71 1 Factors to be considered. A demonstration program should be established that confirms acceptable operation when the following factors are considered:
(aa) Airplane weight and CG.
(bb) Various landing configurations.
(cc) Use of manual thrust or autothrust.
(dd) Consequences of thrust derates with selection of Go-Around mode.
(ee) An engine failure at the initiation of go-around.
(ff) An engine failure during go-around after go-around power is reached.
(gg) Initiation altitude (for example, in ground effect, not in ground effect during flare).
2 Characteristics to be evaluated:
(aa) The pitch response of the airplane during the initial transition.
(bb) Speed performance during airplane reconfiguration and climbout.
(cc) Integrated autopilot and autothrust operation.
(dd) Transition to missed approach altitude.
(ee) Lateral performance during an engine failure.
3 Go-around initiation heights. Where height loss during a go-around maneuver is significant or is required to support specific operational approval, demonstrated values for various initiation heights should be included in the AFM.
(5) Steep approach (special authorization).
(a) Flight test/simulator demonstration. Typical approach operations include glidepath angles between 2.75 and 3.77 degrees. Application for approval to conduct operations on glidepath angles of greater than 3.77 degrees requires additional evaluation. See AC 120-29, section 4.3, Landing, for further discussion. For such an approval, the FGS flight test and simulator demonstration should include the following:
1 Approach path capture, tracking, and speed control.
2 Recovery of the system from abuse cases (for example, glidepath angle and speed).
3 Assessment of autopilot disengagement transient.
72 4 Demonstration of Go-Around mode from a steep approach.
(b) Autopilot use on steep approaches. For autopilot use at approach angles greater than 4.5 degrees, the criteria of AC 25-7C, Chapter 8, Airworthiness: Miscellaneous Items, should be satisfied. This advisory material contains airworthiness and transition criteria for steep approaches. In addition, the criteria of AC 120-29, paragraph 6.2.8, “Approach Ban” Applicability, should be assessed depending on the operational and low-visibility requirements.
(6) Indication of and response to an out-of-trim condition. An assessment should be performed to determine the acceptability of the out-of-trim annunciation and subsequent response to disengagement. (See Chapter 4, paragraph 45.d of this AC.)
e. FD/HUD.
(1) General. The guidance aspect of an FGS may be provided by a head-down FD or a HUD. HDDs normally use FD guidance cues that provide steering commands—such as a cross-pointer or single “V”—for the pilot to follow. HUDs normally display a flightpath vector that represents the instantaneous flightpath. The vector is based on the aircraft energy state and directional vectors. Various new display media are evolving (for example, Enhanced Vision Systems (EVS) and simulated vision system) that may integrate guidance elements with situational elements.
(a) Flight test or simulator program. The flight test or simulator program should demonstrate that the FD or HUD guidance elements provide smooth, accurate, and damped guidance in all applicable modes to achieve satisfactory control task performance without pilot compensation or excessive workload.
(b) Performance. The FD guidance should provide adequate performance for operations under the conditions listed below. Some pilot compensation may be acceptable for these conditions:
1 Stability augmentation off.
2 Alternate fly-by-wire control modes (for example, direct law), if any.
3 An engine inoperative.
(c) Non-stationary tracking reference. FDs designed to work with a nonstationary tracking reference (such as a flightpath angle or flightpath vector, which are commonly used with HUD guidance) should be evaluated in conditions, which bring these guidance symbols to the field of view limits of the display. Crosswinds and certain combinations of airspeed, gross weight, CG, and flap/slat/gear configurations might cause such conditions. At these limits, the dynamics of the guidance response to pilot control inputs can differ, with potentially adverse effects on tracking performance, pilot compensation, and workload.
(d) Primary instrument references. It should be demonstrated that movement of the FD and its tracking reference do not interfere with primary instrument references
73 throughout their range of motion. The pilot’s ability to interpret the guidance and essential flight information should not be adversely affected by the movement dynamics or range of motion.
(2) Specific demonstrations for HUD.
(a) Compliance. These demonstrations are intended to show compliance with the following paragraphs of this AC:
1 Chapter 3, paragraph 28, FD Engagement, Disengagement, and Indications.
2 Chapter 4, paragraph 44, FGS Mode Selection, Annunciation, and Indication.
3 Chapter 4, paragraph 46, FGS Considerations for HUDs.
4 Chapter 5, paragraph 53, Normal Performance (specifically, criteria for FD guidance).
(b) Demonstrations required. When the PF is using the HUD, the HUD is where the pilot is looking for the basic flight information, and the pilot is less likely to be scanning the head-down instruments. Therefore, the following should be demonstrated:
1 The location and presentation of the HUD information (for example, guidance, flight information, and alerts/annunciations) does not distract the pilot or obscure the pilot’s outside view. For example, the pilot should be able to track the guidance to the runway without having the view of runway references or hazards along the flightpath obscured by the HUD symbology.
2 Pilot awareness of primary flight information, annunciations, and alerts is satisfactory when using any HUD display mode. Some display modes that are designed to minimize “clutter” could degrade pilot awareness of essential information. For example, a “digital-only” display mode may not provide sufficient speed and altitude awareness during high-speed descents.
3 It should be demonstrated that the pilot can positively detect cases when conformal symbology is field of view limited.
4 Approach mode guidance, if provided, should be satisfactory throughout the intended range of conditions, including at the minimum approach speed and maximum crosswind with expected gust components, for which approval is sought.
5 Visual cautions and warnings associated with the FGS can be immediately detected by the PF while using the HUD.
6 The PF can immediately respond to wind shear warnings, ground proximity warnings, TCAS warnings, and other warnings requiring immediate flight control
74 action, such as a go-around, while using the HUD without having to revert to a head down flight display.
(c) PM. In certain phases of flight, it is important that the PM and the flightcrew be aware of problems with the HUD used by the PF. Therefore, it should also be demonstrated that the PM can immediately be made aware of any visual cautions and warnings associated with the HUD for applicable phases of flight.
(d) Approach mode. If Approach mode guidance is provided, satisfactory performance should be demonstrated throughout the intended range of operating conditions for which approval is sought. For example, performance should be demonstrated at the minimum approach speed and maximum crosswind with expected gust components.
(e) Recovery guidance. If recovery guidance is provided, it should be demonstrated that the pilot can immediately detect and recover from unusual attitudes when using the HUD. Specialized unusual attitude recovery symbology, if provided, should be shown to provide unequivocal indications of the attitude condition (for example, sky/ground, pitch, roll, and horizon) and to correctly guide the pilot to the nearest horizon. The stroke presentation of flight information on a HUD may not be as inherently intuitive for recognition and recovery as the conventional HDD (for example, contrasting color, area fill, shading versus line strokes). The HUD display design needs to be able to compensate for these differences to provide adequate pilot recognition and recovery cues.
(3) Simulator demonstration for HUD. If a pilot-in-the-loop flight simulation is used for some demonstrations, then a high-fidelity, engineering quality facility is typically required. The level of simulator may vary with the functionality being provided and the types of operation being conducted. Factors for validation of the simulation for demonstration purposes include the following:
(a) Guidance and control system interfaces.
(b) Motion base suitability.
(c) Adequacy of stability derivative estimates used.
(d) Adequacy of any simplification assumptions used for the equations of motion.
(e) Fidelity of flight controls and consequent simulated aircraft response to control inputs. (A correlation of the simulator performance to flight test results should be made.)
(f) Fidelity of the simulation of aircraft performance. (A correlation of the simulator performance to flight test results should be made.)
(g) Adequacy of flight deck instruments and displays.
(h) Adequacy of simulator and display transient response to disturbances or failures (for example, engine failure, autofeather, electrical bus switching).
(i) Visual reference availability, fidelity, and delays.
(j) Suitability of visibility restriction models, such as appropriate calibration of visual references for the tests to be performed for day, night, and dusk conditions.
(k) Fidelity of any other significant factor or limitation relevant to the validity of the simulation.
f. Flightcrew override of the FGS. A flight evaluation should be conducted to demonstrate compliance with Chapter 3, paragraph 30 of this AC. The flight evaluation should consider the implication of system configuration for various flight phases and operations.
(1) Autopilot override.
(a) Assessing effect. The effect of flightcrew override should be assessed by applying an input on the cockpit controller (for example, the control column or equivalent) to each axis for which the FGS is designed to disengage. The evaluation should be repeated with progressively increasing rate of force application to assess FGS behavior. This assessment should include the initial application of force on the cockpit controller as well as when the force is removed from the controllers. The effects of speed and altitude should be considered when conducting the evaluation.
(b) No automatic disengagement. If the autopilot is designed such that it does not automatically disengage due to a pilot override, verify that no potential hazards are generated due to the override per Chapter 3, paragraph 30 of this AC.
(c) Multiple channel engagement. If the design of the autopilot provides for multiple channel engagement for some phases of flight that results in a higher override force, these conditions should be evaluated.
Note: AC 120-28, Appendix 3, Airworthiness Approval for Airborne Systems Used to Land and Rollout in Low Visibility Conditions, section 8, Airborne Systems, contains guidance for evaluating autopilot override for systems supporting low-visibility operations.
(2) Autothrust override. The capability of the flightcrew to override the autothrust system should be conducted at various flight phases. The evaluation should include an override of the autothrust system with a single hand on the thrust levers while maintaining control of the airplane using the opposite hand on the control wheel (or equivalent). This action may not result in a potential hazard per § 25.1329(m), either during the override or after the pilot releases the thrust levers. See Chapter 3, paragraph 30 of this AC for additional guidance. If the autothrust system automatically disengages due to the override, the alerts that accompany the disengagement should be assessed to ensure flightcrew awareness.
(3) Pitch trim system evaluation during autopilot override.
(a) Effect of override. The effect of flightcrew override during automatic control on the automatic trim systems should be conducted. The pilot should also apply an input
76 to the pitch cockpit controller below that which would cause the autopilot to disengage and verify that the automatic pitch trim system meets the intent in Chapter 3, paragraph 30 of this AC.
(b) No automatic disengagement. If the system design is such that the autopilot does not have an automatic disengagement on override feature, the pilot should initiate an intentional override for an extended period of time. The autopilot should then be disengaged with the quick disconnect button and any transient response assessed in compliance with Chapter 3, paragraph 30 of this AC. The effectiveness and timeliness of any alerts used to mitigate the effects of the override condition should be assessed during this evaluation.
100. Failure Conditions Requiring Validation: § 25.1309.
a. General.
(1) Safety assessment. The safety assessment process identified in Chapter 8 of this AC should identify any failure condition responses that would require pilot evaluation to assess the severity of the effect, and the validity of any assumptions used for pilot recognition and mitigation. The classification of a failure condition can vary according to flight condition and may need to be confirmed by simulator or flight test.
(2) Evaluation of failure conditions. This chapter provides guidance on the test criteria, including recognition considerations, for flight evaluation of these failure conditions. In addition, certain probable failures should be demonstrated to assess the performance of the FGS and the adequacy of any applicable flightcrew procedures. AC 25-7, paragraph 181b(9) provides guidance on test methods for particular types of failure conditions that have been identified by the safety assessment.
b. Validation elements.
(1) Assessment. The safety assessment described in Chapter 8 of this AC establishes the FGS failure condition for which appropriate testing should be undertaken.
Assessment of failure conditions has the following elements:
(a) Failure condition insertion.
(b) Pilot recognition of the effects of the failure condition.
(c) Pilot reaction time. That is, the time between pilot recognition of the failure condition and initiation of the recovery.
(d) Pilot recovery.
(2) Failure condition.
(a) Autopilot. Failure conditions of the autopilot should be simulated such that overall response is representative of how that failure condition would affect the airplane and its systems. Failure conditions should include multiaxis failures and automatic trim failures, if
77 those failure conditions exist (given the architecture of a specific FGS) and are relevant to the safety assessment.
(b) FD. FD failure conditions should be validated, if those failure conditions are relevant to the safety assessment.
(c) Most critical conditions. The flight conditions under which the failure condition is inserted should be the most critical. Examples of these flight conditions are CG, weight, flap setting, altitude, speed, power, and thrust. If an autothrust system is installed, the tests should be performed with the autothrust system engaged or disengaged, whichever is the more adverse case.
(3) Pilot recognition.
(a) General. The pilot may detect a failure condition through airplane motion cues or by cockpit flight instruments and alerts. The specific recognition cues will vary with flight condition, phase of flight, and crew duties.
(b) Hardover. The recognition point should be that at which a pilot operating in nonvisual conditions may be expected to recognize the need to take action. Recognition of the effect of the failure may be through the behavior of the airplane (for example, in the pitch axis by aircraft motion and associated normal acceleration cues and in the roll axis by excessive bank angle) or an appropriate alerting system. Control column or wheel movements alone should not be used for recognition. The recognition time should not normally be less than 1 second. If a recognition time of less than 1 second is asserted, specific justification will be required. For example, additional tests may be required to ensure that the recognition time is representative in light of the cues available to the pilot.
(c) Slowover. This type of failure condition is typically recognized by a path deviation indicated on primary flight instruments (for example, course deviation indicator (CDI), altimeter, or vertical speed indicator). It is important that the recognition criteria are agreed upon with the FAA. The following identify examples of recognition criteria as a function of flight phase:
1 En route cruise. Recognition through the altitude alerting system can be assumed for vertical path deviation. The lateral motion of the airplane may go unrecognized for a significant period of time, unless a bank angle alerting system is installed and the slowover results in a bank angle in excess of the limit allowed by the alerting system.
2 Climb and descent. Recognition through increasing/decreasing vertical speed, pitch attitude, roll attitude, or heading can be assumed.
3 On an approach with vertical path reference. A displacement recognition threshold should be identified and selected for testing that is appropriate for the display(s) and failure condition(s) to be assessed.
Note 1: For an ILS or GLS approach in a significant wind gradient, a value of 1 dot on the displayed ILS/GLS deviation scale is considered a reasonable value for crew
78 recognition. In smooth atmospheric conditions with steady state tracking with the vertical flightpath typically maintained at less than a fraction of a needle width, a detection and recognition threshold even below 1/2 dot may be suitable.
Note 2: For RNAV systems that do not use dots, some multiple of needle width related to an established crew monitoring tolerance of normal performance may be appropriate (for example, 3 needle widths of deviation on the VNAV scale).
Note 3: Credit may be taken for excessive deviation alerts, if available.
4 On an approach without vertical path reference. Criteria similar to the climb/descent condition can be assumed.
(d) Oscillatory. It is assumed that oscillatory failures that have structural implications are addressed under part 25, Subpart C, and § 25.1309. It can be assumed that the flightcrew will disengage the automatic control elements of the FGS that have any adverse oscillatory effect and will not follow any adverse oscillatory guidance. However, if there are any elements of the FGS that cannot be disconnected in the presence of an oscillatory failure condition, the long-term effects on crew workload and the occupants will need to be evaluated.
(4) Pilot reaction time. The pilot reaction time is considered dependent upon the pilot attentiveness, based upon the phase of flight and associated duties. The following assumptions are considered acceptable:
(a) Climb, cruise, descent, and holding. Recovery action should not be initiated until 3 seconds after the recognition point.
(b) Maneuvering flight. Recovery action should not be initiated until 1 second after the recognition point.
(c) Approach. The demonstration of malfunctions should be consistent with operation in non-visual conditions. The pilot can be assumed to be carefully monitoring the airplane performance and will respond rapidly once the malfunction has been recognized. A reaction time of 1 second between recognition point and initiation of recovery is appropriate for this phase of flight.
Note 1: For the final phase of landing (for example, below 80 feet), the pilot can be assumed to react upon recognition without delay.
Note 2: For phases of flight where the pilot is exercising manual control using CWS, if implemented, the pilot can be assumed to commence recovery action at the recognition point.
(5) Pilot recovery.
(a) Pilot recovery action. The recovery action should be commenced after the reaction time. Following such delay, the pilot should be able to return the airplane to its normal flight attitude under full manual control without engaging in any dangerous maneuvers during recovery and without control forces exceeding the values given in § 25.143(d). During the recovery, the pilot may overpower the autopilot or disengage it.
(b) Minimum autopilot use height. For the purpose of determining the minimum height at which the autopilot may be used during an approach or for height loss assessments, a representative pilot recovery maneuver appropriate to the airplane type and flight condition should be performed. This maneuver should not lead to an unsafe speed excursion to resume a normal flightpath. An incremental normal acceleration in the order of 0.5 g is considered the maximum for this type of maneuver.
c. Takeoff.
(1) Worst-case failure condition. The primary concern for the takeoff phase of flight is the effect of the worst-case failure condition identified by the safety assessment on the following:
(a) The net effect on the flightpath of the airplane after takeoff, and
(b) The airplane’s attitude and speed during climbout.
(2) Failures to be evaluated. Failures that would cause the airplane to pitch up, pitch down, and bank during the takeoff should be evaluated, if those failure conditions exist (given the architecture of a specific FGS) and are relevant to the safety assessment.
(3) On runway guidance. If the FGS provides on runway guidance for takeoff, the effect of any failures of that takeoff guidance should be assessed. See AC 120-28 for additional information.
d. Climb, cruise, descent, and holding. Where the safety analysis identifies a failure condition requiring flight/simulator evaluation with pilot assessment, the height loss should be established in accordance with the method described in AC 25-7, paragraph 181b(9)(e)4, Assessment of Approach without Vertical Path Reference.
e. Maneuvering. Where the safety analysis identifies a failure condition that has a dynamic effect on the roll control of the airplane, the failure condition should be introduced at the bank angle for normal operation. The bank angle should not exceed 60 degrees when the pilot recognition and the recovery times identified above are applied.
f. Approach. A discussion of the operational considerations for approach operations is contained in paragraph 101, Criteria Supporting Operational Use of Autopilot. This chapter identifies test criteria to support those considerations. The safety assessment process should identify the demonstration of specific failure conditions during the approach. The fault demonstration process during approach should include the four phases identified in
80 paragraph 100.b, Validation Elements, of this AC. The failure condition should be inserted at a safe but representative height. The deviation profile should be identified and applied as indicated in AC 25-7, paragraph 181b(9)(e), Approach.
(1) Approach with vertical path reference.
(a) xLS (that is, ILS or GLS).
1 ILS operations are typically conducted on instrument approach procedures designed in accordance with United States Standard for Terminal Instrument Procedures (TERPS). See FAA Order 8260.3B, or the International Civil Aviation Organization (ICAO) Procedures for Air Navigation Services—Aircraft Operations (PANS-OPS) criteria or equivalent. These criteria together with ICAO Annex 14 are generally intended to take into account obstacles beneath a reference obstacle identification surface.
Note: The FAA may establish operational criteria for GLS at a later time.
2 In assessing the implication of the effect of failures during autopilot operations, a reference 1:29 slope penetration boundary has been applied against the deviation profile to identify an appropriate altitude for continued autopilot operation. The 1:29 slope has been found to provide an acceptable margin above obstacles on an approach.
3 The worst-case failure condition identified by the safety assessment (see Chapter 8, paragraph 87, Validation of Failure Conditions) should be demonstrated against the deviation profile criteria and a MUH established. (See AC 25-7, paragraph 181b(9)(e)3, Assessment of Approach with Vertical Path Reference.)
(b) Area navigation.
1 For RNAV coupled approach operations, a vertical flightpath similar to an xLS flightpath will be used (for example, 3 degree path starting 50 feet above the threshold). However, due to sensor characteristics it is assumed that RNAV operations will be conducted with a DA(H) or MDA(H) that is higher than an equivalent MUH on an xLS approach to the same runway. Further, for this type of operation, it should be noted that the MUH is always in the visual segment of the approach, as the failure recognition and recovery maneuver are assumed to be conducted with the pilot having established outside visual reference.
2 In order to derive only one MUH value for simplicity of use, it is assumed that the effects of failure on the autopilot in RNAV operation are no worse than for the xLS operation. No further determination or demonstration is required. However, the applicant should show that due account has been taken in the safety assessment of the differences between the RNAV and xLS inputs to the autopilot (for example, barometric altitude input, FMS position and guidance commands, and their failure effects). If these effects can be bounded or otherwise reconciled, then the xLS demonstrated MUH may also be considered applicable to RNAV operations.
81 3 If these effects cannot be bounded or accounted for within those for the xLS operation, the MUH should be determined in accordance with an Approach without Vertical Path Reference below.
(2) Approach without vertical path reference. For an approach without vertical path reference (for example, VOR, Non-Directional Beacon (NDB), localizer only) the FGS mode of operation is typically vertical speed/flight path angle (that is, a cruise mode). The worstcase failure condition for this type of mode should be demonstrated in the approach configuration. An appropriate height loss should then be established in accordance with the method described in AC 25-7, paragraph 181b(9)(e)4.
(3) Steep approach. In support of an approval to use the FGS on glidepath angles of greater than 3.77 degrees (see Chapter 9, paragraph 99.d(5), Steep Approach (Special Authorization), of this AC), an assessment should be made of the effects of failure conditions for this type of operation. For use of autopilot, an appropriate MUH should be established in accordance with the deviation profile method described in this chapter. For this assessment, the obstacle plane associated with a nominal 3 degree glidepath angle (1:29 slope) should be adjusted according to the maximum approach angle for which approval is sought.
g. Specific conditions.
(1) Failure conditions to be evaluated. The following are failure conditions that should be considered as part of the FGS evaluation program:
(a) Engine failure during approach; continue approach to decision altitude (DA)/minimum descent altitude (MDA).
(b) Potential fuel imbalance.
(c) Airplane system failures that affect FGS operational capabilities.
Examples include failures of hydraulic systems, electrical systems, flight controls, and FGS-related sensors. When possible, these failure conditions should be evaluated with a flight test. However, some failure conditions, due to their potential hazards, may best be evaluated via a high-fidelity flight simulation.
(2) Failure to disengage. The probability of failure of an FGS element to disengage when the quick disengagement control is operated should be shown to be acceptable by the safety analysis process. If credit is to be taken for acceptable continued manual operation with the FGS elements remaining engaged, that is, without operating any of the other disengagement controls, then a flight demonstration should be conducted though approach, landing, and rollout.
101. Criteria Supporting Operational Use of Autopilot.
a. Typical flight operations. The criteria contained in this paragraph are intended to identify how the functional capability of the FGS, established during the certification, can be used to support typical flight operations. The criteria are based on experience gained from certification programs and functionality provided by traditional systems. A FGS providing
82 nontraditional functionality—using new or novel technology and/or implementation techniques—may require additional criteria to be established.
b. Operations in close proximity to the ground.
(1) General. During low-visibility operations, multiple redundant autopilot channels may be used, and the effect of any autopilot failures on the flightpath may be eliminated or substantially minimized by the protection provided by that redundancy. The considerations in the following paragraphs apply primarily to single-channel operations where performance or integrity aspects may require further consideration. For specific considerations relating to autopilot operations close to the ground in the presence of failures, see Chapter 8, paragraph 88.b, FGS Operations in Close Proximity to the Ground, of this AC.
(2) Considerations. The minimum engagement point for the autopilot after takeoff and the minimum use of the autopilot during approach should take into consideration the effect of the following:
(a) Failures and their effects (that is, failure conditions).
(b) Fault-free performance.
(c) Any specific operational considerations and/or mitigation.
(3) Autopilot engagement altitude/height after takeoff.
(a) Deviation from flightpath. The potential deviation of the airplane from the desired flightpath due to the effect of a failure condition may necessitate delaying the engagement of an autopilot to an acceptable height above the departure runway.
(b) Worst-case deviation profile. To support the determination of the minimum engagement height, if autopilot failure condition(s) are identified that will cause a significant deviation below the intended vertical flightpath, the worst-case deviation profile should be identified. This profile and the recovery of the airplane should not result in penetration of the net flightpath as defined in § 25.115.
(c) Other effects. If the failure condition(s) have a neutral effect on the flightpath but has implications for speed control during takeoff, the acceptability of cues for the flightcrew detection of the condition should be made. The effect of any failure condition relating to the bank angle of the airplane should also be assessed. In all of the above, account should be taken of operating the airplane at the weight, altitude, and temperature (WAT) limit.
(d) Minimum engagement height. The minimum engagement height will typically be established, based on the greatest of the following factors:
1 The lowest altitude or height where the flightcrew could reasonably be assumed to engage the autopilot. Consideration should be given to normal flightcrew tasks during rotation and liftoff (typically 100 feet or greater).