U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Control Systems—General Date: 08/30/2024 AC No: 25.671-1 Initiated By: AIR-600 This advisory circular (AC) describes acceptable means for showing compliance with the requirements of Title 14, Code of Federal Regulations (14 CFR) 25.671, Control Systems— General. These means are intended to provide guidance to supplement the engineering and operational judgment that forms the basis of any showing of compliance. Section 25.671 applies to all flight control system installations (including primary, secondary, trim, lift, drag, feel, and load alleviation and stability augmentation systems, and other systems or functions implemented through or supporting the flight control components) regardless of implementation technique (manual, powered, fly-by-wire, or other means). While § 25.671 applies to flight control systems, § 25.671(d) applies to all control systems required to provide control, including deceleration, for the phases specified. This AC provides guidance on means of compliance with regulatory provisions that address operation of the control systems (§ 25.671(a)), design of the control system assembly (§ 25.671(b)), failures of the control system (§ 25.671(c)), control system design in the event all engines fail (§ 25.671(d)), control authority awareness (§ 25.671(e)), and flight control system modes of operation (§ 25.671(f)).
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback form at the end of this AC.
DANIEL J.
Digitally signed by DANIEL J. ELGAS ELGAS Date: 2024.08.30 14:46:05 -04'00' Daniel J. Elgas Director, Policy and Standards Division Aircraft Certification Service
AC 25.671-1 Contents Paragraph P age
1 Purpose1
2 Applicability1
2.1 Applicability of this AC1
2.2 Applicability of § 25.6711
3 Related Documents1
3.1 Related Regulations1
3.2 Advisory Circulars2
3.3 Other Documents2
4 Background2
5 Definitions3
5.1 Continued Safe Flight and Landing3
5.2 Exceptional Pilot Skill or Strength3
5.3 Exposure Time3
5.4 Failure3
5.4.1 Jam3
5.4.2 Loss of Control of Surface4
5.4.3 Oscillatory Failure4
5.4.4 Restricted Control4
5.4.5 Runaway or Hardover4
5.4.6 Stiff or Binding Controls5
5.5 Flight Control System5
6 Evaluation of Flight Control Operation—§ 25.671(a)5
7 Evaluation of Flight Control Assembly—§ 25.671(b)6
8 Evaluation of Flight Control System Failures—§ 25.671(c)7
8.1 General7
8.2 Evaluation of Flight Control Jam Conditions8
8.3 Determination of Normally Encountered Flight Control Surface or Pilot Control
Positions10
8.3.1 General10
8.3.2 Jammed Lateral Control Positions11
8.3.3 Jammed Longitudinal Control Positions12
ii
AC 25.671-1 Contents (continued) Paragraph Page
8.3.4 Jammed Directional Control Positions12
8.3.5 Control Tabs, Trim Tabs, and Trimming Stabilizers13
8.3.6 Speed Brakes13
8.3.7 High Lift Devices13
8.3.8 Load Alleviation Systems13
8.4 Assessment of Continued Safe Flight and Landing14
8.4.1 Flight Characteristics14
8.4.2 Structural Strength for Flight Control System Failures17
9 Evaluation of All-Engines-Failed Condition—§ 25.671(d)18
9.1 Explanation18
9.2 Procedures19
10 Evaluation of Control Authority Awareness—§ 25.671(e)20
11 Evaluation of Flight Control System Submodes—§ 25.671(f)21
12 Acceptable Means of Compliance21
13 Evaluation of Fly-By-Wire Flight Control Systems21
13.1 Evaluation of Command Signal Integrity23
13.2 Compliance Strategy for Fly- By-Wire Flight Control Systems25
Tables Number Page
Table 1. Reaction Times for Flight Conditions16
iii
AC 25.671-1
1 PURPOSE.
This AC provides an acceptable means, but not the only means, of showing compliance with the control system requirements of 14 CFR 25.671, Control Systems—General.
These means are intended to provide guidance to supplement the engineering and operational judgment that forms the basis of any showing of compliance. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
2 APPLICABILITY.
2.1 Applicability of this AC.
2.1.1 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) transport airplane type certification engineers and their designees.
2.1.2 Using this guidance as a means of compliance with § 25.671 is voluntary only and not using it will not affect rights and obligations under existing statutes and regulations. The FAA will consider other means of showing compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the agency may require additional substantiation as the basis for finding compliance.
2.2 Applicability of § 25.671.
Section 25.671 applies to all flight control system installations as defined in paragraph 5.5. Additionally, § 25.671(d) applies to all control systems required to provide control, including deceleration.
3 RELATED DOCUMENTS.
The following regulatory and advisory materials are related to this AC:
3.1 Title 14 of the Code of Federal Regulations .
The following 14 CFR part 25 regulations are related to this AC. You can download the full text of these regulations from the Federal Register website at Electronic Code of Federal Regulations, jointly administered by the Office of the Federal Register (OFR) of the National Archives and Records Administration (NARA) and the U.S.
Government Publishing Office (GPO). You can order a paper copy from the U.S.
Superintendent of Documents, U.S. Government Publishing Office, Washington, D.C.
20401; at Government Publishing Office, by calling telephone number (202) 512-1800;
or by sending a fax to (202) 512-2250.
AC 25.671-1
• Section 25.302, Interaction of systems and structures.
• Section 25.671, Control Systems—General.
• Section 25.683, Operation tests
• Section 25.685, Control system details
• Section 25.1309, Equipment, systems, and installations.
• Section 25.1322, Flightcrew alerting.
• Section 25.1329, Flight guidance system.
3.2 Advisory Circulars.
The following ACs are related to the guidance in this AC. Please refer to the latest version of each AC referenced in this document; they are available at FAA Advisory Circulars and in the Dynamic Regulatory System (DRS).
• AC 25-7D, Flight Test Guide for Certification of Transport Category Airplanes.
• AC 25.1309-1B, System Design and Analysis.
• AC 25.1322-1, Flightcrew Alerting.
• AC 25.1329-1C, Change 1, Approval of Flight Guidance Systems.
3.3 Other Documents.
The following FAA documents are related to the guidance in this AC. If the documents are revised after publication of this AC, you should refer to the latest version for guidance.
• PS-ANM-25-12, Certification of Structural Elements in Flight Control Systems, dated March 13, 2015. Accessible at FAA Dynamic Regulatory System (DRS) at FAA DRS.
• Certification Authorities for Large Transport Aircraft (CATA) Worklist Item FAA- 005 – Flight Control System – Operation Tests, dated October 14, 2022. Accessible at FAA CATA Worklist Item FAA-005.
4 BACKGROUND.
4.1 The FAA is issuing this AC concurrently with several rule changes that address system safety and structural design criteria, such as §§ 25.302, 25.671, 25.1309, and others.
The FAA developed these rule changes, and corresponding advisory material, based on service experience and recommendations from several Aviation Rulemaking Advisory Committee (ARAC) working groups.
AC 25.671-1
4.2 In 2001, the ARAC Flight Controls Harmonization Working Group (FCHWG) provided recommendations for changes to § 25.671 and the corresponding advisory material. The FAA used these recommendations to develop this AC. These recommendations included a requirement to minimize the risk that could be caused by latent failures in flight control systems.
4.3 In addition to the FCHWG, several other working groups separately developed different criteria for latent failures in system designs. In 2010, the ARAC Airplane-Level Safety Analysis Working Group reviewed all the previous recommendations and developed a common approach for addressing latent failures. These latent failure criteria are now included in § 25.1309 and apply to all equipment and systems, including flight control systems.
5 DEFINITIONS.
The following definitions apply to the requirements of § 25.671 and the guidance in this AC. Refer to AC 25.1309-1B for additional definitions including “latent failure,” “event” and “error.”
5.1 Continued Safe Flight and Landing.
The capability for continued controlled flight and landing at an airport without requiring exceptional pilot skill or strength.
5.2 Exceptional Pilot Skill or Strength.
Skill or strength capabilities that exceed that of the average pilot.
5.3 Exposure Time.
The time between when an item was last known to be operating properly and when it will be known to be operating properly again.
5.4 Failure.
An occurrence that affects the operation of a component, part, or element such that it no longer functions as intended. This includes both loss of function and malfunction.
Note 1: Errors may cause failures or influence their effects but are not considered to be failures.
Note 2: Some of the types of failures to consider in showing compliance with § 25.671(c) are listed in paragraphs 5.4.1 through 5.4.6. Since the type of failure and the failure’s effect will depend on system architecture, this list is not all-inclusive, but serves as a general guideline. Compliance with § 25.302 and § 25.1309 may also be required for some of these failure conditions. Refer to AC 25.1309-1B.
5.4.1 Jam.
A failure or event that results in a control surface, pilot control, or component becoming fixed in one position.
AC 25.671-1
5.4.1.1 If the control surface or pilot control is fixed in position due to a physical interference, it is regulated by § 25.671(c)(3). Causes may include corroded bearings, interference with a foreign or loose object, control system icing, seizure of an actuator, or a disconnect that results in a jam by creating an interference. Jams of this type must be assumed to occur and should be evaluated at positions up to and including the normally encountered positions defined in paragraph 8.3 of this AC.
5.4.1.2 All other failures or events that result in either a control surface, pilot control, or component being fixed in position are addressed under § 25.671(c)(1) and (c)(2) and § 25.302 where applicable. Depending on system architecture and the location of the failure, some jam failures or events may not always result in a fixed surface or pilot control; for example, a jammed valve could result in a surface runaway.
5.4.2 Loss of Control of Surface.
A failure that results in a control surface not properly responding to commands. Failure sources include mechanical disconnection, control cable disconnection, actuator disconnection, loss of hydraulic power, or loss of control commands due to flight control computer, data path or actuator electronics failures. In these conditions, the position of the surface(s) or controls can be determined by analyzing the system architecture and airplane aerodynamic characteristics; common positions include surface centered (0°) or zero hinge-moment position (surface float).
5.4.3 Oscillatory Failure.
A failure that results in surface oscillation. Failure sources include control loop destabilization, oscillatory sensor failure, and oscillatory computer or actuator electronics failure. The duration of the oscillation, its frequency, and amplitude depend on the control loop, monitors, limiters, and other system features.
5.4.4 Restricted Control.
A failure that results in limitation of the achievable surface deflection. Failure sources include foreign object interference, travel limiter malfunctioning, and malfunction of an envelope protection. This failure must be evaluated under § 25.671(c)(1) and (c)(2), as the system or surface can still be operated.
5.4.5 Runaway or Hardover.
A failure that results in uncommanded control surface movement. Failure sources include servo valve jamming and computer or actuator electronics malfunctioning. The speed of the runaway, the duration of the runaway (permanent or transient) and the resulting surface position (full or partial deflection, or full retraction) depend on the available monitoring, limiters, and other system features. This type of failure must be evaluated under § 25.671(c)(1) and (c)(2).
AC 25.671-1
5.4.6 Stiff or Binding Controls.
A failure that results in a significant increase in control forces. Failure sources include failures of artificial feel systems, corroded bearings, jammed pulleys, and failures causing high friction. This failure must be evaluated under § 25.671(c)(1) and (c)(2), as the system or surface can still be operated. In some architectures, the higher friction may result in reduced centering of the controls.
5.5 Flight Control System.
This term refers to the following: primary flight controls from the pilots’ controls to the primary control surfaces; trim systems from the pilots’ trim input devices to the trim surfaces (including stabilizer trim); speedbrake/spoiler (drag devices) systems from the pilots’ control lever to the spoiler panels or other drag/lift-dumping devices; high lift systems from the pilots’ controls to the high lift surfaces; feel systems; load alleviation systems; stability augmentation systems; and other functions implemented through or supporting the flight control components. Other systems or devices that alter the air flow around the airplane for the purpose of flight path control or modification of aerodynamic forces or moments, for example suction or blowing systems, should also be considered part of the flight control system. Supporting systems (for example, hydraulic systems, electrical power systems, and avionics) should also be evaluated if failures in these systems have an impact on the function of the flight control system.
5.6 Normal Flight Envelope.
The normal flight envelope includes airplane operating and environmental conditions for which the airplane is designed, including the operating envelope defined by the airplane flight manual (AFM) together with any modification to that envelope associated with abnormal or emergency procedures. The normal flight envelope includes external environmental conditions that the airplane is reasonably expected to encounter, such as atmospheric turbulence, high intensity radiated fields, lightning, and precipitation. The normal flight envelope includes design speeds up to the dive speed, and the maneuvering and gust envelopes defined in subpart C of part 25. The normal flight envelope includes the time from brake release prior to takeoff until the airplane comes to a complete stop on the runway after landing.
6 EVALUATION OF FLIGHT CONTROL OPERATION—§ 25.671(a).
6.1 The first sentence of § 25.671(a) states: “Each flight control system must operate with the ease, smoothness, and positiveness appropriate to its function.” Flight control systems should be designed so that, when a movement to one position has been selected, a different position can be selected without waiting for the completion of the initially selected movement, and the system should arrive at the final selected position without further attention. The movements that follow and the time taken by the system to allow the required sequence of selection should not adversely affect the controllability of the airplane. Additionally, pilot tasks associated with closed-loop flight control systems should be shown to be free from discontinuities in forces or gains that result in excessive forces, lack of control harmony, over-control, or pilot-induced 5
AC 25.671-1
oscillation. Such conditions are typically evaluated for compliance with subpart B regulations during flight testing. Advisory Circular 25-7D provides additional guidance.
6.2 The second sentence of § 25.671(a) states: “The flight control system must continue to operate and respond appropriately to commands, and must not hinder airplane recovery, when the airplane is experiencing any pitch, roll, or yaw rate, or vertical load factor that could occur due to operating or environmental conditions, or when the airplane is in any attitude.” This requirement is intended to ensure there are no features or unique characteristics (including, for example, flight control law errors that might occur at certain airplane bank angles) that could negatively affect either the proper operation of the system during the stated flight conditions or the pilot’s ability to recover from those conditions. The extent of “operating or environmental conditions” are those within the normal flight envelope, as defined in this AC. For airplanes equipped with a flight envelope protection system, the attitudes of the airplane to be evaluated should include cases outside the protected envelope. Compliance should be shown by evaluation of the closed-loop flight control system. Open-loop flight control systems should also be evaluated, if applicable.
7 EVALUATION OF FLIGHT CONTROL ASSEMBLY—§ 25.671(b).
7.1 Section 25.671(b) requires that each element of each flight control system be designed, or distinctively and permanently marked, to minimize the probability of incorrect assembly that could result in failure or malfunctioning of the system. Distinctive and permanent marking may be used only where design means are impractical. Examples of the consequences of incorrect assembly include the following:
• An out-of-phase action.
• Reversal in the sense of the control.
• Interconnection of the controls between two systems where this is not intended.
• Loss of function.
7.2 Applicants should take adequate precaution in the design process to minimize the probability of incorrect installation, connection, or adjustment of parts in the flight control system. The design should also minimize the probability that a flight control system element can be installed in the incorrect location, or in the wrong direction or alignment, or otherwise assembled incorrectly. The maintenance manual should specify adequate procedures, but the applicant should not rely on maintenance procedures or automated testing alone to ensure correct assembly. The applicant should account for any possible manner in which system elements could be misassembled, and if incorrect assembly is possible, the design should be modified accordingly. Also, the design should be such that only appropriate software can be loaded into the flight control system.
AC 25.671-1
8 EVALUATION OF FLIGHT CONTROL SYSTEM FAILURES—§ 25.671(c).
8.1 General.
8.1.1 Section 25.671(c) requires that the airplane be shown by analysis, test, or both, to be capable of continued safe flight and landing following failures or jams in the flight control system within the normal flight envelope.
8.1.2 Section 25.671(c)(1) requires the evaluation of any single failure, excluding the types of failures defined in § 25.671(c)(3). Section 25.671(c)(1) also requires that any single failure be considered, suggesting that an alternative means of controlling the airplane or an alternative load path be provided in the case of a single failure. All single failures must be considered, even if they are shown to be extremely improbable.
8.1.3 Section 25.671(c)(2) requires the evaluation of any combination of failures not shown to be extremely improbable, excluding the types of failures defined in § 25.671(c)(3).
Some combinations of failures, such as dual electrical system or dual hydraulic system failures, or any single failure in combination with any probable electrical or hydraulic system failure, are normally not demonstrated as being extremely improbable.
8.1.4 Relationship between §§ 25.671(c) and 25.1309.
8.1.4.1 Section 25.1309 applies to all systems and equipment installed on the airplane, including the flight control system. Section 25.671(c) also applies to the flight control system. The safety requirements in § 25.671(c)(1) and (c)(2) correspond with those in § 25.1309(b)(1). There are no fundamental differences between these two sets of safety requirements as they apply to the flight control system. However, different methods of compliance may be used to comply with § 25.671(c)(1) and
(c)(2) as compared to § 25.1309(b)(1).
8.1.4.2 Section 25.671(c)(1) and (c)(2) require the airplane be capable of continued safe flight and landing after any single failure and after any combination of failures not shown to be extremely improbable.
Section 25.1309 requires that these failure conditions not be catastrophic.
While worded differently, these requirements are equivalent. A flight control system failure condition that would prevent continued safe flight and landing should be classified as catastrophic. This AC provides specific criteria unique to the assessment of flight control system failures.
Advisory Circular 25.1309-1B also provides guidance on assessing failure conditions that applies to the flight control system.
8.1.4.3 Operating and environmental conditions within the normal flight envelope should be considered in combination with § 25.671(c)(1) and (c)(2) failure conditions as described in AC 25.1309-1B, section 7.8.
AC 25.671-1
8.1.4.4 Section 25.1309(b)(2)-(5), (c) and (e) apply to the flight control system.
There are no requirements in § 25.671 that correspond to these subparagraphs.
8.1.5 Relationship between §§ 25.671(c) and 25.302.
8.1.5.1 Section 25.671(c) applies to all flight control systems, including structural elements in systems. Section 25.302 applies to some flight control systems, as well as other systems, and to structures affected by those systems. Specifically, § 25.302 applies to systems that affect structural performance, either directly or as a result of a failure or malfunction. A system affects structural performance if it can induce loads on the airplane or can change the response of the airplane to maneuvers or to inputs such as gusts or pilot actions. Examples of these systems include flight control systems, autopilots, stability augmentation systems, load alleviation systems, and fuel management systems.
8.1.5.2 Flight control systems covered by § 25.302 must meet the structural criteria in that regulation. Flight control systems, whether covered by § 25.302 or not, must also meet §§ 25.671 and 25.1309 requirements, which go beyond structural criteria. For example, this AC includes maneuverability criteria following a flight control system failure.
8.1.6 Development errors (e.g., mistakes in requirements, design, or implementation) should be considered when demonstrating compliance with § 25.671(c). However, the guidance provided in this paragraph is not intended to address the means of compliance related to development errors. Development errors are managed through development assurance processes and system architecture. Guidance is provided in AC 25.1309-1B.
8.2 Evaluation of Flight Control Jam Conditions.
8.2.1 Section 25.671(c)(3) requires the applicant to evaluate any failure or event that results in a jam of a flight control surface or pilot control. Section 25.671(c)(3) is intended to address failure modes that would result in the control surface or pilot’s control being fixed, at the position commanded at the time of the failure, due to some physical interference. The position at the time of the jam should be any control position that would be normally encountered during takeoff, climb, cruise, normal maneuvering, descent, approach, and landing. In some architectures, component jams within the system may result in failure modes other than a fixed surface or pilot control. Those types of jams must be evaluated under §§ 25.671(c)(1), 25.671(c)(2), 25.1309, and
25.302 if applicable.
8.2.2 Section 25.671(c)(3)(i) requires the jam to be considered at any normally encountered position of the control surface or pilot control. In the past, determining a consistent and reasonable definition of normally encountered control positions has been difficult. A review of in-service fleet experience showed that the overall rate of control system jams is approximately 10-6 to 10-7 per flight hour. The numerical definition of “extremely 8
AC 25.671-1
improbable” is a failure rate of less than 10-9 per flight hour. Therefore, considering the in-service data, a reasonable definition of normally encountered positions represents the range of control surface deflections (from neutral to the largest deflection) expected to occur in 1000 random operational flights, without considering other failures, for each of the flight segments within the normal flight envelope. The applicant may determine appropriate “normally encountered positions” using this criterion, if it has adequate data that is relevant to the airplane being certified.
8.2.3 In lieu of using in-service data as described in paragraph 8.2.2 of this AC, an applicant may use the performance-based criteria outlined in paragraph 8.3 of this AC to establish acceptable control surface deflections. These criteria were developed to eliminate any differences between airplane types. The performance-based criteria prescribe environmental and operational maneuver conditions. The resulting deflections may be considered normally encountered positions for compliance with § 25.671(c)(3).
8.2.4 Section 25.671(c)(3) requires that the airplane be capable of landing with a flight control jam, and that the airplane be evaluated for jams anywhere in the normal flight envelope. However, § 25.671(c)(3)(ii) allows the applicant to not account for jams that occur immediately before touchdown if the risk of a potential jam is minimized to the extent practical. The reason for this exception is that recovery may not be achievable when considering time delays in initiating recovery just before touchdown. To minimize the potential risk of jams occurring in this time, the applicant should perform a qualitative analysis to identify jams that could occur, with the purpose of eliminating, alleviating, or mitigating the effects of such jams. This qualitative analysis should show that all practical precautions have been taken to minimize the risk of a potential jam occurring immediately before touchdown. The phrase “immediately before touchdown” means the time before touchdown in which recovery is not achievable for the jam in question when considering time delays in initiating recovery. This time and the corresponding distance above the ground can vary among different airplane types and for different flight control systems.
8.2.5 For jams that occur during takeoff, the applicant may assume that if the jam is detected prior to V1, the takeoff will be rejected.
8.2.6 Section 25.671(c)(3)(iii) states that in the presence of a jammed flight control surface or pilot control, additional failure conditions that could prevent continued safe flight and landing must have a combined probability of 1/1000 or less. This is intended to minimize the exposure of latent failures that could occur in the flight control systems needed to mitigate the effects of a flight control jam.
8.2.6.1 To show compliance with § 25.671(c)(3)(iii), the applicant should evaluate elements of the flight control system that are needed to ensure continued safe flight and landing following the flight control jam condition. These could include elements such as a jam breakout or override, disconnect means, alternate surface control, alternate electrical or hydraulic sources, alternate cable paths, or automated systems designed to address jams, such as automatic flare systems. The failure rate of any 9