Advisory U.S. Department of Transportation Circular Federal Aviation Administration Subject: ACTIVE FLIGHT CONTROLS Date: 11/15/83 AC No: 25.672-1 Initiated by: ANM-110 Change:
PURPOSE. This advisory circular sets forth an equivalent means of complying with the provisions of Part 25 of the Federal Aviation Regulations (FAR) pertaining to the certification requirements of active flight controls. The procedures set forth herein apply to load alleviation systems (LAS), stability augmentation systems (SAS), and flutter suppression systems (FSS). These procedures provide compliance with Part 25 under the equivalent safety provisions of & 21.21(b) (1) in addition to compliance with the applicable sections of Part 25. Like all advisory circular material, this advisory circular is not, in itself, mandatory and does not constitute a regulation. It is issued for guidance purposes and to outline a method of compliance with the contine by ng this party chile enter arcade, no shot he who hose.
to demonstrate compliance with this advisory circular must comply fully with all the provisions herein.
2. RELATED SECTIONS.
a. Portions of Part 25, as presently written, can be applied for the design, substantiation, and certification of active control systems (ACS) for commercial jet transports. Sections which prescribe requirements for these types of systems include:
§ 25.301 Loads § 25.305 Strength and deformation $ 25.335 Design airspeeds § 25.337 Limit maneuvering load factors § 25.373 Speed control devices § 25.571 Damage--tolerance and fatigue evaluation of structure
25.581 Lightning protection
25.629 Flutter, deformation, and fail-safe criteria
25.671 Control systems, general $ 25.672 Stability augmentation and automatic and power-operated systems § 25.1301 Function and installation § 25.1307 (b) Miscellaneous equipment § 25.1309 Equipment, systems, and installations § 25.1322 Warning, caution, and advisory lights
25.1329 Automatic pilot system § 25.1333 Instrument systems § 25.1355(c) Distribution system
AC 25.672- 1 11/15/83
25.1357 Circuit protective devices
25.1359 Electrical system fire and smoke protection
25.1431 Flectronic equipment § 25.1503 Airspeed limitations: general
b. These regulations encompass both automatic systems and structure.
Specific interpretation of appropriate structural and system regulations applicable to load alleviation systems (LAS), stability augmentation systems (SAS), and flutter suppression systems (FSS) is set forth herein, together with references to relevant existing Part 25 paragraphs. These criteria are based on the principle of equivalent safety. One such basis for establishing equivalent alleviation for an airplane of sintane expede safety for load alleviation is that the frequency of exceedance of design limit load shall be no greater than for an airplane of similar characteristics designed without load alleviation systems, considering the expected usage of the airplane in conjunction with the in-flight availability of the LAS. In addition, any change in incremental level of load alleviation in the range between limit and ultimate loads is accounted for.
c. Although this advisory circular provides the regulatory basis for approval of active flight controls, it does not attempt to establish specific criteria which define acceptable limits on handling characteristics, tlutter margins, or stability requirements when operating in the inoperative mode.
These criteria will be developed prior to certification of the system and will be related to system reliability. Also, incorporation of certain features in the flight control systems may require additional findings of equivalency with Part 25 requirements when operating in either the operative or inoperative mode.
A fly-by-wire system incorporating no feedback or feel system is an example of such a system.
3. BACKGPOUND.
In recent years, significant developments in active controls technology have advanced the state-of-the-art of active flight control systems in both effectiveness and reliability to the point where some alleviation from flight loads can be achieved. Flutter suppression systems may also be installed independently or share cormon components with the LAS to provide flutter margins.
b. Stability augmentation systems (SAS) have been successfully used on transport airplanes for several years. The earlier SAS were limited in authority to assure acceptable handling qualities with the system malfunctioning or inoperative. Although the SAS provided some alleviation of flight loads, its effectiveness in relieving loads was not necessarily assessed against system reliability. The LAS criteria in this advisory circular are also applicable to the SAS.
c. The procedures set forth in this advisory circular were developed for use in certification of active controls. Adherence to these criteria will provide a level of safety in airplanes equipped with these systems consistent with the level of safety found in airplanes without them.
2 Par 2
4. CRITERIA FOR LOAD ALLEVIATION SYSTEMS (LAS).
a. When the LAS is operative, all applicable Part 25 requirements shall be When the LAS is inoperative due to inflight failures, the design loads, stability and control characteristics, and crew advisories shall he related to the operative LAS reliability. The analyses which establish the probabilities cited in the following paragraphs shall assume maintenance practices as recommended by the applicant.
(1) For systems having a probability of loss of function greater than 10-9 per flight hour, all of the applicable Part 25 requirements shall be met with the system inoperative.
For systems having a probability of loss of function less than or equal to 10-5 per flight hour, the following nust be shown when the system is inoperative due to inflight failures:
(i) The structure shall be capable of sustaining limit loads computed with LAS inoperative and treated as ultimate loads.
(ii) The airplane shall be capable of withstanding 2/3 limit loads, treated as ultimate, and with structural damage determined under & 25.571(b), or consistent with the certification basis of the airplane.
(iii) The airplane shall be shown by analysis or tests to be free from flutter and divergence up to Vn/Mn with any combination of failures not shown to be extremely improbable (§ 25.629(d) (4)).
(iv) The airplane shall demonstrate that trim stability, control, and stall characteristics are not impaired below a level needed to permit continued safe flight and landing (§ 25.672(c)).
(3) If more than one system is required to achieve the required reliability, the loss of proper function of any system shall be annunciated in a manner to provide flightcrew awareness of system status prior to flight. The total loss of the LAS function shall be annunciated to the crew, and the FAA-approved Airplane Flight Manual shall contain procedures to account for the total loss (§ 25.1309(b) (2) and (c)). These procedures may include flight limitations.
(4) System loss of function need not be considered if it can be shown to be extremely improbable.
(5) Failure conditions which would prevent continued safe flight and landing must not result from any single failure, regardless of system reliability.
c. The airplane shall be capable of continued safe flight and landing after any failures of the system not shown to be extremely improbable at speeds up to Vc/Mc. Any increase in speed as a result of hardover failures must be Par 4 3
AC 25.6/2-1 11/15/83 accounted for. The loads from the occurrence of any system hardover or oscillatory malfunction not shown to be extremely improbable shall be considered limit loads and must be multiplied by a factor of 1.5 to obtain ultimate loads;
except any probable failure condition shall not produce a negative load factor at the airplane c.q.
d. The LAS may be disengaged if other automatic systems are engaged that meet all applicable Part 25 requirements and the criteria herein.
e. The effect of significant LAS nonlinearities, including rate and displacement saturations, shall be accounted for in establishing limit loads.
it shall also be shown that, between limit load and 1.5 times limit load, nonlinearities in the LAS, including aeroelastic effects, will not result in a smaller load increment than the increment achieved at limit load due to load alleviation.
f. For LAS retrofit installations, the structure must be evaluated with the system operative for the damage tolerance conditions of § 25.571 consistent with the certification basis of the airplane.
19e. Or her restrictions a ge mahat posedles are provide tinch assure compliance of the alternate configurations with the type certification basis.
5. CRITERIA FOR FLUTTER SUPPRESSION SYSTEMS (FSS).
a. When the FSS is operative, all applicable Part 25 requirements shall be met, including design for flutter-free and divergence-free flight up to a speed of 1.2 Vn/Mr.
When the FSS is inoperative due to inflight failures, flutter margins, stability and control characteristics, and crew advisories shall be related to operative FSS reliability. The analyses which establish the probabilities cited in the following paragraphs shall assume maintenance practices as recommended by the applicant.
(1) For systems having a probability of loss of function greater than 10-> per flight hour, all of the applicable Part 25 requirements shall be met with the system inoperative, including freedom from flutter and divergence up to 1.2 Vn/MD.
(2) For systems having a probability of loss of function less than or equal to 10-5 per flight hour, the following must be shown when the system is inoperative due to inflight failures:
(i) The airplane must demonstrate acceptable stability and control characteristics.
4 Par 4
(ii) The airplane shall be shown by analyses or tests to be free from flutter and divergence at any speed up to Vp/Mn.
(3) If more than one system is required to achieve the required reliability, the loss of proper function of any system shall be annunciated in a manner to provide flightcrew awareness of system status prior to flight. The total loss of the FSS function shall be annunciated to the crew, and the FAA-approved Airplane Flight Manual shall contain procedures to account for the total loss (§ 25.1309(b)(2) and (c)). These procedures may include flight limitations.
(4) System loss of function need not be considered if it can be shown to be extremely improbable.
(5) Failure conditions which would prevent continued safe flight and landing must not result from any single failure, regardless of system reliability.
c. The airplane shall be shown by analysis or tests to be free from flutter or divergence that would preclude safe flight at any speed up to Vp/Mn after failure or malfunction of the FSS, together with any other combination of failures, malfunctions, or adverse conditions affecting flutter or divergence for which the probability of occurrence, in combination with the probability of tailures, maltunctions, or degraded pertormance ot the FSS, cannot be shown to be extremely improbable.
d. The aircraft shall be capable of continued safe flight and landing after system hardover or oscillatory malfunctions at speeds up to Vc/Mc for failures of the system not shown to be extremely improbable. Any increase in speed as a result of the hardover must be accounted for. The loads from the occurrence of any system hardover or oscillatory malfunction not shown to be extremely improbable shall be considered limit loads and multiplied by a factor of 1.5 to obtain ultimate loads, except any probable failure conditions shall not produce a negative load factor at the airplane c.9.
e. The effect of significant nonlinear aeroelastic effects and FSS nonlinearities, including rate and displacement saturations, shall be accounted for in establishing the flutter stability of the airplane. Flutter stability will be shown by analysis or tests for all flight speeds up to 1.? Vn/Mn with the airplane subjected to design maneuver load factors. Flutter stability will also be shown for all flight speeds up to Vn/Mp with the aircraft subjected to design gust intensities and up to 1.? Vn/Mp for gust intensities which further decrease with increasing airspeed.
An aircratt may be certitied for alternate contigurations, including hose with the FSS selected totally inoperative, provided appropriate weight light, or other restrictions and flight manual procedures are provided which assure compliance of the alternate configurations with the type certification basis.
Par 5 5
AC 25.672- 1 11/15/83 MEL CONSIDERATION.
a. Consideration may be given to including parts of the ACS on an approved Minimum Equipment List (MEL) if these system components are used only to achieve the necessary level of reliability and not required to accomplish system function. Fach MEL proposal should be examined by an FAA Aircraft Certification Office in the Transport Airplane Certification Directorate and assessed for the degree of risk involved for the hours of operation with part of the system inoperative. Final approval for inclusion in the MEL is the responsibility of the appropriate Flight Operations Evaluation Board (FOER).
b. Some of the basic assumptions which support the active controls criteria are based upon probability studies. Such factors as load exceedances per flight hour, residual strength after structural damage, and system reliability were considered in developing the basic criteria. To aid in providing reasonable control of the risk associated with an MEL proposal for LAS, the following analytical approach should be used to determine the maximum time to repair:
LET :
= Probability of complete loss of LAS function and exceedance of limit load.
= PLAS Pg = 10-9 (extremely improbable) WHERE:
= Probability of encountering a limit load level.
= 2 x 10-5 for the next hour of flight.
PLAS = The maximum allowable probability of complete loss of function for the next hour of flight.
= 10-9/2 × 10-5 = 5 × 10-5 When parts of the LAS are on an approved MEL:
PLAS = PLPO + (1-PO) PI.2 WHERE:
Probability of total loss of function in one hour of flight from its nonfaulted configuration.
Probability of the system being in its nonfaulted configuration at the beginning of the flight.
PLI = Probability of system degradation to the MEL configuration in one hour of flight.
PLZ Probability of total loss of function in one hour of flight from the MEL configuration.
Par 6
It can be shown that:
PO = 1 - PLIT WHERE:
T Maximum time in flight hours allowed in MEL dispatch configuration.
The solution for T yields:
5 × 10-5 - PL PLI (PL2 - PL) Example:
This criteria would be met by a fully monitored, dual redundant LAS with the following characteristics:
= 1.0 x 10-5 (presumes two channels not completely independent).
PLI = 2.0 x 10-3 (1.0 x 10-3 probability of failure for each of two channels per flight hour).
PL2 = 1.0 x 10-3 (for remaining channel per flight hour).
Using these typical data, the calculation of T results in 21 flight hours before repair.
c. At the present time there is insufficient experience to prescribe a method for incorporating parts of the FSS on the MEL. Any method used must be approved by the FAA certification office in the Transport Airplane Certification Directorate.
d. If an extra channel is installed for dispatch reliability, then any one of the channels may be included in the MEL, provided the extra channel meets the reliability of the basic system and is not needed to establish reliability of the basic system. This provision applies to the LAS, SAS, and FSS without regard to time in the MEL configuration.
7. TEST DEMONSTRATION. The purpose of the test demonstration is to show that the aircraft meets the regulatory requirements by carrying out performance and fault tests at selected conditions. The tests shall include, in addition to those normally required by paragraph 4a of this document, the following simulator, ground, or flight demonstrations:
a. The system effectiveness in alleviating loads, suppressing flutter modes, and stabilizing aircraft oscillatory modes should be demonstrated by flight tests for selected conditions within the airplane design envelope.
Par 6 7
Airplane response to oscillatory as well as hardover failures should be similarly verified by tests, unless these conditions are shown to be extremely improbable.
b. In addition to the normal freedom from flutter demonstrations, maneuvering to limit load factors or load factors which produce light buffeting at both low speed and high speed should be explored for system capability to alleviate loads or suppress flutter.
c. With the FSS inoperative, freedom from flutter shall be demonstrated for flight speeds up to at least VFC/MFC.
d. If parts of the ACS are approved for MEL dispatch, the tests described in paragraph 7a of this document must include selected conditions in the MEL configurations. Credit for loads alleviation or flutter suppression will be based on these tests.
8. SYSTEM RELIABILITY.
a. Since the airplane design criteria for load levels and/or flutter margins are dependent on the reliability of the ACS, the probability of loss of system function must be evaluated in a realistic or conservative manner before certification. System and component failure rates for use in probability calculations may be based on tests and, when available, on service experience with similar installations. Both the normal operative and the MEL dispatch configuration must be assessed for both loss of function and improper functioning (hardovers, etc.).
b. If the systems prove less reliable in service than assessed for certitication, adjustments in maintenance schedules, load levels, and/or operating limitations may be required. This will necessitate monitoring of the systems for a sufficient period of time to substantiate an adequate level of reliability. Details of the reliability verification program should be based on system criticality and the degree of conservatism inherent in the system design and analysis. Periodic checks for system reliability may be required throughout the service life of the ACS.
c. The effects of realistic environmental factors should be fully considered in assessing system reliability. This will include analysis and/or test. The analysis and test program is to be based on system criticality and architecture and should be submitted for FAA concurrence at an early point in the program.
Lees, A. Kith LEROY A. KEITH Manager, Aircraft Certification Division 8 Par 7