 The vertical flightpath control for an xLS approach will be made with reference to the path defined by the navigation service. The RNAV vertical flightpath will typically be conducted with reference to barometric altitude. An appropriate adjustment to the MUH may be necessary to take into account the vertical accuracy of RNAV operations.
Note: Temperature effect compensation should be considered as part of the operational authorization.
6 The MUH-Approach is the value identified using the method identified in AC 25-7, paragraph 181b(9)(e).
(d) Approach without vertical path reference.
1 Flight operations with no vertical path reference are conducted with an appropriate visual segment for final approach path. In the interest of providing appropriate automatic control to assist in a stabilized approach, the minimum use of the autopilot should be consistent with the performance needed for the descent (for example, vertical speed/flightpath angle) and the pilot detection and recovery from an autopilot failure.
2 To support this determination, if one or more autopilot failure conditions is identified that causes a significant transition below the intended vertical flightpath, the worst-case deviation profile should be identified. If the failure condition has a neutral effect on the flightpath but has implications for speed control during takeoff, the acceptability of cues for the flightcrew detection of the condition should be made. The effect of any failure condition relating to the bank angle of the airplane should be assessed.
3 For FGS that are failure protected (that is, fail-passive), the MUH will typically be no lower than 50 feet above runway elevation. However, when determining this limitation, account should be taken of the handling task presented to the pilot when regaining manual control, especially in limiting crosswind conditions.
4 For FGS that are not failure protected (that is, not fail-passive), the demonstrated MUH-Approach will typically be established based on the greater of the following considerations:
(aa) 50 feet above runway elevation.
(bb) Two times the height loss for the airplane as a result of any identified autopilot failure condition, using the method identified in AC 25-7, paragraph 181b(9)(e).
(5) Circling approach.
(a) For the purpose of this AC, circling approaches may be considered to have the following visual segments associated with the approach:
1 A segment at or above the minimums prescribed by the procedure that parallel the runway in the opposite direction of the landing runway, 2 A turning segment to align with the runway that can be level or partially descending, and 3 A final descending segment to landing.
(b) Operationally, the autopilot may remain engaged even after leaving the MDA(H) for reasons related to safety and flightcrew workload relief. This operational procedure should be balanced against unacceptable performance or failure characteristics. As this procedure is in the visual segment, no specific constraints for the use of the autopilot are considered necessary for this phase of flight, unless specific unacceptable performance or failure characteristics related to circling approach are identified during the certification program.
c. Climb, cruise, descent, and holding. The value of the use of the autopilot in providing flightcrew workload relief in climb, cruise, descent, and holding phases of flight should be balanced against the failure characteristics of the autopilot. No specific constraints for the use of the autopilot are considered necessary for these phases of flight, unless specific unacceptable performance or failure characteristics related to climb, cruise, or descent are identified during the certification program.
d. Maneuvering. No specific constraints for the use of the autopilot are considered necessary for maneuvering flight, unless unacceptable performance or failure characteristics are identified during the certification program. Chapter 9, paragraph 100.e, Maneuvering, of this AC provides assessment criteria for maneuvering flight for autopilot failures.
102. Automatic Disengagement of the Autopilot. The automatic disengagement of the FGS will occur for several reasons, such as system failures, sensor failures, or unusual accelerations.
The automatic disengagement characteristics of the FGS should be investigated throughout the flight envelope. These disengagement cases should be analyzed to determine the ones that can be demonstrated during the test program. For each disengagement case, the transients, warnings, and pilot workload for recovery should be evaluated, and compliance with § 25.1329(d) and (e) must be verified. The use of simulation is recommended for all conditions that are expected to result in significant transients.
103. Assessment of Human Factors.
a. General. The evaluation, demonstration, and testing should assess the acceptability of the HMI with the FGS and the potential for flightcrew errors and confusion concerning the behavior and operation of the FGS, when used by a representative range of pilots.
The evaluation of normal and non-normal FGS operations should include the representative range of conditions in terms of crew mental or physical workload, required crew response
86 timeliness, and potential for confusion or indecision. The set of test cases should represent operationally relevant scenarios and the assumptions about pilot training and skill level should be documented.
b. Flight evaluations.
(1) During certification. Flight evaluation during certification is a final assessment and is intended to validate the design.
(2) Prior to certification. Evaluations prior to certification are typically conducted in a variety of ways and at different levels of fidelity in order to finalize the design. These may include the following:
(a) Engineering evaluations and task analyses, including cognitive and physical tasks.
(b) Mock-up evaluations and demonstrations.
(c) Part-task evaluations and demonstrations.
(d) Simulator evaluations, demonstrations, and tests.
(e) Engineering flight evaluations, demonstrations, and tests.
(3) Credit to establish FGS compliance. The data and experiences from these evaluations may be useful for credit to establish FGS compliance with regulations having human factors considerations. In addition, applicants have successfully used comparisons to previously certificated designs to obtain such credit (although such credit is not assured). Additional testing may be necessary for new FGS flightcrew interface designs or functions.
(4) Simulation versus flight tests. In some cases, the FAA may consider that less flight testing may be required to show compliance, if the simulation evaluations have added confidence with respect to the reduced potential for crew error and confusion and other human factors attributes of the pilot/FGS interface.
(a) Selecting methodology. In many cases, the evaluation, demonstration, and test scenarios, including failures and environmental events, will determine whether the data should be obtained in simulation or in flight because of safety considerations or unavailability of the necessary environmental conditions.
(b) High-fidelity simulation. In some test scenarios, a very high-fidelity simulation will be needed. In addition to the simulation validation considerations identified in Chapter 9, paragraph 99.e(3)(b), Motion Base Suitability, of this AC, the simulation used may need to include the following features, depending on the functionality of the FGS:
1 Physical implementation of flight deck controls, displays, indicators, and annunciators for all flightcrew positions that are relevant to the objectives of the evaluation.
87 2 Adequate emulations of relevant equipment (hardware and software function), including capability to introduce failures.
3 Weather simulation, including gusts, turbulence, wind shear, and visibility.
4 Representation of the operational environments, including interaction with air traffic services, day/night operations, etc., as relevant to the functions and pilot tasks being evaluated.
5 Data collection capabilities.
(c) Simulation conformity. In some cases, certification credit or demonstration of compliance using simulations may not be granted due to inability to find simulation conformity. Conformity should be accounted for when seeking certification testing credit using a simulator.
c. Structured subjective evaluations. Simulator evaluations and tests are intended to generate objective and/or subjective data. It may not always be possible or necessary to obtain quantifiable measurements of flightcrew performance, even with high-fidelity flight or simulation evaluation, demonstration, or test scenarios. In these cases, evaluation procedures should be based on the use of structured subjective methods, such as rating scales, questionnaires, and/or interviews. When there is dependence on this type of data, evaluations should consider multiple data collection techniques with an appropriate number of pilot evaluators.
d. Pilot training and experience. In order to provide sound evaluations, pilots should be trained appropriately on the FGS operation and procedures. They should have experience in the kinds of operation and aircraft types for which the FGS is intended. Finally, they should be familiar with the intended function of the FGS, its operational and design philosophy, and the way that this philosophy fits with the overall flight deck and its operational and design philosophy.
e. Evaluating new or unique design features. Rationale should be provided for decisions regarding new or unique features in a design. It should be confirmed that the data resulting from the evaluations support acceptability of any new or unique features.
f. Certification planning documentation. The certification planning documentation should describe the means to show compliance with the human factors related considerations of the FGS with this AC.
104—108 [RESERVED]
88 CHAPTER 10. AIRPLANE FLIGHT MANUAL
109. General. The following paragraphs provide guidance on material to be provided in the AFM to ensure that the appropriate information related to FGS operation is translated into air carrier operations. For additional guidance, note that the current edition of AC 25.1581-1 addresses requirements of the AFM for transport category aircraft and distinguishes between those aircraft that are used in air carrier operations and those not in air carrier service.
a. AFM terminology. The terminology used in the AFM should be consistent with the intended operational use.
b. Low-visibility operations. Appropriate AFM information related to low-visibility operations are addressed in AC 120-28 and AC 120-29.
110. Information Supporting Operational Use of Autopilot.
a. General. The airworthiness certification process will assess the effect of autopilot Failure Conditions as identified in Chapters 8 and 9 of this AC. If a specific MUH is necessary, then the height should be provided in the AFM limitations section. If the design is such that the effects of one or more failure conditions do not require establishment of a MUH, then the pertinent deviation profile or height loss information should be provided in the normal or nonnormal section of the AFM, as applicable.
b. Specifying a MUH. If a MUH or a height loss value is applicable, it should be specified as follows:
(1) Takeoff—autopilot engagement altitude or height.
(2) Cruise—height loss.
(3) Approach—MUH or height loss.
(a) Approach with vertical path reference. The MUH should be determined based on clearance above a 1:29 plane using the deviation profile method, as discussed in AC 25-7, paragraph 181b(9)(e), and shown in Figure 181-2, Deviation Profile Method, of that AC.
(b) Approach without vertical path reference. The height loss should be determined using the height loss method, as discussed in AC 25-7, paragraph 181b(9)(e), and shown in Figure 181-3, Height Loss Method, of that AC.
(c) Assessment of approach with vertical path reference. As shown in AC 25-7, Figure 181-2, Deviation Profile Method.
c. Maximum displacement deviation. If minimum engagement altitude(s) or height(s) are not specified, then “maximum displacement deviation” information from a pertinent takeoff flightpath and approach profile should be provided in the AFM normal procedures section, or in the associated Flightcrew Operating Manual (FCOM).
111. Limitations. The AFM limitations section presents those FGS operating limitations appropriate to the airplane model as established in the course of the type certification process.
The FGS operational limitations listed in the AFM (should any exist) must specify any configuration/envelope restrictions. See §§ 25.1581(a)(1) and 25.1583.
112. Non-Normal/Emergency Procedures. The AFM must include non-normal or emergency procedures appropriate to the FGS identified during the certification program. See § 25.1581(a)(1) and § 25.1585(a)(2) and (3).
113. Normal Procedures.
a. Documentation of normal procedures. The normal procedures for use of the FGS must be documented in the AFM. See §§25.1581(a)(1) and 25.1585(a)(1). These procedures should be demonstrated during the type certification process.
b. Maximum displacement deviation. In lieu of specification of minimum engagement altitude(s) or height(s) (see paragraph 110 of this AC), the AFM may alternately specify “maximum displacement deviations” from a specified takeoff flightpath or from a specified approach profile. This information may be based on typical departure or approach flightpaths suited for the aircraft type and for failure conditions that are determined applicable to the type of FGS and modes suitable for use.
c. Procedures for use of FGS in icing conditions. The flight manual should include any necessary procedures for the use of the FGS in icing conditions (including moderate and heavy icing conditions). In particular, the procedures should include any necessary changes in operating speeds, required either operationally or as a result of relevant design features of the speed protection function of the FGS. For example, variations in minimum speeds as a function of deicing/anti-icing system selection, speed increments during approach, and landing in turbulence should be part of the documented procedures.
d. Aircraft with published FCOMs. The AFMs for aircraft for which the manufacturer has published a FCOM must contain essential information on normal operating procedures that are considered unique to the operation of the FGS for the aircraft type or are otherwise necessary for safe operation. See § 25.1581(a)(2). FGS description and integration with the overall flight deck design philosophy, specification, and operational procedures that are normally associated with FGSs should be included in the FCOM. If applicable, a FCOM may contain the “maximum displacement deviation” information described in paragraph 110 of this AC in either numeric or graphic form.
e. Aircraft without published FCOMs. For aircraft that rely on the AFM as the sole operating manual, the AFM must contain operating information sufficient for flightcrew reference. See § 25.1581(a)(2). The FGS description and integration with the overall flight deck design philosophy, specification and operational procedures normally associated with FGSs, should be made available so that an appropriately trained flightcrew may operate the FGS under normal conditions.
Appendix A A-1 APPENDIX A. SAFETY ASSESSMENT
1. General. This appendix provides material that may be useful in supporting the safety assessment activities identified in Chapter 8 of this AC.
2. Identification of Failure Conditions.
a. The following cases should be considered for applicability when establishing failure conditions, as indicated in Chapter 8 of this AC.
(1) Loss of autopilot in single or multiple axes.
(2) Loss of guidance in single or multiple axes.
(3) Loss of thrust control.
(4) Partial loss or degradation of autopilot function.
(5) Unintended autopilot commands in a single axis or multiple axes simultaneously (for example, hardover, slowover, and oscillatory failure modes).
(6) Unintended guidance commands in a single axis or multiple axes.
(7) Unintended thrust control.
(8) A sustained out-of-trim condition with the autopilot engaged without an alert.
(9) Autopilot disengagement in an out-of-trim condition.
(10) Autopilot disengagement without a warning.
(11) Inability to disengage the autopilot or autothrust function.
(12) Uncommanded engagement of an autopilot or autothrust.
(13) Jamming or loading of primary flight controls.
(14) Unintended thrust asymmetry.
b. A typical failure condition statement may be of the form:
‘[Failure]’ during ‘[Phase of Flight]’ that ‘[Effect]’ when ‘[Mitigation Consideration]’
c. Failure conditions may result from failures within the FGS or from failure associated with aircraft interfacing systems or components (for example, NAV receivers, attitude heading reference systems, FMS, hydraulics, electrical systems, etc.).
Appendix A A-2
3. Considerations when Assessing the Severity of Failure Condition Effects.
a. Complete definition of failure condition. The “failure condition” definition is complete (as defined in AC 25.1309-1) when the effects resulting from the failure are identified.
The complete definition of the “failure condition” and its effect will then support the subsequent failure condition hazard classification.
b. Factors to consider. When assessing the effect that results from a failure, the following factors should be considered for various phases of flight:
(1) The impact of the loss of control or unintended control on the structural integrity of the airplane as a result of simple loading or as a result of excitation of aerodynamic or structural modes—both at the time of occurrence and while the flight continues.
(2) Implications of the airplane response in terms of attitude, speed, accelerations, flightpath, and the impact on the occupants and on flightcrew performance.
(3) Degradation in the stability or other flying qualities of the airplane.
(4) The duration of the condition.
(5) The aircraft configuration.
(6) The aircraft motion cues that will be used by the flightcrew for recognition.
(7) Availability, level, and type of alerting provided to the flightcrew.
(8) Expected flightcrew corrective action on detection of the failure.
c. Possible characteristics of failure conditions. Failure conditions may include the following characteristics:
(1) “Hardover” effects. Typically, these are considered significant and are readily detectable by the flightcrew, based on the resulting aircraft motion or guidance cues.
(2) “Slowover” effects. Typically, these are not readily detected by the flightcrew.
The effect may involve departures from intended flightpath that are not initially detectable by aircraft motion alone and may be detectable only by motion cues when a significant flightpath deviation has occurred or by an appropriate flightcrew alert.
(3) “Oscillatory” effects. Typically, these are repetitive motions or guidance conditions not related to intended guidance or control. The magnitude, period, and duration of the condition and any mitigation considerations will determine the final effect.
(4) “Loss of” effects. Typically, this is the removal of control, guidance, or functionality that may have an immediate effect or may not be immediately apparent to the flightcrew.
Appendix A A-3 Note: Chapter 9 of this AC provides guidance on crew recognition considerations.
4. Failure Condition Classification. The following are examples of the type of failure condition effects that have been identified in previous airplane certification programs. The specific number and type of failure condition may vary with airplane type, airplane system architecture, and FGS design philosophy (for example, failure detection, redundancy management, failure annunciation, etc.).
a. Catastrophic failure conditions. The following effects have been assessed catastrophic in previous airplane certification programs:
(1) A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing.
(2) Unrecoverable loss of flightpath control.
(3) Exceedance of VDF/MDF (demonstrated flight diving speed/demonstrated flight diving Mach).
(4) Flutter or vibration that causes a structural failure preventing safe flight and landing.
(5) A temporary loss of control (for example, stall) where the flightcrew is unable to prevent contact with obstacles or terrain.
(6) Deviations in flightpath from which the flightcrew are unable to prevent contact with obstacles, terrain, or other aircraft.
b. Hazardous failure conditions. The following effects have been assessed hazardous in previous airplane certification programs:
(1) Exceedance of an airspeed halfway between VMO (maximum operating limit speed) and VDF or a Mach number halfway between MMO (maximum operating limit Mach) and MDF.
(2) A stall, even if the flightcrew is able to recover safe flightpath control.
(3) A load factor less than zero.
(4) Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 1000 feet (304.8 meters above an applicable airport elevation).
(5) Degradation of the flying qualities of the airplane that excessively increases flightcrew workload.
(6) Failure that could result in a rejected takeoff (RTO) and high speed overrun (for example, 60 knots).
Appendix A A-4
(7) A flightpath deviation that requires a severe maneuver to prevent contact with obstacle, terrain, or other aircraft.
Note: Severe maneuver includes risk of serious injury or death of a small number of occupants.
c. Major failure conditions. The following effects have been assessed “major” in previous airplane certification programs:
(1) A flightpath deviation, including the required recovery maneuver, which may result in passenger injuries. Consideration should be given to phases of flight where the occupants may reasonably be moving about the airplane or be serving or consuming hot drinks.
See Appendix B for the definition of significant transient.
(2) Degradation of the flying qualities of the airplane that significantly increase flightcrew workload.
Appendix B B-1 APPENDIX B. DEFINITIONS The following definitions apply to the requirements of § 25.1329 and the guidance material provided in this AC. You should not assume that these definitions apply to the same or similar terms used in other regulations or ACs. Terms for which standard dictionary definitions apply are not defined in this AC.
Table B-1. Terms and Definitions Term Definition Abnormal Condition See Non-Normal Condition.
Advisory Crew awareness is required and subsequent crew action may be required.
Alert A generic term used to describe a flight deck indication meant to attract the attention of the flightcrew to a non-normal operational or airplane system condition without implying the degree or level of urgency for recognition and corrective action by the crew.
Warnings, cautions, and advisories are considered alerts.
Analysis The terms “analysis” and “assessment” are used throughout. Each has a broad definition and the two terms are to some extent interchangeable. However, the term analysis generally implies a more specific, more detailed evaluation, while the term assessment may be a more general or broader evaluation but may include one or more types of analysis.
Arm A condition where the intent to transition to a new mode or state has been established but the criteria necessary to make that transition has not been satisfied.
Assessment See the definition of analysis above.
Autopilot The autopilot function provides automatic control of the airplane, typically in pitch, roll, and yaw. The term includes the sensors, computers, power supplies, servo-motors/actuators and associated wiring, necessary for its function. It includes any indications and controllers necessary for the pilot to manage and supervise the system. Any part of the autopilot system that remains connected to the primary flight controls when the autopilot is not in use is regarded as a part of the primary flight controls.