Printing - SUMMIT - AC 25.1329-1B

AC 25.
1329-1B - APPROVAL OF FLIGHT GUIDANCE SYSTEMS

{New-2013-14}
U.S. Department of Transportation
Federal Aviation Administration
July 17, 2006

Initiated by: ANM-110
Revision History:
Change 1, dated 10/16/12
1. Purpose. This change updates Advisory Circular (AC) 25.1329, “Approval of Flight Guidance Systems,” dated July 16, 2006 to AC
25.1329-1B, Change 1 dated 10/16/12.
a. This change removes Appendix 2, “Flight Test Procedures,” because this material has been incorporated in AC 25-7C, “Flight Test Guide
for Certification of Transport Category Airplanes.”
2. Applicability.
a. The guidance provided in this document is directed to airplane manufacturers, modifiers, and operators of certain transport category
airplanes.
b. The guidance in this AC is neither mandatory nor regulatory in nature and does not constitute a requirement. You may follow alternate
FAA-approved design recommendations.
c. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with
the relevant regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in
compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design
changes as a basis for finding compliance.
d. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
3. Principle changes.
a. This change removes Appendix 2 from this AC, renumbers the remaining appendices, and changes all references to AC 25-7 from AC
25-7A to AC 25-7C, dated 10/16/12.
b. The change number is shown at the top of each page with the date of the change.
/s/
John Piccola
Acting Manager, Transport Airplane Directorate
Aircraft Certification Service
1. Purpose. This advisory circular (AC) describes an acceptable means for showing compliance with certain requirements of Title 14, Code of
Federal Regulations (14 CFR) 25.1329, Flight guidance systems. While Part 25 contains the airworthiness standards applicable to transport
category airplanes, the guidance in this AC pertains to the functions of autopilots, flight directors (FD), and automatic thrust control as well as
any interactions with stability augmentation and trim functions.
2. Cancellation. Advisory Circular 25.1329-1B, dated July 17, 2006, is canceled.
3. Applicability.
a. The guidance provided in this document is directed to airplane manufacturers, modifiers, and operators of certain transport category
airplanes.
b. The guidance in this AC is neither mandatory nor regulatory in nature and does not constitute a requirement. You may follow alternate
FAA-approved design recommendations.
c. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with
the relevant regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in
compliance with the applicable regulations, we will not be bound by the terms of this AC, and we may require additional substantiation or design
changes as a basis for finding compliance.
d. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
4. Related regulations, ACs, and industry documents.
a. Regulations. The following related documents are provided for information purposes and are not necessarily directly referenced in this AC.
The full text of 14 CFR can be downloaded from the Internet at http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=%2Findex.tpl. A paper
copy may be ordered from the Government Printing Office (GPO), Superintendent of Documents, Attn: New Orders, PO Box 371954,
Pittsburgh, PA 15250-7954.
Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Page 1
Section Title
§ 25.143 Controllability and Maneuverability, General
§ 25.301 Loads
§ 25.671 Control systems, General
§ 25.672 Stability augmentation and automatic and power-operated systems
§ 25.677 Trim systems
§ 25.777 Cockpit controls
§ 25.779 Motion and effect of cockpit controls
§ 25.781 Cockpit control knob shape
§ 25.901 Installation
§ 25.903 Engines
§ 25.1301 Function and installation
§ 25.1303 Flight and navigations instruments
§ 25.1309 Equipment, systems, and installations
§ 25.1322 Warning, caution, and advisory lights
§ 25.1581 Airplane Flight Manual, General
§ 25.1583 Airplane Flight Manual, Operating limitations
§ 25.1585 Airplane Flight Manual, Operating procedures
b. ACs. An electronic copy of the following ACs can be downloaded from the internet at
http://www.faa.gov/regulations_policies/advisory_circulars/ or our Regulatory and Guidance Library (RGL) at http://rgl.faa.gov/.
Number Title
AC 20-115B RTCA, Inc., Document RTCA/DO 178B [Radio Technical Commission for
Aeronautics]
AC 20-138B Airworthiness Approval of Positioning and Navigation Systems
AC 20-152 Design Assurance Guidance for Airborne Electronic Hardware RTCA/DO 254
AC 25-7C Flight Test Guide for Certification of Transport Category Airplanes
AC 25-11A Transport Category Airplane Electronic Display Systems
AC 25-12 Airworthiness Criteria for the Approval of Airborne Windshear Warning
Systems in Transport Category Airplanes
AC 25.672-1 Active Flight Controls
AC 25.1309-1A System Design and Analysis
AC 25.1419-1A Certification of Transport Category Airplanes for Flight in Icing Conditions
AC 25.1581-1 Airplane Flight Manual
Change 1
AC 120-28D Criteria for Approval of Category III Weather Minima for Takeoff, Landing,
and Rollout
AC 120-29A Criteria for Approving Category 1 and Category II Landing Minima for FAR
121 Operators
AC 120-41 Criteria for Operational Approval of Airborne Windshear Alerting and Flight
Guidance Systems
Note: This table represents the latest version of each AC at the time of publication. These
individual ACs may be updated in the future, such that this table may reference a specific version
of an AC that has been superseded. The latest version of each AC should always be used, even
though this document may reference a previous version of an AC.
c. Related Industry Standards. The following documents are available from the Society of Automotive Engineers (SAE). These documents
can be obtained from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, Pennsylvania, 15096 electronically
from the SAE International website, http://www.sae.org/.
Number Title
SAE ARP5366 Autopilot, Flight Director and Autothrust Systems
SAE ARP4754 Certification Considerations for Highly Integrated or Complex Aircraft Systems
SAE ARP4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil
Airborne Systems and Equipment
SAE ARP5288 Transport Category Airplane Head Up Display Systems
SAE AS8055 Minimum Performance Standards for Airborne Head Up Display

Page 2
The following documents are available from the RTCA, Inc. These documents can be purchased by mail from the RTCA Inc., 1150 18th Street
NW, Suite 910, Washington, DC 20036; by fax, after completing the Document Order Form and faxing to 202-833-9434; or electronically from
the RTCA online store at: http://www.rtca.org/onlinecart/.
Number Title
RTCA DO-178B/ Software Considerations in Airborne
EUROCAE ED-12B Systems and Equipment Certification
RTCA DO-160E/ Environmental Conditions and Test
EUROCAE ED-14D Procedures for Airborne Equipment
RTCA DO-254/ Design Assurance Guidance for Airborne
EUROCAE ED-80 Electronic Hardware
d. FAA Documents. An electronic copy of the following FAA document can be downloaded from the Internet at
http://www.faa.gov/aircraft/air_cert/design_approvals/csta/publications/.
Title
Federal Aviation Administration Human Factors Team Report on: The Interfaces
Between Flight Crews and Modern Flight Deck Systems - Jun 18, 1996
An electronic copy of the following FAA Order can be downloaded from the Internet at http://rgl.faa.gov/. A paper copy may be ordered from the
U.S. Department of Transportation, Subsequent Distribution Office, M-30, Ardmore East Business Center, 3341 Q 75th Avenue, Landover, MD
20795.
Number Title
FAA Order 8260.3 United States Standard for Terminal Instrument Procedures
/s/
John Piccola
Acting Manager, Transport Airplane Directorate
Aircraft Certification Service
1 - 10 [Reserved]
Chapter 1. Background
11. General.
a. Advisory Circular (AC) 25.1329-1B. This advisory material replaces material previously provided in AC 25.1329-1A for autopilots. The
automatic control and guidance systems in current aircraft have evolved to a level that dictates a revision to current advisory material.
b. Scope. This advisory material provides information for flight guidance systems (FGS), which include any autopilot functions, flight
director (FD) functions, and automatic thrust control functions as well as any interactions with stability augmentation and trim functions.
12. Evolution of FGSs.
a. Complexity. There have been dramatic changes in technology and system design, which have resulted in much higher levels of integration,
automation, and complexity. These changes have also redefined the allocation of functions and interfaces between systems. Relatively simple,
dedicated systems have been replaced with digital multi-function systems with more modes and automatic changes in modes of operation. The
introduction of fly-by-wire flight control systems has created new interface considerations for the FGS.
b. Guidance Considerations. These new systems are capable of providing better performance, increased safety, and decreased workload. But,
if designed without consideration for the criteria in this AC, these systems could also be confusing and not immediately intuitive for the
flightcrew. Significant operational experience has been gained on new generation systems, and this guidance material is provided based on that
experience.
13 - 16 [Reserved]
Chapter 2. Overview of flight guidance systems (FGS)
17. Purpose of FGS. The FGS is primarily intended to assist the flightcrew in the basic control and tactical guidance of the airplane. The system
may also provide workload relief to the pilots and provide a means to fly a flight path more accurately to support specific operational
requirements, such as reduced vertical separation minimum (RVSM) or required navigation performance (RNP).
18. FGS Components.
a. Included in Definition. For the purpose of this AC, the term “FGS” includes all the equipment necessary to accomplish the FGS function,
including the sensors, computers, power supplies, servo-motors/actuators, and associated wiring. It includes any indications and controllers
necessary for the pilot to manage and supervise the system.

Page 3
b. Excluded from Definition. Any equipment or component that remains mechanically connected to the primary flight controls or propulsion
controls when the FGS is not in use is regarded as a part of the primary flight controls and propulsion system, and the provisions for such
systems are applicable.
19. FGS functions.
a. Elements of FGS.
(1) Flight guidance and control (for example, autopilot, FD displayed head down or head up).
(2) Autothrottle/autothrust systems. The term “autothrust” is generic in nature and includes power control systems for propeller driven
airplanes.
(3) Interactions with stability augmentation and trim systems.
(4) Alerting, status, mode annunciation, and situation information associated with flight guidance and control functions.
b. Approach and Landing System. The FGS includes those functions necessary to provide guidance and control in conjunction with an
approach and landing system, such as the following:
(1) Instrument landing system (ILS)
(2) Microwave landing system (MLS)
(3) Ground-Based Augmentation System (GBAS) Landing System (GLS.)
c. Flight Management System (FMS). The FGS also includes those functions necessary to provide guidance and control in conjunction with a
FMS. The FGS does not include the flight planning and the generation of flight path and speed profiles tied to waypoints and other flight
planning aspects of the FMS. However, it does include the interface between the FMS and FGS necessary for the execution of flight path and
speed commands.
d. Design Philosophy. The applicant should establish, document, and follow a design philosophy that supports the intended operational use
regarding FGS behavior, modes of operation, the pilot interface with controls, indications, alerts, and mode functionality.
e. Description of FGS Behavior and Operation. A description of the FGS behavior and operation should be addressed from flightcrew and
maintenance perspectives in appropriate documentation and training material.
20. Compliance with § 25.1329.
a. General. Subsequent chapters of this advisory material provide acceptable means of compliance with § 25.1329 and the applicability of
other part 25 rules to FGS (e.g., §§ 25.1301 and 25.1309). The demonstrated means of compliance may include a combination of analysis,
laboratory testing, flight testing, and simulator testing. The applicant should coordinate with the FAA early in the certification program via a
certification plan to reach agreement on the methods to be used to demonstrate compliance.
Note 1:
This AC uses the terminology “should” and “should not” when discussing compliance to the AC itself, as the AC represents one, but not
the only, method of complying with § 25.1329.
Note 2:
This AC uses the terminology “must” and “may not” when discussing compliance to § 25.1329 and other specific rules, as compliance to
a rule is not optional. In these cases, the AC text supplies a reference to the specific rule being discussed.
b. Relevant Paragraphs. The following table (Table 2-1) lists the relevant paragraphs of § 25.1329 and indicates where acceptable means of
compliance with each paragraph can be found within this AC.
Table 2-1 Cross-References

§ 25.1329 Paragraphs to AC Chapters
Section/Paragraph AC Chapter Reference/Paragraph
§ 25.1329(a) Chapter 3
Quick disengagement controls for the autopilot and FGS Engagement, Disengagement, Indications, and
autothrust functions must be provided for each pilot. The Override
autopilot quick disengagement controls must be located Paragraph 27, Autopilot Engagement,
on both control wheels (or equivalent). The autothrust Disengagement, and Indications
quick disengagement controls must be located on the
thrust control levers. Quick disengagement controls must Paragraph 29, Autothrust Engagement,
be readily accessible to each pilot while operating the Disengagement, Indications
control wheel (or equivalent) and thrust control levers.
§ 25.1329(b) Chapter 3
The effects of a failure of the system to disengage the FGS Engagement, Disengagement, Indications, and
autopilot or autothrust functions when manually Override
commanded by the pilot must be assessed in accordance Paragraph 27, Autopilot Engagement,
with the requirements of § 25.1309. Disengagement, Indications
Paragraph 29, Autothrust Engagement,

Page 4
Disengagement, and Indications
Paragraph 30, Override of the FGS
Chapter 8
Safety Assessment
Paragraph 89, Failure to Disengage the FGS
§ 25.1329(c) Chapter 3
Engagement or switching of the flight guidance system, a FGS Engagement, Disengagement, Indications, and
mode, or a sensor may not cause a transient response of Override
the airplane's flight path any greater than a minor
transient, as defined in paragraph (n)(1) of this section. Chapter 8
Safety Assessment
§ 25.1329(d) Chapter 3
Under normal conditions, the disengagement of any FGS Engagement, Disengagement, Indications, and
automatic control function of a flight guidance system Override
may not cause a transient response of the airplane's flight
path any greater than a minor transient. Chapter 4
Controls, Indications, and Alerts
Paragraph 45, FGS Alerting, Warning, Caution,
Advisory, and Status
Chapter 8
Safety Assessment
§ 25.1329(e) Chapter 3
Under rare normal and non-normal conditions, FGS Engagement, Disengagement, Indications, and
disengagement of any automatic control function of a Override
flight guidance system may not result in a transient any
greater than a significant transient, as defined in Chapter 4
paragraph (n)(2) of this section. Controls, Indications, and Alerts
Chapter 8
Safety Assessment
§ 25.1329(f) Chapter 4
The function and direction of motion of each command Controls, Indications and Alerts
reference control, such as heading select or vertical Paragraph 43, FGS Controls
speed, must be plainly indicated on, or adjacent to, each
control if necessary to prevent inappropriate use or
confusion.
§ 25.1329(g) Chapter 4
Under any condition of flight appropriate to its use, the Controls, Indications and Alerts
flight guidance system may not produce hazardous loads Paragraph 45, FGS Alerting, Warning, Caution,
on the airplane, nor create hazardous deviations in the Advisory, and Status
flight path. This applies to both fault-free operation and
in the event of a malfunction, and assumes that the pilot Chapter 5
begins corrective action within a reasonable period of Performance of Function
time.
Chapter 8
Safety Assessment
Chapter 9
Compliance Demonstration Using Flight Test and
Simulation
§ 25.1329(h) Chapter 5
When the flight guidance system is in use, a means must Performance of Function
be provided to avoid excursions beyond an acceptable Paragraph 57, Speed Protection
margin from the speed range of the normal flight
envelope. If the airplane experiences an excursion
outside this range, a means must be provided to prevent
the flight guidance system from providing guidance or
control to an unsafe speed.
§ 25.1329(i) Chapter 4
The flight guidance system functions, controls, Controls, Indications, and Alerts
indications, and alerts must be designed to minimize
flightcrew errors and confusion concerning the behavior
and operation of the flight guidance system. Means must
Page 5
be provided to indicate the current mode of operation,
including any armed modes, transitions, and reversions.
Selector switch position is not an acceptable means of
indication. The controls and indications must be grouped
and presented in a logical and consistent manner. The
indications must be visible to each pilot under all
expected lighting conditions.
§ 25.1329(j) Chapter 3
Following disengagement of the autopilot, a warning FGS Engagement, Disengagement, Indications, and
(visual and auditory) must be provided to each pilot and Override
be timely and distinct from all other cockpit warnings. Paragraph 27, Autopilot Engagement,
Disengagement, and Indications,
Chapter 8
Safety Assessment
§ 25.1329(k) Chapter 3
Following disengagement of the autothrust function, a FGS Engagement, Disengagement, Indications, and
caution must be provided to each pilot. Override
Paragraph 27, Autopilot Engagement,
Disengagement, and Indications
Chapter 8
Safety Assessment
§ 25.1329(l) Chapter 3
The autopilot may not create a potential hazard when the FGS Engagement, Disengagement, Indications, and
flightcrew applies an override force to the flight controls. Override
Paragraph 30, Override of the FGS
Chapter 4
Controls, Indications, and Alerts
Chapter 8
Safety Assessment
§ 25.1329(m) Chapter 3
During autothrust operation, it must be possible for the FGS Engagement, Disengagement, Indications, and
flightcrew to move the thrust levers without requiring Override paragraph 30, Override of the FGS
excessive force. The autothrust may not create a potential
hazard when the flightcrew applies an override force to Chapter 8
the thrust levers. Safety Assessment
§ 25.1329(n) Appendix 3 - Definitions
For purposes of this section, a transient is a disturbance
in the control or flight path of the airplane that is not
consistent with response to flightcrew inputs or
environmental conditions.
(1) A minor transient would not significantly reduce

safety margins and would involve flightcrew actions that
are well within their capabilities. A minor transient may
involve a slight increase in flightcrew workload or some
physical discomfort to passengers or cabin crew.
(2) A significant transient may lead to a significant

reduction in safety margins, an increase in flightcrew
workload, discomfort to the flightcrew, or physical
distress to the passengers or cabin crew, possibly
including non-fatal injuries. Significant transients do not
require, in order to remain within or recover to the
normal flight envelope, any of the following:
(i) Exceptional piloting skill, alertness, or strength.
(ii) Forces applied by the pilot which are greater than

those specified in § 25.143(d).
(iii) Accelerations or attitudes in the airplane that might

result in further hazard to secured or non-secured

Page 6
occupants.
Note: The text for each paragraph in § 25.1329 is included in this AC for reference only. Please refer to the actual
text in 14 CFR part 25.
21 - 26 [Reserved]
Chapter 3. FGS engagement, disengagement, indications, and override
27. Autopilot engagement, disengagement, and indications. Autopilot engagement and disengagement should be accomplished in a manner
consistent with other flightcrew procedures and tasks and should not require undue attention.
a. Autopilot Engagement.
(1) Single Switch Action. Each pilot should be able to select the autopilot function of the FGS with a single switch action. The single
switch action should engage both the pitch and roll axes.
(2) Engagement Status of Autopilot. The autopilot system should provide positive indication to the flightcrew that the system has been
engaged. The selector switch position is not acceptable as a means of indication. [See § 25.1329(i)] Regardless of the method used, the
engagement status (and changes in status) of the autopilot(s) should be clearly indicated and should not require undue attention or recall.
NOTE:
If an operational need is identified for split-axis engagement, then annunciation or indication should be provided for each axis.
(3) Multiple Autopilots. If a single autopilot within a multiple autopilot installation can be individually selected by the flightcrew, the
engagement annunciation should reflect the flightcrew selection. It should not be possible for multiple autopilots to be engaged in different
modes. For modes that use multiple autopilots, the additional autopilots may engage automatically at selection of the mode or after arming the
mode. A means should be provided to determine that adequate autopilot capability exists to support the intended operation (for example, "Land
2" and "Land 3" are used in some aircraft).
(4) Acceptable Transients. The engagement of the autopilot should be free of perceptible transients. Under dynamic conditions, including
maneuvering flight, minor transients are acceptable. However, with normal operating conditions, significant transients may not occur. [See §
25.1329(d)]
(5) Flight Director (FD) Not Engaged. Without a FD engaged, the initial lateral and vertical modes should be consistent with minimal
disturbance from the flight path. For example, the lateral mode at engagement may roll the airplane to wings level and then hold the airplane
heading/track or maintain the existing bank angle (if in a normal range). A heading/track pre-select at engagement function may be provided, if
precautions are taken to ensure that selection reflects the current intent of the flightcrew. The modes at engagement should be annunciated and
any associated selected target values should be displayed.
(6) FD Engaged. With a FD engaged, the autopilot should engage in a mode consistent with (that is, the same as, or if that is not possible,
then compatible with) the active FD mode of operation. Consideration should be given to the mode in which the autopilot will engage when large
commands are present on either or both FDs. The following examples list some of these considerations:
(a) Should the autopilot retain the active FD mode or should it engage in the basic default mode?
(b) Are there any implications for current flight path references and targets?
(c) Is there any potential for flightcrew confusion and unintended changes in flight path or modes?
NOTE:
The design should consider the possibility that the pilot may attempt to engage the autopilot outside of the normal flight envelope. It is
not required that the autopilot compensate for unusual attitudes or other situations outside the normal flight envelope, unless that is part
of the autopilot's intended function.
b. Autopilot Disengagement.
(1) General.
(a) Normal Conditions. Under normal conditions, automatic or manual disengagement of the autopilot should be free of perceptible
transients or out-of-trim forces that are not consistent with the maneuvers being conducted by the airplane at the time of disengagement. A
disengagement in normal conditions may not result in a transient any greater than a minor transient. If multiple autopilots are engaged, any
disengagement of an individual autopilot may not result in a transient any greater than a minor transient. [See § 25.1329(d)] The disengagement
of an individual autopilot should not adversely affect the operation of the remaining engaged autopilot(s).
(b) Other Than Normal Conditions. Under other than normal conditions (that is, non-normal or rare normal conditions),
disengagement of the autopilot may not result in a transient any greater than a significant transient. [See § 25.1329(e)] (See Chapter 5,
Performance of Function, paragraphs 54 and 56 of this AC for a discussion of non-normal and rare normal conditions). The flightcrew should be
able to respond to a significant transient without using any of the following:
1 exceptional piloting skill, alertness, or strength,
2 forces greater than those given in § 25.143(d), or
3 accelerations or attitudes in the airplane that might result in a hazard to secured or non-secured occupants.
Page 7
(c) Potential for Significant Transient. The flightcrew should be made aware (via a suitable alerting or other indication) of conditions
or situations (for example, continued out-of-trim) that could result in a significant transient at disengagement. [See Chapter 4, Controls,
Indications, and Alerts, paragraph 45d, Awareness of Potential Significant Transient Condition (“Bark before Bite”).]
NOTE:
See Appendix 2 for definitions of significant transient and minor transient. See Chapter 5, Performance of Function, paragraphs 53, 54,
and 56 for a discussion of normal conditions, rare normal conditions, and non-normal conditions.
(2) Autopilot Disengagement Alerts.
(a) Alert Type. Since it is necessary for a pilot to immediately assume manual control following disengagement (manual or automatic)
of the autopilot, a warning (both visual and aural) must be given. [See § 25.1329(j)]
(b) Aural Warning Specifications. A timely aural warning must be provided and must be distinct from all other cockpit warnings. [See
§ 25.1329(j)] It should sound long enough to ensure that it is heard and recognized by the pilot and other flight crewmembers, but not so long
that it adversely affects communication between crewmembers or is a distraction. The aural warning should continue until silenced by one of the
following means:
1 Activation of the autopilot quick disengagement control.
2 Re-engagement of the autopilot.
3 Another acceptable means.
(c) Multiple Autopilot System.
1 Disengagement of an autopilot channel within a multiple-channel autopilot system, downgraded system capability, or a
reduction in the level of system redundancy which requires immediate flightcrew awareness and possible timely action should cause a caution
level alert to be issued to the flightcrew.
2 Disengagement of an autopilot channel within a multiple-channel autopilot system which requires only flightcrew awareness
should cause a suitable advisory level alert to be issued to the flightcrew.
(3) Quick Disengagement Control.
(a) Purpose. The purpose of the quick disengagement control is to ensure the capability for each pilot to manually disengage the
autopilot quickly with a minimum of pilot hand/limb movement.
(b) Location. The quick disengagement control must be located on each control wheel or equivalent. [See § 25.1329(a)] It should be
within easy reach of one or more fingers/thumb of the pilot's hand when the hand is in a position for normal use on the control wheel or
equivalent.
(c) Criteria. The quick disengagement control:
1 Must be operable with one hand on the control wheel or equivalent and the other hand on the thrust levers. [See § 25.1329(a)]
2 Should be accessible and operable from a normal hands-on position without requiring a shift in hand position or grip on the
control wheel or equivalent.
3 Should be easily locatable by the pilot without having to first locate the control visually.
4 Should be designed so that any action to operate the quick disengagement control should not cause an unintended input to the
control wheel (or equivalent).
5 Should be designed to minimize inadvertent operation and interference from other nearby control wheel (or equivalent)
switches/ devices, such as radio control or trim.
NOTE:
When establishing location of the quick disengagement control, consideration should be given to its accessibility with large
displacements of or forces on the control wheel (or equivalent) and the possible need to operate the quick disengagement control with the
other hand.
(4) Alternative Means of Autopilot Disengagement.
(a) Factors to Consider. When a § 25.1309 assessment shows a need for an alternative means of disengagement, the following factors
should be addressed:
1 Independence from primary quick disengagement control.
2 Whether alternative means are readily accessible to each pilot.
3 Reliability and the possibility of latent failure of those alternative means.
(b) Acceptable Means. The following means of providing an alternative disengagement have been found to be acceptable:
1 Selecting the engagement control to the “off” position.
2 Disengaging the bar on mode select panel (MSP).
Page 8
3 Activating the trim switch on the yoke.
NOTE:
Use of circuit breakers as a means of disengagement is not considered acceptable.
(5) Flightcrew Pitch Trim Input. If the autopilot is engaged and the pilot applies manual pitch trim input, and the autopilot is designed to
disengage because of that flight crew action, the autopilot must disengage with no more than a minor transient. [See § 25.1329(c)] Alternatively,
pitch trim changes may be inhibited, such that the potential for a transient is removed.
28. FD engagement, disengagement, and indications. Engagement and disengagement of the FD should be accomplished consistent with other
flightcrew procedures and tasks and should not require undue attention.
a. FD Engagement.
(1) General.
(a) Selection. A means may be provided for each pilot to select (that is, turn on) and de-select (that is, turn off) the FD for display on
his or her primary flight display (PFD).
(b) Engagement. A FD is considered “engaged” if it is selected and displaying guidance cues.
NOTE:
The distinction is made between “engaged” and “selected,” because the FD might be selected but not displaying guidance cue(s) (for
example, the cue(s) are biased out of view).
(c) Engagement Status of FD. The selection status of the FD and the source of FD guidance should be clear and unambiguous. Failure
of a selected FD should be clearly annunciated.
(d) Multiple FDs. If there are multiple FDs and if necessary for crew awareness, indications should be provided to denote which FD is
engaged (for example, FD1, FD2, HUD (head up display)). For airplanes with multiple FDs installed, all engaged FDs should always be in the
same armed and active FGS modes. The selection status of each FD should be clear and unambiguous for each pilot. In addition, indications
should be provided to denote loss of FD independence (for example, first officer selection of captain's FD).
(e) Autopilot Engaged. A FD should engage into the current modes and targets of an already engaged autopilot or FD, if any. With no
autopilot engaged, the basic modes at engagement of the FD functions should be established consistent with typical flight operations.
NOTE:
The engagement of the pitch axis in Vertical Speed or Flight Path Angle and engagement of the lateral axis in Heading Hold, Heading
Select, or Bank Angle Hold have been found to be acceptable.
(f) HUD. Since the HUD can display flight guidance, the HUD guidance mode should be indicated to both pilots and should be
compatible with the active head down FD mode.
(g) Maneuvering Flight. Engagement during maneuvering flight should be considered.
NOTE:
The design should consider the safety consequences if it is possible for the FD to engage outside of the normal flight envelope. It is not
required that the FD should compensate for unusual attitudes or other situations outside the normal flight envelope, unless that is part of
the FD's intended function.
(2) Guidance Cue(s).
(a) Display. The FD command guidance cue(s) will typically be displayed under the following conditions:
1 When the FD is selected and valid command guidance is available, or
2 When the FD is automatically providing guidance (See paragraph (3), below).
(b) Engagement Indication. The display of guidance cue(s) (for example, FD bars) is sufficient indication that the FD is engaged.
(c) Invalid Guidance. The FD guidance cue(s) should be removed when guidance is determined to be invalid.
(3) Reactive Windshear Guidance System. For airplanes equipped with a FD windshear guidance system, FD engagement should be
provided consistent with the criteria in AC 25-12, Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport
Category Airplanes; and AC 120-41, Criteria for Operational Approval of Airborne Windshear Alerting and Flight Guidance.
b. FD Disengagement. There should be a means for each pilot to readily de-select his or her on-side FD function. Flightcrew awareness of
disengagement and de-selection is important. Removal of guidance cue(s) alone is not sufficient indication of de-selection, because the guidance
cue(s) may be removed from view for a number of reasons, including invalid guidance or autopilot engagement. Therefore, the FD function
should provide clear and unambiguous indication to the flightcrew that the function has been deselected.
29. Autothrust engagement, disengagement, and indications. Engagement and disengagement should be accomplished in a manner consistent
with other flightcrew procedures and tasks and should not require undue attention.
a. Autothrust Engagement.

Page 9
(1) Indication. The autothrust function must provide the flightcrew positive indication that the system has been engaged. (See §
25.1329(i))
(2) Accessibility of Controls. The autothrust engagement controls should be accessible to each pilot.
(3) Inadvertent Engagement/Disengagement. The autothrust function should normally be designed to prevent inadvertent engagement and
inadvertent application of thrust for both on-ground and in-air operations. For example, separate arm and engage functions may be provided.
(4) Automatic Engagement. Intended automatic engagement, such as a “wake up” mode to protect for unsafe speeds, may be acceptable.
(See Chapter 5, paragraph 57b, Low Speed Protection.) If such automatic engagement occurs, it should be clear to the flightcrew that automatic
engagement has occurred. The automatic engagement may not cause a transient larger than a minor transient. [See § 25.1329(c)] The transition to
the engaged state should be smooth, and should not cause large, unexpected changes in pitch attitudes or pitching moments. The reason for
automatic engagement should be clear and obvious to the flightcrew.
NOTE:
The design should consider the possibility that the pilot may attempt to engage the autothrust function outside of the normal flight
envelope or at excessive or too low engine thrust. It is not expected that the autothrust feature should compensate for situations outside
the normal flight envelope or normal engine operation range, unless that is part of the intended function of the autothrust system.
b. Autothrust Disengagement.
(1) Indication of Disengagement. Positive indication of disengagement of the autothrust function must result in a caution level alert to the
flightcrew. [See § 25.1329(k)] The autothrust “engage” status annunciations should be deleted.
(a) Visual Indication.
1 Following automatic disengagement: Visual indication of disengagement should persist until canceled by flightcrew action.
2 Following manual disengagement: If an aural alert is provided, visual indication of disengagement should persist for some
minimum period. If an aural alert is not provided, visual indication of disengagement should persist until canceled by flightcrew action.
(b) Aural alert. If provided, the aural disengagement alert should be of sufficient duration and volume to assure that the flightcrew has
been alerted that disengagement has occurred. However, an extended cycle of an aural alert is not acceptable following disengagement, if such an
alert can significantly interfere with flightcrew coordination or radio communication.
(2) Inadvertent Disengagement. The autothrust normally should be designed to preclude inadvertent disengagement during activation of
autothrust modes of operation.
(3) Consequence of Disengagement. Under normal conditions, autothrust disengagement may not cause a transient any greater than a
minor transient. [See § 25.1329(d)] The transition to the disengaged state should be smooth and not cause unexpected changes in pitch attitude or
pitching moment or a significant thrust transient. The disengagement should not preclude, inhibit, or interfere with timely thrust changes for
go-around, landing, or other maneuvers requiring manual thrust changes.
(4) Autothrust Quick Disengagement Control. Autothrust quick disengagement controls must be provided for each pilot on the respective
thrust control (thrust lever or equivalent). A single-action, quick disengagement switch must be incorporated on the thrust control, so that switch
activation can be executed when the pilot's other hand is on the control wheel (or equivalent). [See § 25.1329(a)] The disengagement control
should be positioned such that inadvertent disengagement of the autothrust function is unlikely. Positioning the control on the outboard side has
been shown to be acceptable for multi-engine aircraft. Thrust lever knob, end-mounted disengagement controls available on both sides to
facilitate use by either pilot have been shown to be preferable to those positioned to be accessible by the pilot's palm.
30. Override of the FGS.
a. General. An override of an engaged FGS function is defined as an action taken by the flightcrew intended to prevent, oppose, or alter an
operation being conducted by the FGS function without first disengaging that function.
b. Autopilot Override.
(1) With Automatic Disengagement.
(a) Override Force. The autopilot should disengage when the flightcrew applies a significant override force to the controls. The
applicant should interpret “significant” as a force that is consistent with an intention to overpower the autopilot by either or both pilots. The
autopilot should not disengage by minor application of force to the controls, such as a pilot gently bumping the control column while entering or
exiting a pilot seat during cruise.
NOTE:
Twenty-five pounds (25 lbs) of force at the control column or wheel has been determined to be a significant override force level for other
than approach operations on some aircraft types. To reduce nuisance disengagement, higher forces have been found acceptable for certain
approach, landing, and go-around operations on some aircraft. The force to disengage an autopilot is not necessarily the force required at
the column to oppose autopilot control, that is, to cause elevator movement. The corresponding forces for a sidestick controller may be
different.
(b) Transients Resulting from Override. In normal operating conditions, a transient larger than a minor transient may not result from
autopilot disengagement when the flightcrew applies an override force to the controls. [See § 25.1329(d)] Mitigation may be accomplished
through provision of an appropriate alert and flightcrew procedure.

Page 10
(c) Sustained Override Force Below Level Required for Automatic Disconnect. Sustained application of force below the
disengagement threshold may not result in a potential hazard. [See § 25.1329(l)] For example, the automatic trim should not run to oppose the
override of the autopilot by the flightcrew that would result in unacceptable airplane motion, if the autopilot were to automatically disengage or
be manually disengaged.
(2) Without Automatic Disengagement.
(a) Potential Hazard. If the FGS is not designed to disengage in response to any override force, then the response to an override may
not result in a potential hazard. Sustained application of an override force may not result in a potential hazard, such as when the flightcrew
abruptly releases the force on the controls. [See § 25.1329(l)] Mitigation may be accomplished through provision of an appropriate alert and
flightcrew procedure.
NOTE:
The term “sustained application of override force” is intended to describe a force that is applied to the controls which may be small, slow,
and sustained for some period of time. This may be due to an inadvertent crew action or may be an intentional crew action meant to
“assist” the autopilot in a particular maneuver. (See Chapter 9, Compliance Demonstration Using Flight Test and Simulation, paragraph
99f, Flightcrew Override of the FGS, for more information.)
(b) Transients Resulting from Override. In normal operating conditions, a transient larger than a minor transient may not result from
manual autopilot disengagement after the flightcrew has applied an override force to the controls. [See § 25.1329(d)] Mitigation may be
accomplished through provision of an appropriate alert and flightcrew procedure.
NOTE 1:
The term “override force” is intended to describe a pilot action that is intended to prevent, oppose or alter an operation being conducted
by a flight guidance function without first disengaging that function. One possible reason for this action could be an avoidance maneuver,
such as responding to a traffic alert and collision avoidance system (TCAS) resolution advisory that requires immediate action by the
flightcrew and would typically involve a rapid and forceful input from the flightcrew.
NOTE 2:
For control wheel steering considerations, see Chapter 6, Characteristics of Specific Modes, paragraph 68, Control Wheel Steering
(CWS) [control steering through the autopilot].
c. Autothrust Override.
(1) Force Required. It should be possible for the pilot to readily override the autothrust function and set thrust by moving the thrust levers
(or equivalent) with one hand.
(2) Response To Override. The autothrust response to a flightcrew override may not create a potential hazard. [See § 25.1329(m)] The
autothrust response to the flightcrew override should not result in an abrupt change of pitch attitude, an abrupt pitching moment, or an
uncontrolled change of thrust.
(3) Engagement Status With Override. Autothrust functions may be designed to safely remain engaged during pilot override.
Alternatively, autothrust functions may disengage as a result of pilot override, provided that the design prevents unintentional autothrust
disengagement and adequately alerts the flightcrew to ensure pilot awareness.
31. FGS Engagement mode compatibility.
a. FGS Mode Engagement Philosophy. A description of the philosophy used for the mode at engagement of the autopilot, FD, and autothrust
functions should be provided in flightcrew training material.
b. Engagement Mode Compatibility. It should not be possible to select incompatible FGS command or guidance functions, such as
commanding speed through elevator and autothrust at the same time.
32 - 41 [Reserved]
Chapter 4. Controls, Indications, and Alerts
42. General.
a. Human-Machine Interface. The human-machine interface with the FGS is crucial to ensuring safe, effective, and consistent FGS operation.
The manner in which FGS information is depicted to the flightcrew is vital to flightcrew awareness and, therefore, to safe operation of the FGS.
b. Design of Controls, Indications, and Alerts. These features must be designed to minimize flightcrew errors and confusion. [See §
25.1329(i)] Indications and alerts should be presented in a manner compatible with the procedures and assigned tasks of the flightcrew and
provide the necessary information to perform those tasks. The indications must be grouped and presented in a logical and consistent manner and
must be visible from each pilot's station under all expected lighting conditions. [See § 25.1329(i)] The choice of colors, fonts, font size, location,
orientation, movement, graphical layout, and other characteristics-such as steady or flashing-should all contribute to the effectiveness of the
system. Controls, indications, and alerts should be implemented in a consistent manner.
c. Evaluation of Information Provided by FGS. It is recommended that the applicant evaluate the adequacy and effectiveness of the
information provided by the FGS interface, that is the controls, indications, alerts, and displays, to ensure flightcrew awareness of FGS behavior
and operation. See Chapter 9, Compliance Demonstration Using Flight Test and Simulation, for more discussion of appropriate analyses which
may include, for example, cognitive task analysis as a basis for evaluation.

Page 11
43. FGS Controls.
a. General. The FGS controls must be designed and located to prevent crew errors, confusion, and inadvertent operation. [See § 25.1329(i)]
They should be designed to provide convenience of operation to each crewmember. The function and direction of motion of each control must be
readily apparent or plainly indicated on or adjacent to each control, if needed to prevent inappropriate use or confusion. [See § 25.1329(f)]
Sections 25.777(b) and 25.779(a) provide requirements regarding direction of motion of flight deck controls. These requirements apply for FGS
command reference controls which select target values, such as heading select or vertical speed. Section 25.781 also provides requirements for
the shapes of the knobs.
b. Design Considerations. The design of the FGS should address the following specific considerations:
(1) Differentiation of Knob Shape and Position. Errors by the flightcrew have included confusing speed and heading knobs on the MSP.
(2) Design to Support Correct Selection of Target Values. Use of a single control, such as concentric controls, for selecting multiple
command reference targets has resulted in erroneous target value selection.
(3) Commonality Across Aircraft Types. Use of uniform control design in different aircraft prevents negative transfer of learning with
respect to operation of the controls. Using knowledge about the operation of the controls on one type of airplane has resulted in activation of the
incorrect control when pilots move from that type of airplane to another type of airplane. An example of this is confusion between the
takeoff/go-around button and the autothrust disengagement button when transitioning between aircraft types with differing designs and locations
for these controls.
(4) Positioning of Controls and Related Indications. Individual FGS controls, flight mode annunciator (FMA), and related PFD
information should be positioned so that, as much as reasonably practical, items of related function have similarly related positions.
Misinterpretation and confusion have occurred due to the inconsistent arrangement of FGS controls with the annunciations on the FMA.
(5) Inadvertent Operation. The FGS controls must be located to discourage or avoid inadvertent operation, such as inadvertent
engagement or disengagement. [See § 25.777(a)] Further design aspects of the FGS controls, other than location of the controls, should also be
used discourage or avoid inadvertent operation. Examples include the shape of the control and the force required for operation.
44. FGS Mode selection, annunciation, and indication.
a. Annunciation of Engagement of the FGS. Engagement of the FGS functions must be suitably annunciated to each pilot. [See § 25.1329(i)]
Guidance is provided in Chapter 3, FGS Engagement, Disengagement, Indications, and Override.
b. Description of FGS Modes. The operator should be provided with appropriate descriptions of the FGS modes and their behaviors.
c. FGS Mode Annunciations. Mode annunciation must indicate the state of the system. [See § 25.1329(i)] Mode annunciation should be
presented in a manner compatible with flightcrew procedures/tasks and be consistent with the mode annunciation design for the specific aircraft
type. That is, the mode annunciation should be compatible with other flight deck systems mode annunciations. Mode selector switch position or
status is not acceptable as the sole means of mode annunciation. [See § 25.1329(i)] Modes and mode changes should be depicted in a manner
that achieves flightcrew attention and awareness.
(1) Active and Armed Modes. The FGS mode annunciations must effectively and unambiguously indicate the active and armed modes of
operation. [See § 25.1329(i)] The mode annunciation should convey explicitly, and as simply as possible, what the FGS is doing (for active
modes), what it will be doing (for armed modes), and target information (such as selected speed, heading, and altitude) for satisfactory flightcrew
awareness.
(2) Location. Mode annunciations should be located in the forward field of view. For example, a suitable location is on the PFD. Engaged
modes should be annunciated at different locations than armed modes to assist in mode recognition.
(3) Discriminators. Color, font type, font size, location, highlighting, and symbol flashing have historical precedent as good
discriminators, when implemented appropriately. The fonts and font size should be chosen so that annunciation of FGS mode and status
information is readable and understandable without eyestrain when viewed by the pilot seated at the design eye position. The use of graphical or
symbolic (that is, non-textual) indications is acceptable. Implementation of such discriminators should follow accepted guidelines, as described
in applicable international standards (such as AC 25-11A, Transport Category Airplane Electronic Display Systems), and should be evaluated for
their consistency with and integration with the flight deck design.
(4) Color. Color should be used in a consistent manner and assure compatibility with the overall use of color on the flight deck. Specific
colors should be used such that the FGS displays are consistent with other flight deck systems, such as a flight management system (FMS). The
use of monochrome displays is not precluded, provided that the aspects of flightcrew attention and awareness are satisfied. Engaged modes
should be annunciated with different colors than armed modes to assist in mode recognition.
d. Mode Changes.
(1) Operationally Relevant Mode Changes. Mode changes that are operationally relevant-especially mode reversions and sustained speed
protection-should be clearly and positively annunciated to ensure flightcrew awareness. Altitude Capture is an example of an operationally
relevant mode that should be annunciated, because pilot actions during that brief time the mode is operational may have different effects on the
airplane. Annunciation of sustained speed protection should be clear and distinct to ensure flightcrew awareness. The FGS sub-modes that are
not operationally relevant (for example, sub-modes as the FGS transitions from instrument landing system Localizer (LOC) Capture to Localizer
Track) need not be annunciated.
(2) Attention-Getting Features. The transition from an armed mode to an engaged mode should provide an additional attention-getting
feature, such as boxing and flashing on an electronic display (see AC 25-11A) for a suitable, but brief, period (for example, ten seconds) to assist
in flightcrew awareness. Aural notification of mode changes should be limited to special considerations.

Page 12
(3) Use Of Alerts. In-service experience has shown that mode annunciation alone may be insufficient-unclear or not compelling
enough-to communicate mode changes to the flightcrew, especially in high workload situations. Therefore, the safety consequences of the
flightcrew not recognizing mode changes should be considered. If necessary, an appropriate alert should be used.
e. Failure to Engage or Arm. The failure of a mode to engage or arm when selected by the pilot should be apparent.
f. FGS Mode Display and Indications. Mode information provided to the flightcrew should be sufficiently detailed, so that the consequences
of the interaction between the FGS and the flightcrew can be determined unambiguously. The FGS interface should provide timely and positive
indication when the FGS deviates from the pilot's direct commands (for example, a target altitude or speed setting) or from the pilot's
pre-programmed set of commands (for example, waypoint crossing). The interface should also provide clear indication when there is a difference
or conflict between pilot-initiated commands. An example would be when a pilot engages positive vertical speed and then selects an altitude that
is lower than the aircraft altitude. The default action taken by the FGS should be made apparent.
45. FGS Alerting, warning, caution, advisory, and status.
a. General.
(1) Alerting Provisions. Alerting information must follow the provisions of § 25.1322. The advisory material associated with § 25.1322
should be consulted. Alerts for FGS engagement and disengagement are described in Chapter 3, FGS Engagement, Disengagement, Indications,
and Override.
(2) Determination of FGS Capability. There should be some method for the flightcrew to determine and monitor the availability or
capability of the FGS (for example, prior to dispatch), where the intended operation is predicated on the use of the FGS. The method of
monitoring provided should take account of the hazard resulting from the loss of the autopilot function for the intended operation.
b. Speed Protection Alerts.
(1) Alerts to Crew. To assure crew awareness, an alert should be provided when a sustained speed protection condition is detected. This is
in addition to any annunciations associated with mode reversions that occur as a consequence of invoking speed protection (See Chapter 5,
Performance of Function, paragraph 57, Speed Protection).
(2) Alert Specifications.
(a) Low Speed Protection. Low speed protection alerts should include both an aural and a visual component.
(b) High Speed Protection. High-speed protection alerts need include only a visual alert component because of existing high-speed
aural alert requirements. However, giving an alert prior to that required aural alert is not precluded. [Refer to § 25.1303(c)(1) for overspeed
alerting regulations.]
(3) Consistency. Alerts for speed protection should be consistent with the protection provided and with the other alerts in the flight deck.
(4) Nuisance Alerts. Care should be taken to set appropriate values for indicating speed protection that would not be considered a
nuisance for the flightcrew.
c. Loss of Autopilot Approach Mode. The loss of the Approach mode requires immediate flightcrew awareness. This may be accomplished
through autopilot disengagement described in AC 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and
Rollout. If the autopilot remains engaged and reverts to a non-approach mode, an appropriate aural warning and/or visual alert should be
provided.
d. Awareness of Potential Significant Transient Condition (“Bark Before Bite”).
(1) General. There have been situations where an autopilot was engaged, operating normally and controlling up to the limit of its
authority for an extended period of time, and the flightcrew was unaware of the potential hazard. This service experience has shown that, without
timely flightcrew awareness and action, such a situation can progress to a loss of control after autopilot disengagement, particularly in rare
normal or non-normal conditions. However, with adequate flightcrew awareness and pilot action, loss of control may be prevented.
(2) Flightcrew Alert(s). To help ensure flightcrew awareness and timely action, appropriate alert(s)-normally a caution or warning-should
be provided to the flightcrew for conditions that could require exceptional piloting skill or alertness for manual control following autopilot
disengagement (for example, significantly out of trim conditions). The number and type of alerts required should be determined by the unique
situations that are being detected and by the crew procedures required to address those situations. Any alert should be clear and unambiguous and
should be consistent and compatible with other flight deck alerts. Care should be taken to set appropriate thresholds for these alerts so that they
are not considered a nuisance for the flightcrew.
(3) Situations to Consider for an Alert.
(a) Sustained Lateral Control Command. If the autopilot is holding a sustained lateral control command, it could be indicative of an
unusual operating condition for which the autopilot is compensating. Examples of such unusual operating conditions are asymmetric lift and/or
drag due to asymmetric icing, fuel imbalance, or asymmetric thrust. In the worst case, the autopilot may be operating at or near its full authority
in one direction. If the autopilot were to disengage while holding this lateral trim, the result would be that the airplane could undergo a rolling
moment that could possibly take the pilot by surprise. Therefore, a timely alert should be considered to permit the crew to manually disengage
the autopilot and take control prior to any automatic disengagement that might result from the condition.
(b) Sustained Pitch Command. If the autopilot is holding sustained pitch command, it could be indicative of an unusual operating
condition (for example, inoperative automatic horizontal trim) for which the autopilot is compensating. If the autopilot were to disengage while
holding this pitch command, the result would be that the airplane could undergo an abrupt change in pitch that could possibly take the pilot by
surprise. Therefore, a timely alert should be considered to permit the crew to manually disengage the autopilot and take control prior to any

Page 13
automatic disengagement that might result from the condition.
(c) Bank and Pitch Angles. Most autopilots are designed with operational limits in both the pitch and roll axes, such that those
predetermined limits will not be purposely exceeded. If the airplane exceeds those limits, it could be indicative of a situation that requires the
pilot to intervene. Such a situation may not be covered by paragraphs (a) or (b) above. Therefore, a timely alert should bring this condition to the
attention of the flightcrew and permit the crew to manually disengage the autopilot and take control prior to any automatic disengagement which
might result.
(4) Automatic Disengagement. It is preferable that the autopilot remains engaged during out-of-trim conditions. However, if there is an
automatic disengagement feature due to excessive out-of-trim, an alert should be generated and should precede any automatic disengagement
with sufficient margin to permit timely flightcrew recognition and manual disengagement. See also Chapter 3, FGS Engagement,
Disengagement, Indications, and Override, paragraph 30, Override of the FGS, for related material.
NOTE 1:
This paragraph is not intended to require alerting for all instances of automatic autopilot disengagement. It is intended only for conditions
that would, if not addressed, lead to disengagement that could result in a significant transient (or greater) for which the pilot may be
unprepared. The intent is to provide crew awareness that would allow the flightcrew to be prepared with hands on controls and take
appropriate corrective action before the condition results in a potentially hazardous airplane configuration or state.
NOTE 2:
This paragraph describes alerting requirements for conditions resulting in unintended out-of-trim operation. There are FGS functions that
can intentionally produce out-of-trim conditions. Examples would be parallel rudder operation in align or engine failure compensation
modes, pitch trim operation during the approach/landing to provide trim up/flare spring bias, and pitch trim operation for certain types of
speed/Mach trim systems. It is not the intent of this paragraph to require alerts for functions producing intentional out-of-trim conditions.
Other system indications (for example, mode and status annunciations) should be provided to make the crew aware of the operation of
these functions, where appropriate.
46. FGS Considerations for head up displays (HUD).
a. General. HUDs have unique characteristics compared to flight displays installed on the instrument panel. Most of these HUD differences
are addressed during HUD certification whether or not the HUD provides flight guidance functions. The intent of this chapter is to address how
such HUD differences may affect FGS functions. (See SAE ARP5288, Transport Category Airplane Head Up Display Systems, for further
information on this subject. An address for obtaining SAE ARP documents is provided in paragraph 4 of this AC.)
b. Characteristics of HUD Guidance.
(1) Supplemental Use Display System. If the HUD is designed as a supplemental use display system, it does not replace the requirement
for standard head down display (HDD) of flight instrument data. The HUD is intended for use during takeoff, climb, cruise, descent, approach,
and landing under day, night, visual meteorological conditions (VMC), and instrument meteorological conditions (IMC) conditions. When it can
be reasonably expected that the pilot will operate primarily by reference to the HUD, it should be shown that the HUD is satisfactory for
manually controlling the airplane and for monitoring the performance of the FGS.
(2) External Visual References. During takeoff and landing in certain light and visibility conditions, HUD symbology can be extremely
dominant in comparison to external visual references. When visual references are relatively dim, extremely active symbology dynamics and
guidance cue gains can lead the pilot to make excessively strong corrections. It should be shown that-if HUD guidance cues are followed
regardless of the appearance of external visual references-they do not cause the pilot to take unsafe actions.
(3) Interference and Occlusion. It should be shown that there is no interference between the indications of primary flight information and
the flight guidance cues. In takeoff, approach, and landing FGS modes, the flight guidance symbology should have occlusion priority. That is, the
flight guidance symbology should not be obscured or covered by the primary flight information. The HUD guidance symbology should not
excessively interfere with pilots’ forward view, ability to visually maneuver the airplane, acquire opposing traffic, and see the runway
environment.
(4) Display Criteria. Generally, the criteria for the mechanization of guidance displayed on the HUD should be no different than for
guidance displayed on the HDD. See Chapter 5, Performance of Function, for FD performance criteria.
(5) Conformal Symbology. Unlike HDDs, HUDs are capable of displaying certain symbology conformal to the outside scene, including
guidance cues. Consequently, the range of motion of this conformal symbology, including the guidance cues, can present certain challenges in
rapidly changing and high crosswind conditions. In certain cases, the motion of the guidance and the primary reference cue may be limited by the
field of view. It should be shown that, in such cases, the guidance remains usable and that there is a positive indication that it is no longer
conformal with the outside scene.
(6) Low Visibility Approach. The HUD guidance is often used in cases, like the low visibility approach, where the pilot will need to
reference both the information displayed on the HUD and outside references. Consequently, it should be shown that the location and presentation
of the HUD information does not distract the pilot or obscure the pilot's outside view. For example, it would be necessary for the pilot to track
the guidance to the runway without having the view of runway references or hazards along the flight path obscured by the HUD symbology.
(7) Clutter. The HUD display should present flight guidance information in a clear and unambiguous manner. Display clutter should be
minimized. Some flight guidance data elements are essential or critical and should not be removed by any de-clutter function.
c. HUD/Head Down Display (HDD) Compatibility.
(1) General. The HUD FGS symbology should be compatible and consistent with symbology on other FGS displays such as head down
electronic flight instruments. The FGS-related display parameters should be consistent to avoid misinterpretation of similar information, but the
Page 14
display presentations need not be identical. The HUD and head down PFD formats and data sources need to be compatible to ensure that the
same FGS-related information presented on both displays have the same intended meaning.
(2) Consistency and Compatibility. While not all information displayed on the HUD is directly related to the FGS, the pilot is likely to
use most of the displayed information while using the HUD-displayed guidance and FGS annunciations. Therefore, when applicable, the
guidelines below for the presentation of FGS-related display information should be followed as much as possible. Certain deviations from these
guidelines may be appropriate due to conflict with other information display characteristics or requirements unique to HUDs. These may include
minimization of display clutter, minimization of excessive symbol flashing, and the presentation of certain information conformal to the outside
scene.
(a) Symbology. Symbols should be the same format. For example, a triangle-shaped pointer head down should appear as a triangle
pointer head up. However, some differences in HUD symbology, such as the FD “circle” versus head down FD “bars” or “wedge,” have been
found acceptable.
(b) Location. Information (symbols) should appear in the same general location relative to other information.
(c) Alphanumeric Data. Alphanumeric readouts should have the same resolution, units, and labeling. For example, the command
reference indication for “vertical speed” should be displayed in the same foot-per-minute increments and be labeled with the same characters as
the HDDs.
(d) Analog Scales. Analog scales or dials should have the same range and dynamic operation. For example, a glideslope deviation
scale displayed head up should have the same displayed range as the glideslope deviation scale displayed head down, and the direction of
movement should be consistent.
(e) Display of FGS Modes. The FGS modes and status state transitions should be displayed on the HUD using consistent methods,
except for the use of color. That is, the method used head down to indicate a FD mode transitioning from armed to captured should also be used
head up.
(f) Information Sources. Information sources should be consistent between the HUDs and the HDDs used by the same pilot.
(g) Display of FGS Command Information. When FGS command information (for example, a FD command) is displayed on the HUD
in addition to the HDDs, the HUD depiction and guidance cue deviation “scaling” needs to be consistent with that used on the HDDs. This is
intended to provide comparable pilot performance and workload when using either HUDs or HDDs.
(h) Display for Pilot Not Flying. The same information concerning current HUD system mode, reference data, status state transitions,
and alert information that is displayed to the pilot flying on the HUD should also be displayed to the pilot not flying on the HDDs. Consistent
nomenclature should be used to ensure unambiguous awareness of the HUD operation.
d. Alerting Issues.
(1) Alerts Displayed on HUDs. Although HUDs are typically not intended to be classified as integrated caution and warning systems, they
may display cautions, warnings, and advisories as part of their FGS function. In this regard, HUDs should provide the equivalent alerting
functionality as the head down PFD(s). Warnings that require continued flightcrew attention on the PFD also should be presented on the HUD
(for example, TCAS, windshear, and ground proximity warning (GPWS) annunciations). If master alerting indications are not provided within
the peripheral field of view of the pilot while using the HUD, the HUD should provide annunciations that inform the pilot of caution and/or
warning conditions.
(2) Monochrome HUDs. For monochrome HUDs, appropriate use of attention-getting properties, such as flashing, outline boxes,
brightness, size, and/or location are necessary to adequately compensate for the lack of color normally assigned to distinguish and call attention
to cautions and warnings.
(3) Multi-Color HUDs. For multi-color HUDs, the use of red, amber, or yellow for symbols not related to caution and warning functions
should be avoided, so that the effectiveness of distinguishing characteristics of true cautions and warnings is not reduced.
(4) Single HUD Installation. Single HUD installations rely on the fact that the pilot not flying (PNF) will monitor the head down
instruments and alerting systems for failures of systems, modes, and functions not associated with PFDs.
(5) Dual HUD Installations. Dual HUD installations require special consideration for alerting systems. It should be assumed that both
pilots will be head up simultaneously (full or part-time), especially when the HUD is being used as the primary flight reference or when the HUD
is required equipment for the operation being conducted. If master alerting indications are not provided within the peripheral field of view of
each pilot while using the HUD, then each HUD should provide annunciations that direct the pilot's attention to head down alerting displays. The
types of information that should trigger the HUD master alerting display are any cautions or warnings not already duplicated on the HUD from
head down primary display as well as any caution level or warning level engine indications or system alerts.
NOTE:
The objective is to avoid redirecting attention of the pilot flying (PF) to another display when an immediate maneuver is required (for
example, TCAS resolution advisory, windshear).
(6) Ground Proximity Warning System (GPWS)/Traffic Alert and Collision Avoidance System (TCAS) on HUD. If a GPWS, wind shear
detection system, wind shear escape guidance system, or a TCAS is installed, then the guidance, warnings and annunciations required to be a part
of these systems and normally required to be in the pilot's primary field of view should be displayed on the HUD.
e. Upset/Unusual Attitude Recovery Guidance.
(1) Guidance Cues. Upsets due to wake turbulence or other environmental conditions may result in near instantaneous excursions in pitch
and bank angles and a subsequent unusual attitude. If the HUD is designed to provide guidance for recovery from upsets or unusual attitudes,
Page 15
recovery steering guidance commands should be distinct from and not confused with orientation symbology such as horizon “pointers.” For
example, a cue for left control wheel/stick input should not be confused with a cue indicating direction to the nearest horizon. Guidance should
be removed if cues become invalid at extreme attitudes, such as zenith, nadir, overbanked (for example, greater than 90 degrees bank angle), or
inverted. For extreme attitudes, it is acceptable for the pilot to transition to the HDD, provided that the cues to transition from the HUD are clear
and unambiguous.
(2) Orientation Cues. If the HUD is designed to provide only orientation during upsets or unusual attitudes (that is, no guidance cues are
provided), those orientation cues should be designed to prevent them from being mistaken as flight control input commands.
47 - 51 [Reserved]
Chapter 5. Performance of Function
52. General.
a. Intended Function. The FGS should provide guidance or control, as appropriate, for the intended function of the active mode(s) in a safe
and predictable manner within the airplane's normal flight envelope. There are special considerations when the FGS is operating at the limits of
its performance capabilities or under significant environmental conditions. The following paragraphs provide criteria for acceptable means of
compliance and interpretive material pertaining to these considerations.
b. Effect of System Tolerances. Where system tolerances have a significant effect on autopilot authority limits, consideration should be given
to the effect on autopilot performance. Factors to be considered include, but are not limited to, tolerances of servo authority, servo clutch setting,
“cam-out” settings, control friction, and sensor tolerances.
53. Normal performance.
a. General. The FGS should be designed to provide guidance or control, as appropriate, for the intended function of the active mode(s) in a
safe and predictable manner within the airplane's normal flight envelope.
b. Conditions to Consider. The design of the FGS should consider the normal conditions listed in the following table. This table does not
fully define every condition that may be encountered during an airplane's life and unequivocally categorize what can be considered to be a
“normal condition.” Rather, the table is intended to give examples to be used during system development and testing. By the very nature of the
phenomena involved, there will always be some subjectivity to these categorizations. Also, the same conditions may affect different airplane
models in very different ways. These differences should be considered in determining how to characterize the severity of the conditions discussed
in the table.
Table 5-1
Examples of Normal Conditions
No failure conditions All airplane systems that are associated with airplane performance are fully
operational. Failures of those systems could impair the flight guidance system's (FGS)
ability to perform its functions.
Light to moderate winds Constant wind in a specific direction that may cause a slight deviation in intended
flight path or a small difference between airspeed and groundspeed.
Light to moderate wind Variation in wind velocity-as a function of altitude, position, or time-which may cause
gradients slight erratic or unpredictable changes in intended flight path.
Light to moderate gusts Non-repetitive momentary changes in wind velocity that can cause changes in altitude
and/or attitude to occur, but the aircraft remains in positive control at all times.
Light turbulence Turbulence that momentarily causes slight, erratic changes in altitude and/or attitude
(pitch, roll, or yaw).
Moderate turbulence Similar to light turbulence but of greater intensity. Changes in altitude and/or attitude
occur, but the aircraft remains in positive control at all times.
Light chop Turbulence that causes slight, rapid, and somewhat rhythmic bumpiness without
appreciable changes in altitude or attitude.
Moderate chop Similar to light chop but of greater intensity. It causes rapid bumps or jolts without
appreciable changes in aircraft altitude or attitude.
Icing All icing conditions covered by 14 CFR Part 25, Appendix C with the exception of
“asymmetric icing” discussed under “Rare Normal Conditions” in Table 5-2.
Note: Representative levels of the environmental effects should be established consistent with the airplane's intended
operation.
c. Level of Performance.
(1) Significant Characteristics. Any performance characteristics that are operationally significant or operationally limiting must be
identified with an appropriate statement or limitation in the airplane flight manual (AFM). [See § 25.1581]
(2) Configuration Changes. The FGS should perform its intended function during routine airplane configuration or power changes,
including the operation of secondary flight controls and landing gear.
(3) Compliance Evaluation. Evaluation of FGS performance for compliance should be based on the minimum level of performance
needed for its intended functions. Subjective judgment may be applied to account for experience acquired from similar equipment and levels that
Page 16
have been established as operationally acceptable by the end-user.
(4) Prescribed Levels of Performance. There are certain operations that dictate a prescribed level of performance. When the FGS is
intended for operations that require specific levels of performance, the use of FGS should be shown to meet those specific levels of performance
(for example, low visibility operations - Category II and III operations, reduced vertical separation minimums (RVSM), required navigation
performance (RNP)).
(5) Equivalence of Performance. The FGS performance of intended functions should at least be equivalent to that expected of a pilot for a
similar task. AC 25-7C, Flight Test Guide for Certification of Transport Category Airplanes, and the SAE ARP5366, Autopilot, Flight Director
and Autothrust Systems, may prove useful for establishing the general behavior of the FGS. When integrated with navigation (NAV) sensors or
the FMS, the FGS should satisfy the flight technical error tolerances expected for the use of those systems in performing their intended functions.
(6) Autopilot. The autopilot should provide smooth and accurate control without divergent or perceptible sustained nuisance oscillation.
(7) Flight Director (FD). The FD, in each available display presentation (for example, single cue, cross-pointer, flight path director)
should provide smooth and accurate guidance and be appropriately damped, to achieve satisfactory control task performance without pilot
compensation or excessive workload.
(8) Autothrust. The autothrust function should provide smooth and accurate control of thrust without significant or sustained oscillatory
power changes or excessive overshoot of the required power setting.
(9) Automatic Trim. The automatic pitch trim function should operate at a rate sufficient to mitigate excessive control surface deflections
or limitations of control authority without introducing adverse interactions with automatic control of the aircraft. Automatic roll and yaw trim
functions, if installed, should operate without introducing adverse interactions with automatic control of the aircraft.
54. Performance in rare normal conditions.
a. General.
(1) Range of Conditions. The FGS will encounter a wide range of conditions in normal operations, some of which may be infrequent but
levy a greater than average demand on the FGS capabilities. Certain environmental conditions, as discussed in paragraph b, below, are prime
examples. The FGS performance during such rare normal conditions should be assessed.
(2) Effect on Performance. Rare normal conditions may degrade the performance of the FGS but should be safe for operation of the FGS.
The relative infrequency of such conditions may also be a factor in the flightcrew's ability to detect and mitigate in a timely manner any limited
capability of the FGS to cope with them.
b. Conditions to Consider. The design of the FGS should consider the rare normal conditions listed in the following table. This table does not
fully define every condition that may be encountered during an airplane's life and unequivocally categorize what can be considered to be a “rare
normal condition.” Rather, the table is intended to give examples to be used during system development and testing. By the very nature of the
phenomena involved, there will always be some subjectivity to these categorizations. Also, the same conditions may affect different airplane
models in very different ways. These differences should be considered in determining how to characterize the severity of the conditions discussed
in the table.
Table 5-2
Examples of Rare Normal Conditions
Significant winds Constant wind in a specific direction that may cause a large change in intended flight
path or groundspeed or cause a large difference between airspeed and groundspeed.
Significant wind gradients Variation in wind velocity-as a function of altitude, position, or time-which may cause
large changes in intended flight path.
Windshear/microburst A wind gradient of such magnitude that it may cause damage to the aircraft.
Large gusts Non-repetitive momentary changes in wind velocity that can cause large changes in
altitude and/or attitude to occur. Aircraft may be momentarily out of control.
Severe turbulence Turbulence that causes large, abrupt changes in altitude or attitude. It usually causes
large variations in indicated airspeed. Aircraft may be momentarily out of control.
Asymmetric icing Icing conditions that result in ice accumulations that causes the FGS, if engaged, to
counter the aerodynamic effect of the icing conditions with a sustained pitch, roll, or
yaw command that approaches its maximum authority.
Note: Airplanes intended to meet § 121.358 for windshear warning and guidance need FD windshear guidance. The
FGS may also provide suitable autopilot control during windshear. Refer to AC 25-12 and AC 120-41 for wind shear
guidance system requirements.
(1) Performance Standard. For rare normal conditions, the FGS should be designed to provide guidance or control, as appropriate, for the
intended function of the active mode(s) in a safe and predictable manner, both within the normal flight envelope and for momentary excursions
outside the normal flight envelope. If a determination is made that there are environmental conditions in which the FGS cannot be safely
operated, appropriate operational limitations should be placed in the AFM.
(2) Autopilot Authority Limit. Operations in rare normal conditions may result in automatic or pilot-initiated autopilot disengagement
close to the limit of autopilot authority. Autopilot disengagement in rare normal conditions should meet the safety criteria for autopilot
disengagement found in Chapter 3, FGS Engagement, Disengagement, Indications, and Override, paragraph 27b, Autopilot Disengagement, and
Page 17
the criteria for flight guidance alerting in Chapter 4, Controls, Indications, and Alerts, paragraph 45d, Awareness of Potential Significant
Transient Condition (“Bark Before Bite”).
(3) Masking of Potential Hazard. It is not necessary that the FGS always be disengaged when rare normal conditions that may degrade its
performance or capability are encountered. The FGS may significantly help the flightcrew during such conditions. However, the design should
address the potential for the FGS to mask a condition from the flightcrew or otherwise delay appropriate flightcrew action. See Chapter 4,
paragraph 45, FGS Alerting, Warning, Caution, Advisory, and Status, for discussion of alerting under such conditions.
55. Icing consideration in normal and rare normal conditions.
a. Effect on Performance. The FGS typically will be designed to provide acceptable performance in all standard airplane configurations.
Operating an airplane in icing conditions can have significant implications on the aerodynamic characteristics of the airplane (for example, ice
accretion on wings, tail, and engines) and, consequently, on FGS performance. Ice accretion may be slow, rapid, symmetric, or asymmetric.
During autopilot operation, the flightcrew may not be aware of the gradual onset of icing conditions or the effect that the accumulation of ice is
having on the handling qualities of the airplane.
b. Alerts. Means should be provided to alert the flightcrew when icing conditions begin to have an effect upon FGS performance, as
described in Chapter 4, paragraph 45.
c. Effect On Speed Protection. The implication of icing conditions on speed protection should be assessed. If the threshold of the stall
warning system is adjusted due to icing conditions, appropriate adjustments should also be made to the FGS low speed protection threshold,
which is discussed in paragraph 57b, Low Speed Protection, of this chapter.
56. Performance in non-normal conditions.
a. General. The FGS will occasionally be operating when the airplane transitions outside of its normal flight envelope, due to failures or
non-standard ferry configurations. Under such circumstances, the FGS characteristics and flightcrew interaction with the FGS should be shown
to be safe.
b. Conditions to Consider. The following table shows examples of non-normal conditions. The table does not fully define every condition
that may be encountered during an airplane's life and unequivocally categorize what can be considered to be a “non-normal condition.” Rather,
the table is intended to give examples to be used during system development and testing. By the very nature of the phenomena involved, there
will always be some subjectivity to these categorizations. Also, the same conditions may affect different airplane models in very different ways.
These differences should be considered in determining how to characterize the severity of the conditions discussed in the following table.
Table 5-3
Examples of Non-Normal Conditions
Significant fuel imbalance Large variation of the amount of fuel between the two wing tanks (and center and tail tanks, if
so equipped) that causes the FGS, if engaged, to counter the aerodynamic effect of the fuel
imbalance with a pitch, roll, or yaw command that is approaching maximum system authority.
Non-standard ferry flight Possible aerodynamic drag (both symmetrical and unsymmetrical) caused by non-standard
configurations airplane ferry flight conditions such as locked high lift devices, landing gear locked in the
deployed position, or an extra engine carried underneath one wing in an inoperative position.
Inoperative engine(s) Loss of one or more engines that causes the FGS, if engaged, to counter the aerodynamic
effect of the difference in thrust with a pitch, roll, or yaw command that is approaching
maximum system authority.
Loss of one or more Loss of one or more hydraulic systems down to the minimum amount of remaining operational
hydraulic systems systems which the FGS is certified to operate.
Inoperative Ice Detection/ Loss of ice detection/protection system on an airplane so equipped where the FGS is certified
Protection System for operation in icing conditions with that failure present.
(1) Performance Standard. For non-normal conditions, the FGS should be designed to provide guidance or control, as appropriate, for the
intended function of the active mode(s) in a safe and predictable manner, both within the normal flight envelope and for momentary excursions
outside the normal flight envelope. If a determination is made that there are non-normal conditions in which the FGS cannot be safely operated,
appropriate operational limitations should be placed in the AFM.
(2) Autopilot Authority Limit. Operations in non-normal conditions may result in automatic or pilot-initiated autopilot disengagement
close to the limit of autopilot authority. Autopilot disengagement in non-normal conditions should meet the safety criteria for autopilot
disengagement found in Chapter 3, FGS Engagement, Disengagement, Indications, and Override, paragraph 27b, Autopilot Disengagement, and
the criteria for flight guidance alerting in Chapter 4, Controls, Indications, and Alerts, paragraph 45d, Awareness of Potential Significant
Transient Condition (“Bark Before Bite”).
(3) Masking of Potential Hazard. It is not necessary that the FGS always be disengaged when non-normal conditions that may degrade its
performance or capability are encountered. The FGS may significantly help the flightcrew during such conditions. However, the design should
address the potential for the FGS to mask a condition from the flightcrew or otherwise delay appropriate flightcrew action. See Chapter 4,
paragraph 45, FGS Alerting, Warning, Caution, Advisory, and Status, for discussion of alerting under such conditions.
57. Speed protection.
a. General.

Page 18
(1) Speed Excursions. The requirement for speed protection is based on the premise that reliance on flightcrew attentiveness to airspeed
indications alone during FGS operation is not adequate to avoid unacceptable speed excursions outside the speed range of the normal flight
envelope. Many existing FGS systems have no provisions to avoid speed excursions outside the normal flight envelope. Some FGSs will remain
engaged until the aircraft slows to stall conditions and also to speeds well above maximum operating limit speed/maximum operating limit Mach
(VMO/MMO).
(2) Compliance with § 25.1329(h). Standard stall warning and high-speed alerts are not always timely enough for the flightcrew to
intervene to prevent unacceptable speed excursions during FGS operation. The intent of § 25.1329(h) is for the FGS to provide a speed
protection function for all operating modes, so that the airspeed can be safely maintained within an acceptable margin of the speed range of the
normal flight envelope. The FGS design may use any of the following ways or a combination of ways to provide acceptable speed protection:
(a) The FGS Provides Speed Protection. In this case, the following are acceptable means to comply with this rule:
1 The FGS may detect the speed protection condition, alert the flightcrew, and provide speed protection control or guidance.
2 The FGS may detect the speed protection condition, alert the flightcrew, and then disengage the FGS.
3 The FGS may detect the speed protection condition, alert the flightcrew, and remain engaged in the active mode without
providing speed protection control or guidance.
(b) Other Systems Provide Speed Protection. Other systems, such as the primary flight control system or the FMS (when in a vertical
navigation (VNAV) mode) may be used to provide equivalent speed protection.
NOTE:
If compliance with this requirement is based on use of alerting alone, the alerts should be shown to be appropriate and timely to ensure
flightcrew awareness and enable the pilot to keep the airplane within an acceptable margin from the speed range of the normal flight
envelope. See Chapter 4, Controls, Indications, and Alerts, paragraph 45b, Speed Protection Alerts, for additional discussion of speed
protection alerting.
(3) Design Standard.
(a) Interaction of FGS Elements. The design should consider how and when the speed protection is provided for combinations of
autopilot, FDs, and autothrust operation. Care should be taken to set appropriate values for transitioning into and out of speed protection such
that the flightcrew does not consider the transitions a nuisance.
(b) Integration of Pitch and Thrust Control. The speed protection function should integrate pitch and thrust control. Consideration
should be given to automatically activating the autothrust function when speed protection is invoked. If an autothrust function is either not
provided or is unavailable, speed protection should be provided through pitch control alone.
(c) Interaction of Systems. The role and interaction of autothrust with elements of the FMS, the primary flight control system, and the
propulsion system, as applicable, should be accounted for in the design for speed protection.
(d) Engine Inoperative. Consideration should be given to the effects of an engine inoperative condition on the performance of speed
protection.
b. Low Speed Protection.
(1) General. When the FGS is engaged in any modes (with the possible exception of Approach, as discussed in paragraph (3) below) for
which the available thrust is insufficient to maintain a safe operating speed, the low speed protection function should be invoked to avoid unsafe
speed excursions.
(2) Factors to Consider. Activation of speed protection should take into account such factors as the phase of flight, turbulence and gusty
wind conditions, and compatibility with the speed schedules. The low speed protection function should activate at a suitable margin to stall
warning that will not result in nuisance alerts. Consider the operational speeds, as specified in the AFM, for all-engine and engine-inoperative
cases during the following phases of flight:
(a) Takeoff.
(b) Departure, climb, cruise, descent, and terminal area operations. During these flight phases, airplanes are normally operated at or
above the minimum maneuvering speed for the given flap configuration.
NOTE:
For high altitude operations, it may be desirable to incorporate low speed protection at the appropriate engine out drift-down speed
schedule, if the FGS (or other integrated sensors/systems) can determine that the thrust deficiency is due to an engine failure.
(c) Approach.
(d) Transition from approach to go-around and go-around climb.
NOTE:
A low speed alert and a transition to the Speed Protection mode at approximately 1.13 VSR (reference stall speed) for the landing flap
configuration has been found to be acceptable.
(3) Low Speed Protection During Approach Operations.

Page 19
(a) Non-Interference. Speed protection should not interfere with the approach and landing phases of flight.
(b) Autothrust Operation. It is assumed that with autothrust operating normally, the combination of thrust control and pitch control
during the approach will be sufficient to maintain speed and desired vertical flight path. In cases where it is not sufficient, an alert should be
provided in time for the flightcrew to take appropriate corrective action.
(c) Defined Vertical Path. For approach operations with a defined vertical path (for example, ILS, microwave landing system (MLS),
GBAS landing system (GLS), Lateral Navigation (LNAV) mode, VNAV mode), if the thrust is insufficient to maintain both the desired flight
path and the desired approach speed, there are several ways to meet the intent of low speed protection:
1 The FGS may maintain the defined vertical path as the airplane decelerates below the desired approach speed until the airspeed
reaches the low speed protection value. At that time, the FGS would provide guidance to maintain the low speed protection value as the airplane
departs the defined vertical path. The FGS mode reversion and low speed alert should be activated to ensure pilot awareness.
NOTE:
The pilot is expected to take corrective action to add thrust and return the airplane to the defined vertical path or go-around, as necessary.
2 The FGS may maintain the defined vertical path as the airplane decelerates below the desired approach speed to the low speed
protection value. The FGS will then provide a low speed alert while remaining in the existing FGS approach mode.
NOTE:
The pilot is expected to take corrective action to add thrust to cause the airplane to accelerate back to the desired approach speed while
maintaining the defined vertical path or go-around, as necessary.
3 The FGS may maintain the defined vertical path as the airplane decelerates below the desired approach speed until the airspeed
reaches the low speed protection value. The FGS will then provide a low speed alert and disengage.
NOTE:
The pilot is expected to take corrective action when alerted to the low speed condition and the disengagement of the autopilot, to add
thrust, and to manually return the airplane to the desired vertical path or go-around.
(d) Vertical Flight Path Not Protected. If the speed protection is invoked during approach such that vertical flight path is not
protected, the subsequent behavior of the FGS after speed protection should be carefully considered. Activating low speed protection during the
approach, resuming the Approach mode, and re-acquiring the defined vertical path may be an acceptable response, if the activation is sufficiently
brief and not accompanied by large speed or path deviations. This response is considered consistent with criteria for Category III automatic
landing systems in AC 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout, appendix 3, section
8.1, Automatic Flight Control Systems, which states that it should not be possible to change the flight path of the airplane with the autopilot(s)
engaged, except by initiating an automatic go-around.
(4) Windshear Recovery Guidance. The interaction between low speed protection and windshear recovery guidance is a special case.
Windshear recovery guidance that meets the criteria found in AC 25-12 and AC 120-41 provides the necessary low speed protection when it is
activated and is considered acceptable for compliance with § 25.1329(h). The autopilot should be disengaged when the windshear recovery
guidance activates, unless autopilot operation has been shown to be safe in these conditions and provides effective automatic windshear recovery
that meets the criteria found in the ACs referenced above.
c. High Speed Protection.
(1) General. Section 25.1329(h) states that means must be provided to avoid excursions beyond an acceptable margin from the speed
range of the normal flight envelope. VMO and MMO mark the upper speed/Mach limit of the normal flight envelope. This is not intended to
require or preclude high speed protection based on airplane configurations (for example, flaps extended).
(2) Factors to Consider.
(a) Duration of Airspeed Excursions, Rate of Airspeed Change, Turbulence, and Gust Characteristics:
1 Operations at or near VMO/MMO in routine atmospheric conditions (for example, light turbulence) are safe. Small, brief
excursions above VMO/MMO by themselves are not unsafe.
2 The FGS design should strive to strike a balance between providing adequate speed protection margin and avoiding nuisance
activation of high-speed protection.
NOTE:
The following factors apply only to designs that provide high-speed protection through FGS control of airspeed.
(b) High Speed Protection While in Altitude Hold Mode:
1 Climbing to control airspeed is not desirable, because departing an assigned altitude can be disruptive to air traffic control
(ATC) and potentially hazardous (for example, in RVSM airspace). As long as the speed does not exceed a certain margin beyond VMO/MMO
(for example, six knots), it is better that the FGS remain in Altitude Hold mode.
2 The autothrust function, if operating normally, should effect high-speed protection by limiting its speed reference to the normal
speed envelope (that is, at or below VMO/MMO).

Page 20
3 The basic airplane high-speed alert should be sufficient for the pilot to recognize the overspeed condition and take corrective
action to reduce thrust. However, if the airspeed exceeds a margin beyond VMO/MMO (for example, six knots), the FGS may transition from
Altitude Hold to the Overspeed Protection mode and depart (that is, climb above) the selected altitude.
(c) High Speed Protection During Climbs and Descents.
1 When the elevator channel of the FGS is not controlling airspeed, the autothrust function, if engaged, should reduce thrust, as
needed to prevent sustained airspeed excursions beyond VMO/MMO (for example, six knots) down to the minimum appropriate value.
2 When thrust is already the minimum appropriate value or the autothrust function is not operating, the FGS should begin using
pitch control, as needed, for high-speed protection.
3 If conditions are encountered that result in airspeed excursions above VMO/MMO, it is preferable for the FGS to smoothly and
positively guide or control the airplane back to within the speed range of the normal flight envelope.
58 - 61 [Reserved]
Chapter 6. Characteristics of Specific Modes
62. General. There are certain operational modes of the FGS that have been implemented in different ways in different airplanes and systems.
The following paragraphs provide guidance and interpretative material that clarifies the operational intent of these modes, and criteria shown to
be acceptable in current operations. The guidance in this chapter does not preclude other mode implementations. Pilot understanding of the mode
behavior is especially important to avoid confusion. Therefore, mode behavior should be clearly annunciated, as described in Chapter 4,
Controls, Indications, and Alerts, paragraph 44, FGS Mode Selection, Annunciation, and Indication.
63. Lateral modes. This paragraph discusses modes that are implemented in many FGSs that are used primarily for lateral/directional control of
the airplane. The criteria below identify acceptable mode operation, based on past operational experience gained from the use of these modes.
a. Heading or Track Hold. In the Heading or Track Hold mode, the FGS should maintain the airplane heading or track. When the airplane is
in a bank when the Heading or Track Hold mode is engaged, the FGS should roll the airplane to a wings-level condition and maintain the
heading or track when wings-level is achieved (typically less than five degrees of bank angle).
b. Heading or Track Select. In the Heading or Track Select mode, the FGS should expeditiously acquire and maintain a “selected” heading or
track value consistent with occupant comfort. When the mode is initially engaged, the FGS should turn the airplane in a direction that is the
shortest heading (or track) change to acquire the new heading (or track). Once the Heading/Track Select mode is active, changes in the selected
value should result in changes in heading/track. The FGS must turn the airplane in the same direction as the sense of the selected heading change.
[See § 25.779(a)(1)] That is, if the pilot turns the heading select knob clockwise, the airplane must turn to the right, even if the shortest heading
(or track) change is in the opposite direction. The target heading or track value should be presented to the flightcrew.
c. Lateral Navigation (LNAV) Mode.
(1) Lateral Flight Path. In the LNAV mode, the FGS should acquire and maintain the lateral flight path commanded by a flight
management function (that is, FMS or equivalent).
(2) Automatic Mode Transitions. If the airplane is not on the desired lateral path or within the designed path capture criteria when LNAV
is selected, the FGS LNAV mode should enter an armed state. The FGS should transition from the armed state to an engaged state at a point
where the lateral flight path can be smoothly acquired and tracked.
(3) Takeoff or Go-Around (TOGA). For an FGS incorporating the LNAV mode during the TOGA phase, the design should specify
maneuvering capability immediately after takeoff and any limits that may exist. After TOGA, maneuvering should be based upon aircraft
performance with the objective to prevent excessive roll attitudes where wingtip impact with the runway becomes probable, yet satisfy
operational requirements where terrain and/or thrust limitations exist.
64. Vertical modes. This paragraph discusses modes that are implemented in many FGSs that are used primarily for pitch control of the airplane.
The criteria identified reflect operational experience gained from the use of these modes.
a. Target Altitude Selection. To avoid unconstrained climbs or descents for any altitude transitions when using applicable vertical modes, the
altitude select controller should be set to a new target altitude before the vertical mode can be selected. If the design allows the vertical mode to
be selected before setting the target altitude, then consideration should be given to the potential vulnerability of unconstrained climb or descent
leading to an altitude violation or controlled flight into terrain. Consideration should also be given to appropriate annunciation of the deviation
from previously selected altitude and/or subsequent required pilot action to reset the selected altitude.
b. Vertical Speed. In the Vertical Speed mode, the FGS should smoothly acquire and maintain a selected vertical speed. Consideration should
be given to the situation where the selected value is outside the performance capability of the airplane. Another situation to consider is use of
Vertical Speed mode without autothrust. These situations could potentially lead to a low-speed or high-speed condition and corresponding pilot
awareness vulnerabilities. See Chapter 5, paragraph 57, Speed Protection, for discussion of acceptable means of compliance for these situations.
c. Flight Path Angle. In the Flight Path Angle mode, the FGS should smoothly acquire and maintain the selected flight path angle.
Consideration should be given to the situation where the selected value is outside the performance capability of the airplane. The use of Flight
Path Angle mode without autothrust-potentially leading to a low-speed or high-speed condition and corresponding pilot awareness
vulnerabilities-should also be considered. Acceptable means of compliance have included a reversion to an envelope protection mode or a timely
annunciation of the situation.
d. Indicated Airspeed (IAS)/Mach Hold [speed on elevator]. In the Airspeed/Mach Hold mode, the FGS should maintain the airspeed or

Page 21
Mach at the time of engagement.
e. Indicated Airspeed (IAS)/Mach Select [speed on elevator]. In the Airspeed/Mach Select mode, the FGS should acquire and maintain a
selected airspeed or Mach. The selected airspeed or Mach may be either pre-selected or synchronized to the airspeed or Mach at the time of
engagement.
f. Flight Level (FL) Change [speed on elevator]. In the FL Change mode, the FGS should change altitude in a coordinated way with thrust
control on the airplane. The autopilot/FD will typically maintain speed control through the elevator. The autothrust function, if engaged, should
control the thrust to the appropriate value for climb or descent.
g. Altitude Capture.
(1) Mode Transition. The Altitude Capture mode should command the FGS to transition from a vertical mode to smoothly capture and
maintain the selected target altitude with consideration of the rates of climb and descent experienced in service.
(2) Guidelines for Altitude Capture Mode. In-service experience has shown that certain implementations have the potential to cause pilot
confusion that may lead to altitude violations. Accordingly, the following are guidelines for the Altitude Capture mode.
(a) Automatic Arming of Mode. The Altitude Capture mode should be automatically armed to ensure capture of the selected altitude.
Annunciation of the armed status is not required if the Altitude Capture mode is armed at all times. If the FGS is in the Altitude Capture mode, it
should be annunciated.
(b) Engagement From Any Vertical Mode. The Altitude Capture mode should engage from any vertical mode if the computed flight
path will intercept the selected altitude and the altitude capture criteria are satisfied, except as specified during an approach (for example, when
the glidepath for Approach mode is active).
(c) Changing Climb/Descent Command References. Changes in the climb/descent command references (for example, the vertical
speed command reference), with the exception of those made by the flightcrew using the altitude select controller, should not prevent capture of
the target altitude.
(d) Capturing Selected Altitude. The Altitude Capture mode should smoothly capture the selected altitude, using an acceptable
acceleration limit and pitch attitude with consideration for occupant comfort.
(e) Minimizing Acceleration Overshoot. The acceleration limit may, under certain conditions, result in an overshoot. To minimize the
altitude overshoot, the normal acceleration limit may be increased, consistent with occupant safety.
(f) Selecting Other Vertical Modes. Pilot selection of other vertical modes at the time of altitude capture should not prevent or
adversely affect the level off at the target altitude. One means of compliance is to inhibit transition to other pilot-selectable vertical modes
(except Altitude Hold, Go-Around, and Approach modes) during altitude capture, unless the target altitude is changed. If glidepath capture
criteria are satisfied during altitude capture, then the FGS should transition to glidepath capture.
(g) Changing Target Altitude. The FGS must be designed to minimize flightcrew confusion concerning the FGS operation when the
target altitude is changed during altitude capture. [See § 25.1329(i)] It should be suitably annunciated and appropriate for the phase of flight.
(h) Barometric Pressure Adjustment. Adjusting the datum pressure at any time during altitude capture should not result in loss of the
capture mode. The transition to the pressure altitude should be accomplished smoothly.
(i) Maintaining Reference Airspeed. If the autothrust function is active during altitude capture, the autopilot and autothrust functions
should be designed such that the FGS maintains the reference airspeed during the level-off maneuver. For example, if the autopilot changes from
a speed mode to an altitude capture or control mode, then the autothrust should transition to a speed mode to maintain the reference airspeed.
h. Altitude Hold.
(1) Entering Mode. The Altitude Hold mode may be entered either by flightcrew selection or by transition from another vertical mode.
(a) Pilot Selection.
1 Level flight. When initiated by pilot action in level flight, the Altitude Hold mode should provide guidance or control to
maintain altitude at the time the mode is selected.
2 Climbing or descending. When initiated by pilot action when the airplane is either climbing or descending, the FGS should
immediately initiate a pitch change to arrest the climb or descent and maintain the altitude when level flight (for example, less than 200 feet per
minute) is reached. The intensity of the leveling maneuver should be consistent with occupant comfort and safety.
(b) Automatic Transition. When initiated by an automatic transition from Altitude Capture, the Altitude Hold mode should provide
guidance or control to the selected altitude.
(2) Mode Transition Annunciation. Automatic transition into the Altitude Hold mode from another vertical mode should be clearly
annunciated for flightcrew awareness.
(3) Barometric Pressure Adjustment. Any airplane response due to an adjustment of the datum pressure should be smooth.
i. VNAV.
(1) FMS Path.
(a) Acquire Vertical Path. In the VNAV mode, the FGS should acquire and maintain the vertical flight path commanded by a flight
management function (that is, FMS or equivalent). If the airplane is not on the desired FMS path when the VNAV mode is selected, the FGS
VNAV mode should go into an armed state or provide guidance to smoothly acquire the FMS path. The flightcrew should establish the airplane
Page 22
on a flight profile to intercept the desired FMS path. The FGS should transition from the armed state to an engaged state at a point where the
FGS can smoothly acquire and track the FMS path.
(b) Deviation from Vertical Path. If the aircraft is flying a vertical path (for example, VNAV path), then the deviation from that path
should be displayed in the primary field of view, such as the PFD, navigation display (ND), or other acceptable display.
(2) Climb or Descent.
(a) Autothrust Function. When VNAV is selected for climb or descent, the autothrust function (if installed and engaged) should
maintain the appropriate thrust setting. When leveling after a VNAV climb or descent, the autothrust function should maintain the target speed.
(b) Preclude VNAV Climb. The FGS should preclude a VNAV climb, unless the mode select panel (MSP) altitude window is set to
an altitude above the current altitude.
(c) Preclude VNAV Descent. The FGS should preclude a VNAV descent, unless the MSP altitude window is set to an altitude below
the current altitude, except when on a final approach to a runway.
(d) Preclude MSP Altitude Fly-Through. The FGS should not allow the VNAV climb or descent to pass through a MSP altitude,
except when on a final approach to a runway.
NOTE:
See paragraph 67, Special Considerations for VNAV Approach Operations Related to Selecting a Target Altitude.
65. Multi-aces modes. This paragraph discusses modes that are implemented in many FGSs that are used in an integrated manner for pitch,
lateral/directional control, and thrust management of the airplane. The criteria identified reflect operational experience gained from the use of
these modes.
a. Takeoff Mode.
(1) Vertical Guidance. In the Takeoff mode, the vertical element of the FGS should provide vertical guidance to acquire and maintain a
safe climb out speed after initial rotation for takeoff.
(2) Lateral Guidance. In the Takeoff mode, the lateral element of the FGS, if implemented, should maintain runway heading/track or
wings level after liftoff. A separate lateral mode annunciation should be provided.
(3) Rotation Guidance. If rotation guidance is provided, the use of the guidance should not result in a tail strike. It should be consistent
with takeoff methods necessary to meet takeoff performance requirements up to 35 feet above ground level (AGL). If no rotation guidance is
provided, the pitch command bars may be displayed during takeoff roll but should not be considered as providing rotation guidance, unless it is
part of the intended function.
(4) Autothrust. The autothrust function should increase and maintain engine thrust to the selected thrust limits (for example, full takeoff
thrust, de-rate).
(5) Operation and Performance. The FGS design should address all engine and engine-inoperative conditions consistent with the
following takeoff system performance characteristics after liftoff.
(a) Transitions Between Flight Phases. Takeoff system operation should be continuous and smooth through transition from the
runway portion of the takeoff to the airborne portion and reconfiguration for en route climb. The pilot should be able to continue the use of the
same primary display(s) for the airborne portion as for the runway portion. Changes in guidance modes and display formats should be automatic.
(b) Pitch Attitude and Climb Speed/Normal Operation. The vertical axis guidance of the takeoff system during normal operation
should result in the appropriate pitch attitude and climb speed for the airplane considering the following factors:
1 Normal rate rotation of the airplane to the commanded pitch attitude at VR (takeoff rotation speed) - 10 knots for all engines
operative and VR - 5 knots for engine out should not result in a tail-strike.
2 The system should provide commands that lead the airplane to smoothly acquire a pitch attitude that results in capture and
tracking of the all-engine takeoff climb speed, V2 (takeoff safety speed) + X. X is the all-engine speed additive from the AFM (normally 10 knots
or higher). If pitch limited conditions are encountered, a higher climb airspeed may be used to achieve the required takeoff path without
exceeding the pitch limit.
(c) Engine-Out Operation. For engine-out operation, the system should provide commands that lead the airplane to smoothly acquire a
pitch attitude that results in capture and tracking of the following reference speeds:
1 V2, for engine failure at or below V2. This speed should be attained by the time the airplane has reached 35 feet altitude.
2 Airspeed at engine failure for failures between V2 and V2 + X.
3 V2 + X, for failures at or above V2 + X. Alternatively, the airspeed at engine failure may be used, provided it has been shown
that the minimum takeoff climb gradient can still be achieved at that speed.
(d) Lateral Commands During Takeoff Mode. If implemented, the lateral element of the Takeoff mode should maintain runway
heading/track or wings level after liftoff and a separate lateral mode annunciation should be provided.
b. Go-Around Mode. Characteristics of the Go-Around mode and resulting flight path should be consistent with a manually flown go-around.
(1) Vertical Elements. The vertical element of the FGS Go-Around mode should initially rotate the airplane or provide guidance to rotate

Page 23
the airplane to arrest the rate of descent.
(2) Speed. The FGS should acquire and maintain a safe speed during climbout and airplane configuration changes. Typically, a safe speed
for go-around climb is V2, but a different speed may be found safe for windshear recoveries (See AC 25-12).
(3) Autothrust.
(a) Thrust During Climb. The autothrust function, if installed, should increase thrust and either maintain thrust to specific thrust limits
or maintain thrust for an adequate, safe climb. The autothrust function should not exceed thrust limits (for example, full go-around thrust or
de-rated go-around thrust limits). Furthermore, the autothrust function should not reduce thrust for wind below the minimum value required for
an adequate, safe climb or reduce the thrust lever position below a point that would cause a warning system to activate.
(b) Pitch Attitude During Go-Around. The initial go-around maneuver may require a significant change in pitch attitude. It is
acceptable to reduce thrust to lower the pitch attitude for comfort of the occupants when a safe climb gradient has been established. It should be
possible for the pilot to re-select the full thrust value, if needed.
(4) Engagement. The Go-Around mode should engage when go-around is selected by the pilot, even if the MSP selected altitude is at or
below the go-around initiation point. The airplane should climb until another vertical mode is selected or the MSP altitude is adjusted to an
altitude above the present aircraft altitude.
(5) All Engine and Engine Out Capability. The FGS design of the Go-Around mode should address all engine and engine-out operation.
The design should consider an engine failure resulting in a go-around and the engine failure occurring during an all engine go-around.
c. Approach Mode.
(1) Final Approach Path. In the Approach mode, the FGS should capture and track a final approach lateral and vertical path, if applicable,
from a navigation (NAV) or landing system, for example, ILS, MLS, GLS, RNP, area navigation (RNAV) (see AC 120-28D and AC 120-29A).
(2) Mode Annunciations. The FGS should annunciate all operationally relevant approach modes. Modes that are armed and waiting for
capture criteria to be satisfied should be indicated in addition to the active pre-capture mode. A positive indication of the capture of the
previously armed mode should be provided.
(3) Sub-Modes. The FGS may have sub-modes that become active without additional crew selection. An assessment of the significance of
these sub-mode transitions to the flightcrew should be made. If assessed to be significant (for example, flare), positive annunciation of the
transition should be provided.
(4) Mode Engagement Sequence. Glideslope capture mode engagement may occur prior to localizer capture. However, it is the
flightcrew's responsibility to ensure proper safe obstacle/terrain clearance when following vertical guidance when the airplane is not established
on the final lateral path.
NOTE:
Additional guidance and criteria are contained in AC 120-29A and AC 120-28D.
66. Autothrust modes. This paragraph discusses modes that are implemented in many FGSs that are used primarily for controlling the engines
on the airplane. The criteria identified reflect operational experience gained from the use of these modes.
a. Thrust Mode. In the Thrust mode, the FGS should command the autothrust function to achieve a selected target thrust value.
b. Speed Mode. In the Speed mode, the FGS should command the autothrust function to acquire and maintain the selected target speed value,
assuming that the selected speed is within the speed range of the normal flight envelope. The autothrust system may fly a higher airspeed than the
selected target speed during an approach when operating in winds or turbulent conditions.
c. Retard Mode. If a Retard mode is implemented in the FGS, it should work in the same manner for both automatic and manual landings
when the autothrust function is engaged.
67. Special considerations for VNAV Approach operations related to selecting a target altitude.
a. Approach Operations. The FGS vertical modes should allow the pilot to set the target altitude to a missed approach value prior to capturing
the final approach segment. This should be possible for capturing from both above and below the final approach segment.
b. VNAV Path Operations. It should be possible to define a descent path to the final approach fix and another path from the final approach
fix to the runway with the target altitude set for the missed approach altitude. Appropriate targets and descent points should be identified by the
FMS.
68. Control wheel steering (CWS) [control steering through the autopilot].
a. General. In the CWS mode, the FGS allows the flightcrew to maneuver the airplane manually through the autopilot control path. CWS is
considered an FGS mode, as it is a specific function of the FGS. However, during CWS operation, the pilot is in control of the aircraft, rather
than the FGS. Operationally, CWS is identical to the pilot flying the airplane during manual flight. In both cases, the pilot is in control of the
flight path and speed of the airplane. The only difference is the mechanization of how the actual flight control surfaces are moved. No automatic
FGS commands are involved during CWS operation, with the possible exception of automatic aircraft trim function(s). Therefore, paragraphs in
this AC, such as those which discuss speed protection and performance objectives, should be applied only to those autopilot modes with which
the FGS is in control of the flight path of the airplane. Such paragraphs in this AC should not be applied to CWS, unless such features are
specifically provided while the FGS is in the CWS mode.
b. Design. If provided, a CWS mode should meet the following:

Page 24
(1) Control Forces. It should be possible for the pilot to maneuver the airplane using the normal flight controls with the CWS mode
engaged and to achieve the maximum available control surface deflection without using forces so high that the controllability requirements of §
25.143(d) are not met. Excessive discontinuities in control force that might adversely affect the flight path should not be encountered.
(2) Bank and Pitch Attitudes. The maximum bank and pitch attitudes that can be achieved during CWS operations should be limited to
those necessary for the normal operation of the airplane.
NOTE 1:
Normal operational limits are typically 35 degrees in roll and +20 degrees to -10 degrees in pitch.
NOTE 2:
Limits that can be physically overcome with forceful control commands by the pilot are sometimes referred to as “soft limits.”
(3) Control Behavior. It should be possible to perform all normal maneuvers smoothly and accurately without nuisance oscillation. It
should also be possible to counter all normal changes of trim due to change of configuration or power, within the range of flight conditions in
which CWS may be used.
(4) Stall and Stall Recovery. The stall and stall recovery characteristics of the airplane should remain acceptable. It should be assumed
that recovery from such a stall is made with CWS in use, unless automatic disengagement of the autopilot is provided.
(5) Adjustments to Trim. In showing compliance with § 25.143(f), consideration should be given to adjustments to trim that may be made
by the autopilot in the course of maneuvers that can reasonably be expected. Some alleviation may be acceptable in the case of unusually
prolonged maneuvers, provided that the reduced control forces would not be potentially hazardous.
(6) Takeoff and Landing. If the use of CWS for takeoff and landing is to be permitted, it should be shown that:
(a) Sufficient control, both in amplitude and rate, is available without encountering force discontinuities.
(b) Reasonable mishandling is not hazardous (for example, engaging the autopilot while the elevators or ailerons are held in an
out-of-trim position).
(c) Runaway rates and control forces are such that the pilot can readily overpower the autopilot with no significant deviation in flight
path.
(d) Any lag in aircraft response induced by the CWS mode is acceptable for the intended maneuver.
(7) Automatic Reversion to CWS Mode. The autopilot, when engaged, should not automatically revert to the CWS mode by applying an
input to the control column or wheel, unless the autopilot is in a capture mode (for example, Altitude Capture or Localizer Capture). When the
force is released, the autopilot should return to the previously engaged capture mode or to the Track/Heading Hold mode.
c. Terminology and Application of Advisory Material. The term “CWS” is currently used by industry to refer to several different types of
systems. Several other types of systems that are similar in nature to CWS, but functionally different from it, are described below. Paragraph 68b,
Design, applies to systems as described in paragraph 68a, General. It does not apply to those systems described in paragraphs 68c(1) and 68c(2),
below. These descriptions are intended to be generic. Implementation may vary from airplane to airplane.
(1) Touch Control Steering (TCS). A TCS system is available on many business and commuter aircraft. With a TCS system, a pilot is
able to physically disengage the autopilot servos from the flight control system, usually by pushing and holding a button on the control wheel,
without causing the autopilot system itself to disengage or lose its currently selected modes. The pilot may then maneuver the airplane as desired
using the aircraft's flight control system (that is, the autopilot servos are not part of the control loop). The pilot is then able to reconnect the
autopilot servos to the flight control system by releasing the TCS button. Using the new orientation of the aircraft as a basis, the autopilot will
then reassume control of the airplane using the same mode selections as were present before the selection of TCS. This type of system on some
aircraft is also sometimes referred to as CWS.
(2) Supervisory Override. A function available on some aircraft is referred to as a “supervisory override” of an engaged autopilot. With
this function, a pilot is able to physically overpower an engaged autopilot servo by applying force to the flight deck controls. With a supervisory
override, the autopilot does not automatically disengage due to the pilot input. This allows the pilot to position the airplane as desired using the
flight deck controls without first disengaging the autopilot. When the pilot releases the controls, the autopilot reassumes control of the airplane
using the same mode selections as were present before the supervisory override.
69. Special considerations for the integration of fly-by-wire flight control systems and FGS.
a. Speed Protection. Speed protection features may be implemented in the fly-by-wire flight control system. However, if speed protection is
also implemented within the FGS, it should be compatible with the envelope protection features of the fly-by-wire flight control system. The
FGS speed protection (normal flight envelope) should operate to or within the limits of the flight control system (limit flight envelope).
b. System Degradation. Information should be provided to the flightcrew about the impact on the FGS following degradation of the
fly-by-wire flight control systems.
70 - 74 [Reserved]
Chapter 7. FGS Integration
75. General. Throughout the preceding chapters of the document, FGSs and functions have been considered as being separate and distinct from
other systems and functions on the aircraft. It is recognized that in complex aircraft designs, the flight guidance functions are closely integrated

Page 25
with other avionics functions and that the physical integration of these systems may have a bearing on how airplane level safety is assessed. The
following paragraphs provide guidance on the likely FGS system integration issues found in more complex aircraft system designs and the
interfaces that should be considered within the bounds of demonstrating the intended function, performance, and safety of the FGS.
76. System integration issues.
a. Common and Cascading Failure Modes. Integration of other aircraft systems with the FGS has the potential of reducing the independence
of failure effects and partitioning between functions. This is particularly the case where hardware and software resources are shared by different
systems and functions (for example, aircraft data network and integrated modular avionics (IMA) architectures). In addition to considering the
reliability and integrity aspects of the FGS as a separate system, it may be necessary to address the effects of FGS failures with respect to fault
propagation, detection, and isolation within other systems. The overall effect on the aircraft of a combination of individual system failure
conditions occurring as a result of a common or cascade failure, may be more severe than the individual system effect. For example, failure
conditions classified under § 25.1309 as ”minor” or ”major” by themselves may have hazardous effects at the aircraft level when considered in
combination. With regard to isolation of failures and particularly combination of failures, the ability of the alerting system to provide clear and
unambiguous information to the flightcrew becomes of significant importance. (See also Chapter 8, Safety Assessment.)
b. Risk of Error. Complex and highly integrated avionics systems present greater risk for development error. With non-traditional
human-machine interfaces, there is also the potential for operational flightcrew errors. Moreover, integration of systems may result in a greater
likelihood of undesirable and unintended effects.
c. System Safety Analysis. When credit is taken for shared resources or partitioning schemes, these should be justified and documented
within the system safety analysis. When considering the functional failures of the system, where such partitioning schemes cannot be shown to
provide the necessary isolation, possible combination failure modes should be taken into account. An example of this type of failure would be
multi-axis active failures, where the control algorithms for more than one axis are hosted on a single processing element. Further, the functional
integration of control functions such as control surface trimming, yaw channel, and stability augmentation, while not strictly FGS, should be
considered.
77. Functional interfaces.
a. Interfacing Sensors. In its simplest form, the FGS may be considered as interfacing with sensors that provide the necessary inputs to enable
computation of its various functions. Typically, these sensors will include air and inertial data, engine control, and NAV sensors such as ILS,
very high frequency omni range (VOR), and distance measuring equipment (DME). In the case of engine control, a feedback loop may also be
provided. The FGS may also be considered as providing inner loop closure to outer loop commands. The most common interface is with the
FMS, which provides targets for LNAV and VNAV in the form of steering orders.
b. Potential Inconsistencies Between Systems. In demonstrating the intended function and performance of both the FGS and systems
providing outer loop commands, the applicant needs to address potential inconsistencies between limits provided by the two different systems.
One example of this is possible conflicts between FMS steering commands with basic FGS pitch and bank angle limits. Failure to address these
points can result in discontinuities, mode switching, and reversions, leading to erroneous NAV and other possible safety issues (for example,
buffet margin at high altitude). Similar issues arise in the inner loop, across the functional interface between FGS and flight controls. In
fly-by-wire aircraft, the loss of synchronization between the two can result in mode anomalies and autopilot disengagement.
c. Function and Performance. The applicant should demonstrate the intended function and performance of the FGS across all possible
functional interfaces. The alerting system should also be assessed to ensure that accurate and adequate information is provided to the flightcrew
when dealing with failures across functional interfaces.
78 - 82 [Reserved]
Chapter 8. Safety Assessment
83. General.
a. Basic Safety Requirements. Section 25.1309 defines the basic safety requirements for airworthiness approval of airplane systems and AC
25.1309-1A, System Design and Analysis, provides an acceptable means of demonstrating compliance with this rule. This chapter provides
additional guidance and interpretive material for the application of § 25.1309 to the approval of FGS.
b. Safety Assessment. A safety assessment should be performed to identify the failure conditions, classify their hazard level according to the
guidance of AC 25.1309-1A, and establish that the failure conditions occur with a probability corresponding to the hazard classification or are
mitigated as intended. The safety assessment should include the rationale and coverage of the FGS protection and monitoring philosophies
employed. The safety assessment should include an appropriate evaluation of each of the identified FGS failure conditions and an analysis of the
exposure to common mode/cause or cascade failure in accordance with AC 25.1309-1A. Additionally, the safety assessment should include
justification and description of any functional partitioning schemes employed to reduce the effect/likelihood of failures of integrated components
or functions.
c. Validation of Safety Assessment. There may be situations where the severity of the effect of a failure condition identified in the safety
analysis needs to be validated. Laboratory, simulator, or flight test may accomplish the validation of the assessment. The test facility for each
validation test should be chosen based on specific criteria, such as the difficulty of setting up the test conditions, potential hazard to an airplane
and the test crew, and the validity of that validation test in that specific facility.
d. Coordination with the FAA. It is recommended that the safety analysis plan and the functional hazard assessment be coordinated with the
FAA early in the certification program.
84. FGS Failure conditions. One of the initial steps in establishing compliance with § 25.1309 for a system is to identify the failure conditions
that are associated with that system. The failure conditions are typically characterized by an undesired change in the intended function of the

Page 26
system. The failure condition should identify the functionality affected and the effect on the airplane and/or its occupants, specify any
considerations relating to phase of flight, and identify any flightcrew action or other means of mitigation that are relevant.
a. Functionality. The primary functions of a FGS may include the following:
(1) Automatic control of the airplane's flight path utilizing the airplane's aerodynamic control surfaces.
(2) Guidance provided to the flightcrew to achieve a particular desired flight path or maneuver via information presented on a HUD or
HDD system.
(3) Control of the thrust applied to the airplane.
b. Effect of Failure Condition. Dependent upon the functionality provided in a specific FGS, the failure conditions could potentially impact
the following:
(1) Control of the airplane in the pitch, roll, and directional axes.
(2) Control of thrust.
(3) Integrity and availability of guidance and system annunciations/alerts provided to the flightcrew.
(4) Structural integrity of the airplane.
(5) Ability of the flightcrew to cope with adverse operating conditions.
(6) Flightcrew performance and workload.
(7) Safety of the occupants of the airplane.
NOTE:
The safety assessment of a FGS for use in supporting takeoff, approach and landing operations in low visibility conditions is further
addressed in AC 120-29A, Criteria for Approval of Category I and Category II Weather Minima for Approach, and AC 120-28D, Criteria
for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout.
85. Type and severity of failure conditions.
a. Types of Failure Conditions. The type of the FGS failure conditions will depend, to a large extent, upon the architecture, design
philosophy, and implementation of the system. Types of failure conditions can include the following:
(1) Loss of Function. A control or display element no longer provides control, guidance, or system annunciation/alerting.
(2) Malfunction. A control or display element performs in an inappropriate manner, including the following sub-types:
(a) Hardover. The control or display goes to full displacement in a brief period of time. The resultant effect on the flight path and
occupants of the airplane and possible adverse structural effects are the primary concerns.
(b) Slowover. The control or display moves away from the correct control or display value over a relatively long period of time. The
potential delay in recognizing the situation and the effect on the flight path are the primary concerns.
(c) Oscillatory. The control or display is replaced or augmented by an oscillatory element. In addition to difficulty controlling the
aircraft flight path, there may be effects on structural integrity and occupant well being.
b. Cause. Failure conditions are a manifestation of malfunctions in:
(1) Primary FGS elements, such as autopilot, FD, or HUD.
(2) Interfacing sensors to the FGS, such as inertial or air data.
(3) Control and display elements, such as servos or PFDs.
(4) Interfacing systems, such as the FMS or primary flight controls.
(5) Basic aircraft services, such as electrical or hydraulic power.
c. Severity. The severity of the FGS failure conditions and their associated classifications will frequently depend on the phase of flight,
airplane configuration, and the type of operation being conducted. The effect of any control system variability (for example, tolerances and
rigging) on the failure conditions should be considered. The severity of the failure conditions can be mitigated by various design strategies (See
paragraph 86, Mitigation of Failure Conditions, below).
d. Assessment of Failure Conditions.
(1) Functional Failures. Appendix 1, Safety Assessment, of this AC, presents some considerations for use when assessing the type and
severity of condition that results from functional failures. The classifications of failure conditions that have been identified on previous airplane
certification programs are identified. The classifications of failure conditions should be agreed with the FAA during the § 25.1309 safety
assessment process.
(2) Airframe Loads. With the exception of the catastrophic failure condition, the classification of failure conditions leading to the
imposition of airframe loads should be assessed in accordance with 14 CFR Part 25, Subpart C, Structure, and § 25.1309, Equipment, systems,
and installations. The assessment needs to account for loads occurring during the active malfunction, recovery, or continuation of the flight with
the system in the failed state.
Page 27
(3) Assessing Total Effect of Failure. Complex integrated systems may require that the total effect resulting from single failure be
assessed. For example, some failures may result in a number of failure conditions that, if assessed individually, may be considered major effects
but when considered in combination may be hazardous. Special consideration concerning complex integration of systems can be found in
Chapter 7, paragraph 76, System Integration Issues.
86. Mitigation of failure conditions.
a. General. The propagation of potential failure conditions to their full effect may be nullified or mitigated by a number of methods. These
methods could include, but are not limited to, the following:
(1) Failure Detection and Monitoring.
(2) Fault Isolation and Reconfiguration.
(3) Redundancy.
(4) Authority Limiting.
(5) Flightcrew Action to Intervene.
b. Identification of Methods. Means to assure continued performance of any system design mitigation methods should be identified. The
mitigation methods should be described in the safety analysis/assessment document or be available by reference to another document (for
example, a system description document).
c. FGS De-Selection. The design of typical FGS allows for the de-selection of control and guidance elements. The long-term effects on
occupants and any structural implication of oscillatory failures can be mitigated by de-selection of the FGS.
87. Validation of failure conditions.
a. General. The method of validation of failure conditions will depend on the effect of the condition, any assumptions made, and any
associated risk. The severity of some failure conditions may be obvious, and other conditions may be somewhat subjective. If flightcrew action is
used to mitigate the propagation of the effect of a failure condition, the information available to the flightcrew to initiate appropriate action (for
example, motion, alerts, and displays) and the assumed flightcrew response should be identified. It is recommended that there be early
coordination with the FAA to identify any program necessary to validate any of these assumptions.
b. Validation Options. The validation options for failure conditions include the following:
(1) Analysis.
(2) Laboratory Testing.
(3) Simulation.
(4) Flight Test.
c. Validation Methodology. The validation testing and analysis should take account of architectural strategies (for example, redundant
channels, high integrity components, rate limit/magnitude limiting, etc.). It is anticipated that the majority of failure condition can be validated by
analysis to support the probability aspect of the § 25.1309 assessment. It may be necessary to substantiate the severity of a failure condition effect
by ground simulation or flight test. This is particularly true where pilot recognition of the failure condition requires justification, or if there is
some variability in the response of the airplane. Failure conditions that are projected to be less probable than 10-7 per flight hour, independent of
effect severity, need not be demonstrated with a flight test. Guidance on the assessment of traditional failure conditions is provided in Chapter 9,
Compliance Demonstration Using Flight Test and Simulation. New and novel functionality may require additional assessment methods to be
agreed to with the authority.
88. Specific considerations. The following paragraphs identify specific considerations that should be given to potential failure conditions for
various phases of flight.
a. FGS Action During Ground Operations. The potential hazard that may result due to inappropriate autopilot, autothrust, or other system
control action during maintenance operations should be assessed. This includes while the airplane is parked at the gate and during taxi
operations. System interlocks or crew or maintenance procedures and placards may mitigate these hazards.
b. FGS Operations in Close Proximity to the Ground. The response of the airplane to failures in the FGS could have implications for the
safety of operations when the airplane is close to the ground. For the purpose of this AC, close to the ground can be assumed to be less than 500
feet above the liftoff point or touchdown zone or a runway. A specific safety assessment should be performed if approval for operations where
the autopilot is engaged or remains engaged in close proximity to the ground.
NOTE:
ACs 120-29A and AC 120-28D identify additional considerations and criteria for operating the airplane in low visibility conditions.
(1) Takeoff. If approval is sought for engagement of the autopilot below 500 feet after liftoff, an assessment of the effect of any
significant FGS failure conditions on the net vertical flight path, the speed control, and the bank angle of the airplane should be conducted. An
autopilot minimum engage height - takeoff will be established based, in part, on the characteristics of the airplane in response to the failures and
the acceptability of flightcrew recognition of the condition. A pilot assessment of certain failure conditions may be required (See Chapter 9,
Compliance Demonstration Using Flight Test and Simulation). The minimum engage height - takeoff based upon this assessment should be
provided in the AFM.
(a) Vertical Axis Assessment.
Page 28
1 The operational objective during the initial climb is to maintain an appropriate climb profile to assure obstacle clearance and to
maintain an appropriate speed profile during climbout (See Chapter 6, Characteristics of Specific Modes).
2 The FGS failure conditions should be assessed for the potential for a significant reduction in the net takeoff flight path below
500 feet and a significant increase in pitch attitude that results in the airplane speed dropping to unacceptable values.
3 For failure conditions that are likely to occur more frequently than 1 x 10-7 per flight hour or would have hazardous or
catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and documented in
AFM limitations or procedures, if those failure conditions require operational limitations or flightcrew procedures.
(b) Lateral Axis Assessment.
1 The operational objective during the initial climb is to maintain an appropriate heading or track to provide separation from
potential adjacent runway operations.
2 The FGS failure conditions should be assessed for the potential for producing a bank angle that results in significant deviation
from the runway track or intended track.
catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and, as necessary,
documented in AFM limitations or procedures.
(2) Approach.
(a) Assessment of Failure Conditions. If the autopilot is to remain engaged below 500 feet above the touchdown zone during
approach, an assessment of the effect of any significant FGS failure conditions on the net vertical flight path, the speed control, and the bank
angle of the airplane should be conducted. The lowest point on the approach appropriate for the use of the autopilot will be established based on
the characteristics of the airplane in response to the failure conditions and the acceptability of flightcrew recognition of the condition. See
Chapter 9 for details regarding how these failure conditions on approach should be assessed.
(b) Approach Operations.
1 A number of approach operations may be conducted using automatic flight control. These can include, but are not limited to, the
following:
(aa) ILS, MLS, and GLS
(bb) RNAV (e.g., LNAV and VNAV)
(cc) NAV (for example, VOR, LOC, and Backcourse)
(dd) Open loop flight path management (for example, vertical speed, flight path angle, track or heading select).
2 Some operations may be conducted with a single autopilot channel engaged, and some operations may be conducted with
multiple autopilots engaged. The engagement of multiple autopilots may have the effect of mitigating the effect of certain failure conditions. The
effectiveness of these mitigation methods should be established.
3 The type of operation and the prevailing visibility conditions will determine the decision altitude/decision height (DA(H)) or
minimum descent altitude/height (MDA(H)) for a particular flight operation. The operation may continue using automatic flight control if the
visual requirements are met.
4 The lowest altitude at which the autopilot should remain engaged may vary with the type of operation being conducted. The
resultant flight path deviation from any significant failure condition would impact the autopilot minimum operational use height. The minimum
use height (MUH) for approach should be provided in the AFM.
(c) Vertical Axis Assessment.
1 The operational objective during the approach is to maintain an appropriate descent profile to assure obstacle clearance and to
maintain an appropriate speed profile.
2 FGS failure conditions should be assessed for the potential for a significant reduction in the approach flight path when below
500 feet above touchdown and for a significant increase in pitch attitude that results in the airplane speed dropping to unacceptable values.
catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and documented in
AFM limitations or procedures, if those failure conditions require operational limitations or flightcrew procedures.
(d) Lateral Axis Assessment.
1 The operational objective during the approach is to maintain an appropriate track to provide alignment with the runway
centerline or intended flight path to support the landing.
2 The FGS failure conditions should be assessed for the potential for producing a bank angle that results in significant deviation
from the runway track or intended track.
catastrophic effects without pilot intervention, the ability of pilots to adequately perform the intervention should be evaluated and, as necessary,

Page 29
documented in AFM limitations or procedures.
c. Cruise Operations. The primary concerns during cruise operations are adverse effects that the airplane response to failure conditions may
have on the structure of the airplane and to the occupants. At a minimum, the accelerations and attitude resulting from any failure condition
should be assessed. The mitigation of the effect of a failure condition by the flightcrew may not be as immediate as during takeoff and landing
operations. Chapter 9, Compliance Demonstration Using Flight Test and Simulation, provides guidance and considerations for this phase of
flight.
d. Asymmetric Thrust During Autothrust Operation. During autothrust operation, it is possible that a failure (for example, engine failure,
throttle lever jam, or thrust control cable jam) could result in a significant asymmetric thrust failure condition that may be aggravated by the
continued use of the autothrust system. Because the FGS could potentially compensate for the asymmetric condition with roll (and possibly yaw)
control, the pilot may not immediately be aware of the developing situation. Therefore, an alert should be considered as a means of mitigation to
draw the pilot's attention to an asymmetric thrust condition during FGS operation.
89. Failure to disengage the FGS. The requirement for quick disengagement for the autopilot and autothrust functions is intended to provide a
routine and intuitive means for the flightcrew to quickly disengage those functions. The implication of failures that preclude the quick
disengagement from functioning should be assessed consistent with the guidelines of AC 25.1309-1A. [See § 25.1329(b)] This assessment
should consider the effects of failure to disengage the autopilot and/or autothrust functions during the approach using the quick disengagement
controls. The feasibility of the use of the alternative means of disengagement defined in Chapter 3, paragraph 27b(4), Alternative Means of
Autopilot Disengagement, should be assessed. If the assessment indicates the aircraft can be landed manually with the autopilot and/or autothrust
engaged, this should be demonstrated in flight test.
90 - 97 [Reserved]
Chapter 9. Compliance Demonstration Using Flight Test and Simulation
98. General.
a. Methods of Compliance Demonstration. Validation of the performance and integrity of FGS operation will typically be accomplished by a
combination of analysis, laboratory test, simulation, and flight test. This chapter focuses on compliance demonstration by flight test or simulation
with flightcrew participation. The chapter includes the evaluation necessary to confirm acceptable performance of intended functions, including
the human-machine interface and the acceptability of failure scenarios. The specific requirements for flight or simulator evaluation will consider
the specifics of the applicant's design, the supporting engineering analysis, and the scope and depth of the applicant's laboratory testing. The type
and extent of the various validation methods may vary, depending upon the FGS functionality, certification considerations, the applicant's
facilities, and other practical and economic constraints.
b. Criteria for Establishing Compliance. The criteria to be used for establishing compliance with §§ 25.1301, 25.1309, and 25.1329 may be
found in Chapters 3 through 8 of this document.
c. Elements of Certification Flight Test. The certification flight test program should investigate representative phases of flight and aircraft
configurations used by the FGS. The program should evaluate all of the FGS modes through appropriate maneuvers and representative
environmental conditions, including turbulence. Combinations of FGS elements (for example, autopilot engaged and autothrust disengaged)
should be considered. Certain failure scenarios may require flight or simulator demonstration. The airplane should be equipped with sufficient
instrumentation to record the parameters appropriate to the test. Examples of parameters that could be recorded include normal acceleration,
airspeed, height, pitch, and roll angles, and autopilot engagement state. The flight test instrumentation should not affect the behavior of the FGS
or any other system.
d. Pilot-in-the-Loop Evaluation. An important part of the pilot-in-the-loop evaluation is validation of human factors. A thorough evaluation
of the human-machine interface is required to ensure safe, effective, and consistent FGS operation. Portions of this evaluation will be conducted
during flight test. Representative simulators can be used to accomplish the evaluation of human factors and workload studies. The level and
fidelity of the simulator used should be commensurate with the certification credit being sought, and its use should be agreed upon with the FAA.
e. Other Applicable Guidance Material for FGS Takeoff and/or Approach Modes.
(1) Criteria to Consider. The following criteria should be considered for applicability in developing the overall and integrated flight test
and simulation requirements:
(a) AC 120-29A, Criteria for Approval of Category I and II Weather Minima for Approach.
(b) AC 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout need to be included in the
requirements to be tested.
(2) Procedures to Show Compliance. Procedures that may be used to show compliance are provided in AC 25-7C, Flight Test Guide For
Certification of Transport Category Airplanes (See paragraph 181, Automatic Pilot System - § 25.1329).
f. Relationship of AC Chapters. Figure 9-1 depicts the relationship between this chapter and the other chapters contained within this AC.
Figure 9-1
Relationship Between AC Chapters

Page 30
99. Performance and demonstration (fault free): § 25.1301.
a. General.
(1) Certification Plan. The certification plan should identify the specific functionality provided by the FGS. The flight test and/or
simulator program will typically assess this functionality under representative operational conditions, including applicable airplane
configurations and a representative range of airplane weight, center of gravity (CG), and operational envelope.
(2) Evaluating Performance. The performance of the FGS in each of its guidance and control modes should be evaluated. The
acceptability of the performance of the FGS may be based on test pilot assessment, taking into account the experience acquired from similar
equipment capabilities and the general behavior of the airplane. The FGS should be evaluated for its low and high maneuvering capability. AC
25-7C, Flight Test Guide for Certification of Transport Category Airplanes, provides additional information on FGS test procedures.
(3) Evaluating Compatibility of Mode Controls, Indications, and Alerts. The acceptability of mode controls and annunciations, any
associated alerts, and general compatibility with cockpit displays should be evaluated. The FGS should be free from unexpected disengagement,
and no confusion should result from FGS mode changes. Additional considerations relating to the assessment of human factors is provided in
Chapter 9, paragraph 103, Assessment of Human Factors.
b. Normal Performance.
(1) Demonstration. Normal performance is considered to be performance during operations well within the airplane's flight envelope and
with routine atmospheric and environmental conditions. Normal performance should be demonstrated over a range of conditions that represent
typical conditions experienced in operational use.
(2) Evaluation. The FGS should be evaluated to determine the acceptability of the following characteristics:
(a) Stability and tracking of automatic control elements.
(b) Controllability and tracking of guidance elements.
(c) Acquisition of flight paths for capture modes.
(d) Consistency of integration of modes (of this chapter).
(3) Expected Errors. Performance should be assessed in the presence of errors that can reasonably be expected in operation (for example,
the incorrect selection of approach speed).
c. Performance in “Other Than Normal” Conditions. Other than normal conditions are the combination of “rare normal” and “non-normal”
conditions. Performance in “other than normal conditions” is considered to be performance of the system under conditions that are experienced
infrequently by the airplane during operational use. Examples of rare normal and non-normal conditions are given in Chapter 5, paragraphs 54,
Performance in Rare Normal Conditions, and 56, Performance in Non-Normal Conditions.
(1) Test Program. The test program should assess the FGS performance in more challenging environmental conditions (for example,
winds, wind gradients, and various levels of turbulence) as the opportunity presents itself. Rare environmental conditions may require the FGS to
operate at the limits of its capabilities. The intent of the evaluation is to assess the performance of the FGS under more demanding conditions
that may be experienced infrequently in-service. Due to the severity of some environmental conditions, such as severe and extreme turbulence or
flights into severe windshear, it is neither recommended nor required that the FGS flight evaluations include demonstration under those
Page 31
conditions. Those conditions are more appropriately addressed by simulator evaluation.
(2) Evaluation of FGS. The FGS should be evaluated to determine the acceptability of the following characteristics:
(a) Stability of automatic control elements and ability to resume tracking following any upset.
(b) Controllability of guidance elements and ability to resume tracking following any upset.
(c) Acceptability of mode transitions and overall cockpit system integration.
(3) Additional Guidance for Windshear. If the FGS provides windshear escape guidance, performance demonstration requirements should
be conducted consistent with AC 25-12, Airworthiness Criteria for the Approval of Airborne Windshear Warning Systems in Transport Category
Airplanes.
d. Specific Performance Conditions. The following paragraphs identify specific performance conditions requiring evaluation by flight test
and/or simulation.
(1) Icing Considerations. The FGS performance and safety in icing conditions should be demonstrated by flight test and/or simulation
tests and be supported by analysis where necessary. The implications of continued use of the automatic flight control elements of the FGS in
icing conditions should be assessed. Ice accumulation on the airplane wings and surfaces can progressively change the aerodynamic
characteristics and stability of the airplane. Even though the FGS may perform safely under these conditions, its continued use may mask this
change, which, in turn, can lead to pilot handling difficulties and potential loss of control, should the autopilot become disengaged (either
automatically or manually).
(a) Test Program. A test program should assess the potential vulnerability of the FGS to icing conditions by evaluating autopilot
performance during artificial ice shape tests or during natural icing tests.
1 Sufficient autopilot testing and analysis should be conducted to ensure that the autopilot's performance is acceptable. This
testing and analysis should include evaluation of the low speed protection threshold in the event that stall warning parameters are adjusted to
account for icing conditions. See Chapter 5, paragraph 55, Icing Considerations in Normal and Rare Normal Conditions, for more information.
2 In general, it is not necessary to conduct an autopilot evaluation that encompasses all weights, CG positions (including lateral
asymmetry), altitudes, and deceleration device configurations. However, if the autopilot performance with ice accretion shows a significant
difference from the non-contaminated airplane or testing indicates marginal performance, additional tests may be necessary.
3 If significant autopilot inputs are required to compensate for the icing conditions, then the acceptability of the indication of a
significant out of trim condition should be assessed, and the subsequent response of the airplane when the autopilot disengages (manual or
automatic) should be determined. See Chapter 3, paragraph 27b, Autopilot Disengagement, and Chapter 4, paragraph 45d, Awareness of
Potential Significant Transient Condition (“Bark Before Bite”), for more information.
(b) De-icing. If the airplane is configured with a de-icing system, the autopilot should demonstrate satisfactory performance during the
shedding of ice from the airplane.
(c) Airplane Flight Manual (AFM) Limitations. Where degradation is noted which is not significant enough to require changes to the
autopilot system or to de-icing or anti-icing systems, appropriate limitations and procedures should be established and presented in the AFM.
(2) Low-Speed Protection. The FGS should be assessed for the acceptability of the low speed protection performance under the following
conditions:
(a) High altitude cruise with a simulated engine failure.
(b) Climb to altitude capture at low altitude with a simulated engine failure during capture.
(c) Vertical speed with insufficient climb power.
(d) Approach with speed abuse.
(3) High-Speed Protection. The FGS should be assessed for the acceptability of the high-speed protection performance under the
following conditions:
(a) High altitude level flight with autothrust function.
(b) High altitude level flight without autothrust function.
(c) High altitude descending flight with autothrust function.
(4) Go-Around.
(a) Mode Assessment. The objective of the Go-Around mode (see Chapter 6, paragraph 65b, Go-Around Mode) is to quickly change
the flight path of the airplane from approach to landing to a safe climbout trajectory. The mode has specific utility in low visibility conditions
when operations are predicated on a DA/H, and a go-around is necessary if visual references are not acquired at the DA/H. Therefore, the
assessment of the Go-Around mode may be conducted in conjunction with the evaluation of the FGS to support low visibility operations, using
additional criteria contained in AC 120-28D and AC 120-29A.
(b) Flight Evaluation. The flight evaluation should be conducted to assess the rotation characteristics of the airplane and the
performance of the airplane in acquiring and maintaining a safe flight path. The acceptability of the operation if contact is made with the runway
during the missed approach or balked landing should be established.
1 Factors to be considered. A demonstration program should be established that confirms acceptable operation when the following
Page 32
factors are considered:
(aa) Airplane weight and CG.
(bb) Various landing configurations.
(cc) Use of manual thrust or autothrust.
(dd) Consequences of thrust de-rates with selection of Go-Around mode.
(ee) An engine failure at the initiation of go-around.
(ff) An engine failure during go-around after go-around power is reached.
(gg) Initiation altitude (for example, in ground effect, not in ground effect during flare).
2 Characteristics to be evaluated:
(aa) The pitch response of the airplane during the initial transition.
(bb) Speed performance during airplane reconfiguration and climbout.
(cc) Integrated autopilot and autothrust operation.
(dd) Transition to missed approach altitude.
(ee) Lateral performance during an engine failure.
3 Go-Around Initiation Heights. Where height loss during a go-around maneuver is significant or is required to support specific
operational approval, demonstrated values for various initiation heights should be included in the AFM.
(5) Steep Approach [special authorization].
(a) Flight Test/Simulator Demonstration. Typical approach operations include glidepath angles between 2.75 and 3.77 degrees.
Application for approval to conduct operations on glidepath angles of greater than 3.77 degrees requires additional evaluation. See AC 120-29A,
section 4.3, Landing, for further discussion. For such an approval, the FGS flight test and simulator demonstration should include the following:
1 Approach path capture, tracking, and speed control.
2 Recovery of the system from abuse cases (for example, glidepath angle and speed).
3 Assessment of autopilot disengagement transient.
4 Demonstration of Go-Around mode from a steep approach.
(b) Autopilot Use on Steep Approaches. For autopilot use at approach angles greater than 4.5 degrees, the criteria of AC 25-7C, Flight
Test Guide for Certification of Transport Category Airplanes, Chapter 8, Airworthiness-Miscellaneous Items, should be satisfied. This advisory
material contains airworthiness and transition criteria for steep approaches. In addition, the criteria of AC 120-29A, Criteria for Approval of
Category I and II Weather Minima for Approach, paragraph 6.2.8, Approach Ban Applicability, should be assessed depending on the operational
and low visibility requirements.
(6) Indication Of and Response To an Out Of Trim Condition. An assessment should be performed to determine the acceptability of the
out of trim annunciation and subsequent response to disengagement. (See Chapter 4, paragraph 45d, Awareness of Potential Significant Transient
Condition (“Bark Before Bite”)).
e. Flight Director (FD)/Head Up Display (HUD).
(1) General. The guidance aspect of an FGS may be provided by a head down FD or a HUD. Head down displays (HDD) normally utilize
FD guidance cues that provide steering commands-such as a cross pointer or single “V”-for the pilot to follow. HUDs normally display a flight
path vector that represents the instantaneous flight path. The vector is based on the aircraft energy state and directional vectors. Various new
display media are evolving (for example, enhanced vision system (EVS) and simulated vision system) that may integrate guidance elements with
situational elements.
(a) Flight Test or Simulator Program. The flight test or simulator program should demonstrate that the FD or HUD guidance elements
provide smooth, accurate, and damped guidance in all applicable modes to achieve satisfactory control task performance without pilot
compensation or excessive workload.
(b) Performance. The FD guidance should provide adequate performance for operations under the conditions listed below. Some pilot
compensation may be acceptable for these conditions:
1 Stability augmentation off.
2 Alternate fly-by-wire control modes (for example, direct law), if any.
3 An engine inoperative.
(c) Non-Stationary Tracking Reference. Flight directors designed to work with a non-stationary tracking reference (such as a flight
path angle or flight path vector which are commonly used with HUD guidance) should be evaluated in conditions which bring these guidance
symbols to the field of view limits of the display. Crosswinds and certain combinations of airspeed, gross weight, CG, and flap/slat/gear
configurations might cause such conditions. At these limits the dynamics of the guidance response to pilot control inputs can differ, with
potentially adverse affects on tracking performance, pilot compensation, and workload.
Page 33
(d) Primary Instrument References. It should be demonstrated that movement of the FD and its tracking reference do not interfere
with primary instrument references throughout their range of motion. The pilot's ability to interpret the guidance and essential flight information
should not be adversely affected by the movement dynamics or range of motion.
(2) Specific Demonstrations For HUD.
(a) Compliance. These demonstrations are intended to show compliance with the following paragraphs of this AC:
1 Chapter 3, paragraph 28, FD Engagement, Disengagement, and Indications
2 Chapter 4, paragraph 44, FGS Mode Selection, Annunciation, and Indication
3 Chapter 4, paragraph 46, FGS Considerations for Head Up Displays (HUD)
4 Chapter 5, paragraph 53, Normal Performance (specifically, criteria for FD guidance)
(b) Demonstrations Required. When the pilot flying (PF) is using the HUD, the HUD is where the pilot is looking for the basic flight
information, and the pilot is less likely to be scanning the head down instruments. Therefore, the following should be demonstrated:
1 The location and presentation of the HUD information (for example, guidance, flight information, and alerts/annunciations)
does not distract the pilot or obscure the pilot's outside view. For example, the pilot should be able to track the guidance to the runway without
having the view of runway references or hazards along the flight path obscured by the HUD symbology.
2 Pilot awareness of primary flight information, annunciations, and alerts is satisfactory when using any HUD display mode.
Some display modes that are designed to minimize “clutter” could degrade pilot awareness of essential information. For example, a
“digital-only” display mode may not provide sufficient speed and altitude awareness during high-speed descents.
3 It should be demonstrated that the pilot can positively detect cases when conformal symbology is field of view limited.
4 Approach mode guidance, if provided, should be satisfactory throughout the intended range of conditions, including at the
minimum approach speed and maximum crosswind with expected gust components, for which approval is sought.
5 Visual cautions and warnings associated with the FGS can be immediately detected by the PF while using the HUD.
6 The PF can immediately respond to windshear warnings, ground proximity warnings, TCAS warnings, and other warnings
requiring immediate flight control action, such as a go-around, while using the HUD without having to revert to a head down flight display.
(c) Pilot Not Flying (PNF). In certain phases of flight, it is important that the PNF and the flightcrew be aware of problems with the
HUD used by the PF. Therefore, it should also be demonstrated that the PNF can immediately be made aware of any visual cautions and
warnings associated with the HUD for applicable phases of flight.
(d) Approach Mode. If Approach mode guidance is provided, satisfactory performance should be demonstrated throughout the
intended range of operating conditions for which approval is sought. For example, performance should be demonstrated at the minimum
approach speed and maximum crosswind with expected gust components.
(e) Recovery Guidance. If recovery guidance is provided, it should be demonstrated that the pilot can immediately detect and recover
from unusual attitudes when using the HUD. Specialized unusual attitude recovery symbology, if provided, should be shown to provide
unequivocal indications of the attitude condition (for example, sky/ground, pitch, roll, and horizon) and to correctly guide the pilot to the nearest
horizon. The stroke presentation of flight information on a HUD may not be as inherently intuitive for recognition and recovery as the
conventional HDD (for example, contrasting color, area fill, shading vs. line strokes). The HUD display design needs to be able to compensate
for these differences to provide adequate pilot recognition and recovery cues.
(3) Simulator Demonstration for HUD. If a pilot-in-the-loop flight simulation is used for some demonstrations, then a high fidelity,
engineering quality facility is typically required. The level of simulator may vary with the functionality being provided and the types of operation
being conducted. Factors for validation of the simulation for demonstration purposes include the following:
(a) Guidance and control system interfaces.
(b) Motion base suitability.
(c) Adequacy of stability derivative estimates used.
(d) Adequacy of any simplification assumptions used for the equations of motion.
(e) Fidelity of flight controls and consequent simulated aircraft response to control inputs. (A correlation of the simulator performance
to flight test results should be made.)
(f) Fidelity of the simulation of aircraft performance. (A correlation of the simulator performance to flight test results should be
made.)
(g) Adequacy of flight deck instruments and displays.
(h) Adequacy of simulator and display transient response to disturbances or failures (for example, engine failure, auto-feather,
electrical bus switching).
(i) Visual reference availability, fidelity, and delays.
(j) Suitability of visibility restriction models, such as appropriate calibration of visual references for the tests to be performed for day,
night, and dusk conditions.
Page 34
(k) Fidelity of any other significant factor or limitation relevant to the validity of the simulation.
f. Flightcrew Override of the FGS. A flight evaluation should be conducted to demonstrate compliance with Chapter 3, paragraph 30,
Override of the FGS. The flight evaluation should consider the implication of system configuration for various flight phases and operations.
(1) Autopilot Override.
(a) Assessing Effect. The effect of flightcrew override should be assessed by applying an input on the cockpit controller (for example,
the control column or equivalent) to each axis for which the FGS is designed to disengage. The evaluation should be repeated with progressively
increasing rate of force application to assess FGS behavior. This assessment should include the initial application of force on the cockpit
controller as well as when the force is removed from the controllers. The effects of speed and altitude should be considered when conducting the
evaluation.
(b) No Automatic Disengagement. If the autopilot is designed such that it does not automatically disengage due to a pilot override,
verify that no potential hazards are generated due to the override per Chapter 3, paragraph 30.
(c) Multiple Channel Engagement. If the design of the autopilot provides for multiple channel engagement for some phases of flight
that results in a higher override force, these conditions should be evaluated.
NOTE:
AC 120-28D, Appendix 3, Airworthiness Approval for Airborne Systems Used to Land and Rollout in Low Visibility Conditions,
Section 8, Airborne Systems, contains guidance for evaluating autopilot override for systems supporting low visibility operations.
(2) Autothrust Override. The capability of the flightcrew to override the autothrust system should be conducted at various flight phases.
The evaluation should include an override of the autothrust system with a single hand on the thrust levers while maintaining control of the
airplane using the opposite hand on the control wheel (or equivalent). This action may not result in a potential hazard per § 25.1329(m), either
during the override or after the pilot releases the thrust levers. Refer to Chapter 3, paragraph 30 of this AC for additional guidance. If the
autothrust system automatically disengages due to the override, the alerts that accompany the disengagement should be assessed to ensure
flightcrew awareness.
(3) Pitch Trim System Evaluation During Autopilot Override.
(a) Effect of Override. The effect of flightcrew override during automatic control on the automatic trim systems should be conducted.
The pilot should also apply an input to the pitch cockpit controller below that which would cause the autopilot to disengage and verify that the
automatic pitch trim system meets the intent in Chapter 3, paragraph 30.
(b) No Automatic Disengagement. If the system design is such that the autopilot does not have an automatic disengagement on
override feature, the pilot should initiate an intentional override for an extended period of time. The autopilot should then be disengaged with the
quick disconnect button and any transient response assessed in compliance with Chapter 3, paragraph 30. The effectiveness and timeliness of any
alerts used to mitigate the effects of the override condition should be assessed during this evaluation.
100. Failure conditions requiring validation: § 25.1309.
a. General.
(1) Safety Assessment. The safety assessment process identified in Chapter 8 should identify any failure condition responses that would
require pilot evaluation to assess the severity of the effect, and the validity of any assumptions used for pilot recognition and mitigation. The
classification of a failure condition can vary according to flight condition and may need to be confirmed by simulator or flight test.
(2) Evaluation of Failure Conditions. This chapter provides guidance on the test criteria, including recognition considerations, for flight
evaluation of these failure conditions. In addition, certain probable failures should be demonstrated to assess the performance of the FGS and the
adequacy of any applicable flightcrew procedures. AC 25-7C, paragraph 181b(9), provides guidance on test methods for particular types of
failure condition that have been identified by the safety assessment.
b. Validation Elements.
(1) Assessment. The safety assessment described in Chapter 8 establishes the FGS failure condition for which appropriate testing should
be undertaken. Assessment of failure conditions has the following elements:
(a) Failure condition insertion.
(b) Pilot recognition of the effects of the failure condition.
(c) Pilot reaction time. That is, the time between pilot recognition of the failure condition and initiation of the recovery.
(d) Pilot recovery.
(2) Failure Condition.
(a) Autopilot. Failure conditions of the autopilot should be simulated such that overall response is representative of how that failure
condition would affect the airplane and its systems. Failure conditions should include multi-axis failures and automatic trim failures, if those
failure conditions exist (given the architecture of a specific FGS) and are relevant to the safety assessment.
(b) Flight Director (FD). FD failure conditions should be validated, if those failure conditions are relevant to the safety assessment.
(c) Most Critical Conditions. The flight conditions under which the failure condition is inserted should be the most critical. Examples
of these flight conditions are CG, weight, flap setting, altitude, speed, power, and thrust. If an autothrust system is installed, the tests should be
Page 35
performed with the autothrust system engaged or disengaged, whichever is the more adverse case.
(3) Pilot Recognition.
(a) General. The pilot may detect a failure condition through airplane motion cues or by cockpit flight instruments and alerts. The
specific recognition cues will vary with flight condition, phase of flight, and crew duties.
(b) Hardover. The recognition point should be that at which a pilot operating in non-visual conditions may be expected to recognize
the need to take action. Recognition of the effect of the failure may be through the behavior of the airplane (for example, in the pitch axis by
aircraft motion and associated normal acceleration cues and in the roll axis by excessive bank angle) or an appropriate alerting system. Control
column or wheel movements alone should not be used for recognition. The recognition time should not normally be less than 1 second. If a
recognition time of less than 1 second is asserted, specific justification will be required. For example, additional tests may be required to ensure
that the recognition time is representative in light of the cues available to the pilot.
(c) Slowover. This type of failure condition is typically recognized by a path deviation indicated on primary flight instruments (for
example, course deviation indicator (CDI), altimeter, or vertical speed indicator). It is important that the recognition criteria are agreed upon with
the FAA. The following identify examples of recognition criteria as a function of flight phase:
1 En-route cruise. Recognition through the altitude alerting system can be assumed for vertical path deviation. The lateral motion
of the airplane may go unrecognized for a significant period of time, unless a bank angle alerting system is installed and the slowover results in a
bank angle in excess of the limit allowed by the alerting system.
2 Climb and descent. Recognition through increasing/decreasing vertical speed, pitch attitude, roll attitude, or heading can be
assumed.
3 On an approach with vertical path reference. A displacement recognition threshold should be identified and selected for testing
that is appropriate for the display(s) and failure condition(s) to be assessed.
NOTE 1:
For an ILS or GLS approach in a significant wind gradient, a value of 1 dot on the displayed ILS/GLS deviation scale is considered a
reasonable value for crew recognition. In smooth atmospheric conditions with steady state tracking with the vertical flight path typically
maintained at less than a fraction of a needle width, a detection and recognition threshold even below 1/2 dot may be suitable.
NOTE 2:
For RNAV systems that do not use dots, some multiple of needle width related to an established crew monitoring tolerance of normal
performance may be appropriate (for example, three needle widths of deviation on the VNAV scale).
NOTE 3:
Credit may be taken for excessive deviation alerts, if available.
4 On an approach without vertical path reference, criteria similar to the climb/descent condition can be assumed.
(d) Oscillatory. It is assumed that oscillatory failures that have structural implications are addressed under 14 CFR Part 25, Subpart C,
and § 25.1309. It can be assumed that the flightcrew will disengage the automatic control elements of the FGS that have any adverse oscillatory
effect and will not follow any adverse oscillatory guidance. However, if there are any elements of the FGS that can not be disconnected in the
presence of an oscillatory failure condition, the long term effects on crew workload and the occupants will need to be evaluated.
(4) Pilot Reaction Time. The pilot reaction time is considered dependent upon the pilot attentiveness, based upon the phase of flight and
associated duties. The following assumptions are considered acceptable:
(a) Climb, Cruise, Descent and Holding. Recovery action should not be initiated until three seconds after the recognition point.
(b) Maneuvering Flight. Recovery action should not be initiated until one second after the recognition point.
(c) Approach. The demonstration of malfunctions should be consistent with operation in non-visual conditions. The pilot can be
assumed to be carefully monitoring the airplane performance and will respond rapidly once the malfunction has been recognized. A reaction time
of one second between recognition point and initiation of recovery is appropriate for this phase of flight.
NOTE 1:
For the final phase of landing (for example, below 80 feet), the pilot can be assumed to react upon recognition without delay.
NOTE 2:
For phases of flight where the pilot is exercising manual control using CWS, if implemented, the pilot can be assumed to commence
recovery action at the recognition point.
(5) Pilot Recovery.
(a) Pilot Recovery Action. The recovery action should be commenced after the reaction time. Following such delay, the pilot should
be able to return the airplane to its normal flight attitude under full manual control without engaging in any dangerous maneuvers during
recovery and without control forces exceeding the values given in § 25.143(d). During the recovery, the pilot may overpower the autopilot or
disengage it.
(b) Minimum Autopilot Use Height. For the purpose of determining the minimum height at which the autopilot may be used during
an approach or for height loss assessments, a representative pilot recovery maneuver appropriate to the airplane type and flight condition should
Page 36
be performed. This maneuver should not lead to an unsafe speed excursion to resume a normal flight path. An incremental normal acceleration in
the order of 0.5 g is considered the maximum for this type of maneuver.
c. Takeoff.
(1) Worst Case Failure Condition. The primary concern for the takeoff phase of flight is the effect of the worst case failure condition
identified by the safety assessment on the following:
(a) The net effect on the flight path of the airplane after takeoff, and
(b) The airplane's attitude and speed during climbout.
(2) Failures to be Evaluated. Failures that would cause the airplane to pitch up, pitch down, and bank during the takeoff should be
evaluated, if those failure conditions exist (given the architecture of a specific FGS) and are relevant to the safety assessment.
(3) On Runway Guidance. If the FGS provides on runway guidance for takeoff, the effect of any failures of that takeoff guidance should
be assessed. See AC 120-28D for additional information.
d. Climb, Cruise, Descent, and Holding. Where the safety analysis identifies a failure condition requiring flight/simulator evaluation with
pilot assessment, the height loss should be established in accordance with the method described in AC 25-7C, paragraph 181b(9)(e)4,
Assessment of Approach Without Vertical Path Reference.
e. Maneuvering. Where the safety analysis identifies a failure condition that has a dynamic effect on the roll control of the airplane, the failure
condition should be introduced at the bank angle for normal operation. The bank angle should not exceed 60 degrees when the pilot recognition
and the recovery times identified above are applied.
f. Approach. A discussion of the operational considerations for approach operations is contained in paragraph 101, Criteria Supporting
Operational Use of the Autopilot, below. This chapter identifies test criteria to support those considerations. The safety assessment process
should identify the demonstration of specific failure conditions during the approach. The fault demonstration process during approach should
include the four phases identified in paragraph 100b, Validation Elements, above. The failure condition should be inserted at a safe but
representative height. The deviation profile should be identified and applied as indicated in AC 25-7C, paragraph 181b(9)(e), Approach.
(1) Approach With Vertical Path Reference.
(a) xLS (that is, ILS, MLS, or GLS).
1 ILS and MLS operations are typically conducted on instrument approach procedures designed in accordance with United States
Standard for Terminal Instrument Procedures (TERPS). See FAA Order 8260.3, United States Standard for Terminal Instrument Procedures, or
the International Civil Aviation Organization (ICAO) Procedures for Air Navigation Services - Operations (PANS-OPS) criteria, or equivalent.
These criteria together with ICAO Annex 14 are generally intended to take into account obstacles beneath a reference obstacle identification
surface.
NOTE:
The FAA may establish operational criteria for GLS at a later time.
2 In assessing the implication of the effect of failures during autopilot operations, a reference 1:29 slope penetration boundary has
been applied against the deviation profile to identify an appropriate altitude for continued autopilot operation. The 1:29 slope has been found to
provide an acceptable margin above obstacles on an approach.
3 The worst case failure condition identified by the safety assessment (See Chapter 8, paragraph 87, Validation of Failure
Conditions.) should be demonstrated against the deviation profile criteria and a minimum use height (MUH) established. (See AC 25-7C,
paragraph 181b(9)(e)3, Assessment of Approach With Vertical Path Reference.)
(b) Area Navigation (RNAV).
1 For RNAV coupled approach operations, a vertical flight path similar to an xLS flight path will be used (for example, 3 degree
path starting 50 feet above the threshold). However, due to sensor characteristics it is assumed that RNAV operations will be conducted with a
DA(H) or MDA(H) that is higher than an equivalent MUH on an xLS approach to the same runway. Further, for this type of operation, it should
be noted that the MUH is always in the visual segment of the approach, as the failure recognition and recovery maneuver are assumed to be
conducted with the pilot having established outside visual reference.
2 In order to derive only one MUH value for simplicity of use, it is assumed that the effects of failure on the autopilot in RNAV
operation are no worse than for the xLS operation. No further determination or demonstration is required. However, the applicant should show
that due account has been taken in the safety assessment of the differences between the RNAV and xLS inputs to the autopilot (for example,
barometric altitude input, FMS position and guidance commands, and their failure effects). If these effects can be bounded or otherwise
reconciled, then the xLS demonstrated MUH may also be considered applicable to RNAV operations.
3 If these effects cannot be bounded or accounted for within those for the xLS operation, the MUH should be determined in
accordance with an Approach Without Vertical Path Reference, below.
(2) Approach Without Vertical Path Reference. For an approach without vertical path reference (for example, VOR, Non Directional
Beacon (NBD), localizer only) the FGS mode of operation is typically vertical speed/flight path angle (that is, a cruise mode). The worst case
failure condition for this type of mode should be demonstrated in the approach configuration. An appropriate height loss should then be
established in accordance with the method described in AC 25-7C, paragraph 181b(9)(e)4.
(3) Steep Approach. In support of an approval to use the FGS on glidepath angles of greater than 3.77 degrees (see Chapter 9, paragraph
99d(5), Steep Approach [special authorization]), an assessment should be made of the effects of failure conditions for this type of operation. For
Page 37
use of autopilot, an appropriate MUH should be established in accordance with the deviation profile method described in this chapter. For this
assessment, the obstacle plane associated with a nominal 3 degree glidepath angle (1:29 slope) should be adjusted, according to the maximum
approach angle for which approval is sought.
g. Specific Conditions.
(1) Failure Conditions to be Evaluated. The following are failure conditions that should be considered as part of the FGS evaluation
program:
(a) Engine failure during approach; continue approach to decision altitude/minimum descent altitude (DA/MDA).
(b) Potential fuel imbalance.
(c) Airplane system failures that affect FGS operational capabilities. Examples include failures of hydraulic systems, electrical
systems, flight controls, and FGS related sensors. When possible, these failure conditions should be evaluated with a flight test. However, some
failure conditions, due to their potential hazards, may best be evaluated via a high fidelity flight simulation.
(2) Failure to Disengage. The probability of failure of an FGS element to disengage when the quick disengagement control is operated
should be shown to be acceptable by the safety analysis process. If credit is to be taken for acceptable continued manual operation with the FGS
elements remaining engaged, that is, without operating any of the other disengagement controls, then a flight demonstration should be conducted
though approach, landing and rollout.
101. Criteria supporting operational use of autopilot.
a. Typical Flight Operations. The criteria contained in this paragraph are intended to identify how the functional capability of the FGS,
established during the certification, can be utilized to support typical flight operations. The criteria are based on experience gained from
certification programs and functionality provided by traditional systems. A FGS providing non-traditional functionality-using new or novel
technology and/or implementation techniques-may require additional criteria to be established.
b. Operations in Close Proximity to the Ground.
(1) General. During low visibility operations, multiple redundant autopilot channels may be used, and the effect of any autopilot failures
on the flight path may be eliminated or substantially minimized by the protection provided by that redundancy. The considerations in the
following paragraphs apply primarily to single channel operations where performance or integrity aspects may require further consideration. See
Chapter 8, paragraph 88b, FGS Operations in Close Proximity to the Ground, for specific considerations relating to autopilot operations close to
the ground in the presence of failures.
(2) Considerations. The minimum engagement point for the autopilot after takeoff and the minimum use of the autopilot during approach
should take into consideration the effect of the following:
(a) Failures and their effects (that is, failure conditions).
(b) Fault-free performance.
(c) Any specific operational considerations and/or mitigation.
(3) Autopilot Engagement Altitude/Height After Takeoff.
(a) Deviation from Flight Path. The potential deviation of the airplane from the desired flight path due to the effect of a failure
condition may necessitate delaying the engagement of an autopilot to an acceptable height above the departure runway.
(b) Worst-Case Deviation Profile. To support the determination of the minimum engagement height, if autopilot failure condition(s)
are identified that will cause a significant deviation below the intended vertical flight path, the worst-case deviation profile should be identified.
This profile and the recovery of the airplane should not result in penetration of the net flight path as defined in § 25.115.
(c) Other Effects. If the failure condition(s) have a neutral effect on the flight path but has implications for speed control during
takeoff, the acceptability of cues for the flightcrew detection of the condition should be made. The effect of any failure condition relating to the
bank angle of the airplane should also be assessed. In all of the above, account should be taken of operating the airplane at the
weight/altitude/temperature (WAT) limit.
(d) Minimum Engagement Height. The minimum engagement height will typically be established, based on the greatest of the
following factors:
1 The lowest altitude or height where the flightcrew could reasonably be assumed to engage the autopilot. Consideration should
be given to normal flightcrew tasks during rotation and liftoff (typically 100 feet or greater).
2 Any allowance for the acceptability of the performance of the autopilot during the basic engagement/mode transition.
3 The lowest altitude or height consistent with the response of the airplane to any identified autopilot failure condition(s).
4 Activation of an armed stall identification system, such as a stick pusher (if installed).
(e) Deviation Information. If the response to the worst-case failure condition causes a significant transition below the intended vertical
flight path, the deviation information should be provided in the AFM.
(4) Autopilot Engagement During Approach.
(a) Deviation from Flight Path. The potential deviation of the airplane from the desired flight path due to the effect of a failure
condition may necessitate the disengagement of an autopilot at an appropriate height on the approach to landing.
Page 38
(b) MUH - Approach. The operational MUH for approach will be established, based on the following considerations:
1 The altitude or height at which the performance of the automatic control is no longer acceptable.
2 The lowest altitude or height consistent with the response of the airplane to a subsequent autopilot failure.
3 Any specific operational consideration.
(c) Approach with Vertical Path Reference.
1 Approaches with vertical path reference can include xLS (that is, ILS, MLS or GLS) or RNAV. Operations using xLS can be
assumed to be conducted with respect to a flight path prescribed or established as an integral part of navigation service provided by the State.
RNAV approach operations will be conducted using an onboard database that provides a navigation flight path to the runway.
2 The operational consideration for this type of operation relates to an assessment of the adequacy of continued use of the
autopilot in maintaining the desired vertical flight path. Considerations include the lowest altitude consistent with the response of the airplane to
an autopilot failure.
3 To support this determination, if one or more autopilot failure condition(s) is identified that causes a significant transition below
the intended vertical flight path, the worst-case deviation profile should be identified using the method identified in Chapter 9, paragraph
100f(1), Approach With Vertical Path Reference. If the failure condition(s) has a neutral effect on the flight path, the acceptability of cues for the
flightcrew detection of the condition should be made. The effect of any failure condition relating to the bank angle of the airplane should be
assessed.
4 For the purpose of the airworthiness assessment, the vertical flight path an xLS and RNAV approach can be assumed to be a
flight path of 3 degrees that passes through the runway threshold at an altitude of 50 feet. Considerations for steep approaches are provided in
paragraph Chapter 9, paragraph 99d(5), Steep Approach [special authorization].
5 The vertical flight path control for an xLS approach will be made with reference to the path defined by the navigation service.
The RNAV vertical flight path will typically be conducted with reference to barometric altitude. An appropriate adjustment to the MUH may be
necessary to take into account the vertical accuracy of RNAV operations.
NOTE:
Temperature effect compensation should be considered as part of the operational authorization.
6 The MUH - Approach is the value identified using the method identified in AC 25-7C, paragraph 181b(9)(e), Approach.
(d) Approach Without Vertical Path Reference.
1 Flight operations with no vertical path reference are conducted with an appropriate visual segment for final approach path. In the
interest of providing appropriate automatic control to assist in a stabilized approach, the minimum use of the autopilot should be consistent with
the performance needed for the descent (for example, vertical speed/flight path angle) and the pilot detection and recovery from an autopilot
failure.
2 To support this determination, if one or more autopilot failure conditions is identified that causes a significant transition below
the intended vertical flight path, the worst-case deviation profile should be identified. If the failure condition has a neutral effect on the flight
path but has implications for speed control during takeoff, the acceptability of cues for the flightcrew detection of the condition should be made.
The effect of any failure condition relating to the bank angle of the airplane should be assessed.
3 For FGS that are failure protected (that is, fail-passive), the MUH will typically be no lower than 50 feet above runway
elevation. However, when determining this limitation, account should be taken of the handling task presented to the pilot when regaining manual
control, especially in limiting crosswind conditions.
4 For FGS that are not failure protected (that is, not fail-passive), the demonstrated MUH-Approach will typically be established
based on the greater of the following considerations:
(aa) 50 feet above runway elevation.
(bb) Two times the height loss for the airplane as a result of any identified autopilot failure condition, using the method
identified in AC 25-7C, paragraph 181b(9)(e), Approach.
(5) Circling Approach. For the purpose of this AC, circling approaches may be considered to have the following visual segments
associated with the approach:
(a) A segment at or above the minimums prescribed by the procedure that parallel the runway in the opposite direction of the landing
runway,
(b) A turning segment to align with the runway that can be level or partially descending, and
(c) A final descending segment to landing.
Operationally, the autopilot may remain engaged even after leaving the minimum altitude (MDA(H)) for reasons related to safety and
flightcrew workload relief. This operational procedure should be balanced against unacceptable performance or failure characteristics. As this
procedure is in the visual segment, no specific constraints for the use of the autopilot are considered necessary for this phase of flight, unless
specific unacceptable performance or failure characteristics related to circling approach are identified during the certification program.
c. Climb, Cruise, Descent, and Holding. The value of the use of the autopilot in providing flightcrew workload relief in climb, cruise,
Page 39
descent, and holding phases of flight should be balanced against the failure characteristics of the autopilot. No specific constraints for the use of
the autopilot are considered necessary for these phases of flight, unless specific unacceptable performance or failure characteristics related to
climb, cruise, or descent are identified during the certification program.
d. Maneuvering. No specific constraints for the use of the autopilot are considered necessary for maneuvering flight, unless unacceptable
performance or failure characteristics are identified during the certification program. Chapter 9, paragraph 98e, Maneuvering, provides
assessment criteria for maneuvering flight for autopilot failures.
102. Automatic disengagement of the autopilot. The automatic disengagement of the FGS will occur for several reasons, such as system
failures, sensor failures, or unusual accelerations. The automatic disengagement characteristics of the FGS should be investigated throughout the
flight envelope. These disengagement cases should be analyzed to determine the ones that can be demonstrated during the test program. For each
disengagement case, the transients, warnings, and pilot workload for recovery should be evaluated, and compliance with § 25.1329(d) and (e)
must be verified. The use of simulation is recommended for all conditions that are expected to result in significant transients.
103. Assessment of human factors.
a. General. The evaluation, demonstration and testing should assess the acceptability of the human-machine interface with the FGS and the
potential for flightcrew errors and confusion concerning the behavior and operation of the FGS, when used by a representative range of pilots.
The evaluation of normal and non-normal FGS operations should include the representative range of conditions in terms of crew mental or
physical workload, required crew response timeliness, and potential for confusion or indecision. The set of test cases should represent
operationally relevant scenarios and the assumptions about pilot training and skill level should be documented.
b. Flight Evaluations.
(1) During Certification. Flight evaluation during certification is a final assessment and is intended to validate the design.
(2) Prior to Certification. Evaluations prior to certification are typically conducted in a variety of ways and at different levels of fidelity in
order to finalize the design. These may include the following:
(a) Engineering evaluations and task analyses, including cognitive and physical tasks.
(b) Mock-up evaluations and demonstrations.
(c) Part-task evaluations and demonstrations.
(d) Simulator evaluations, demonstrations, and tests.
(e) Engineering flight evaluations, demonstrations, and tests.
(3) Credit to Establish FGS Compliance. The data and experiences from these evaluations may be useful for credit to establish FGS
compliance with regulations having human factors considerations. In addition, applicants have successfully used comparisons to previously
certificated designs to obtain such credit (although such credit is not assured). Additional testing may be necessary for new FGS flightcrew
interface designs or functions.
(4) Simulation Versus Flight Tests. In some cases, the FAA may consider that less flight testing may be required to show compliance, if
the simulation evaluations have added confidence with respect to the reduced potential for crew error and confusion and other human factors
attributes of the pilot/FGS interface.
(a) Selecting Methodology. In many cases the evaluation, demonstration, and test scenarios, including failures and environmental
events, will determine whether the data should be obtained in simulation or in flight because of safety considerations or unavailability of the
necessary environmental conditions.
(b) High Fidelity Simulation. In some test scenarios, a very high fidelity simulation will be needed. In addition to the simulation
validation considerations identified in Chapter 9, paragraph 99e(3)(b), Motion Base Suitability, the simulation used may need to include the
following features, depending on the functionality of the FGS:
1 Physical implementation of flight deck controls, displays, indicators, and annunciators for all flightcrew positions that are
relevant to the objectives of the evaluation.
2 Adequate emulations of relevant equipment (hardware and software function), including capability to introduce failures.
3 Weather simulation, including gusts, turbulence, windshear, and visibility.
4 Representation of the operational environments, including interaction with air traffic services, day/night operations, etc., as
relevant to the functions and pilot tasks being evaluated.
5 Data collection capabilities.
(c) Simulation Conformity. In some cases, certification credit or demonstration of compliance using simulations may not be granted
due to inability to find simulation conformity. Conformity should be accounted for when seeking certification testing credit using a simulator.
c. Structured Subjective Evaluations. Simulator evaluations and tests are intended to generate objective and/or subjective data. It may not
always be possible or necessary to obtain quantifiable measurements of flightcrew performance, even with high fidelity flight or simulation
evaluation, demonstration, or test scenarios. In these cases, evaluation procedures should be based on the use of structured subjective methods,
such as rating scales, questionnaires, and/or interviews. When there is dependence on this type of data, evaluations should consider multiple data
collection techniques with an appropriate number of pilot evaluators.
d. Pilot Training And Experience. In order to provide sound evaluations, pilots should be trained appropriately on the FGS operation and

Page 40
procedures. They should have experience in the kinds of operation and aircraft types for which the FGS is intended. Finally, they should be
familiar with the intended function of the FGS, its operational and design philosophy, and the way that this philosophy fits with the overall flight
deck and its operational and design philosophy.
e. Evaluating New or Unique Design Features. Rationale should be provided for decisions regarding new or unique features in a design. It
should be confirmed that the data resulting from the evaluations support acceptability of any new or unique features.
f. Certification Planning Documentation. The certification planning documentation should describe the means to show compliance with the
human factors related considerations of the FGS with this AC.
104 - 108 [Reserved]
Chapter 10. Airplane Flight Manual
109. General. The following paragraphs provide guidance on material to be provided in the AFM to ensure that the appropriate information
related to FGS operation is translated into air carrier operations. For additional guidance, note that AC 25.1581-1 Change 1, Airplane Flight
Manual, addresses requirements of the AFM for transport category aircraft and distinguishes between those aircraft that are used in air carrier
operations and those not in air carrier service.
a. AFM Terminology. The terminology used in the AFM should be consistent with the intended operational use.
b. Low-Visibility Operations. Appropriate AFM information related to low-visibility operations are addressed in AC 120-28D and AC
120-29A.
110. Information supporting operational use of the autopilot.
a. General. The airworthiness certification process will assess the effect of autopilot Failure Conditions as identified in Chapters 8, Safety
Assessment, and 9, Compliance Demonstration Using Flight Test Simulation. If a specific MUH is necessary, then the height should be provided
in the AFM limitations section. If the design is such that the effects of one or more failure conditions do not require establishment of a MUH,
then the pertinent deviation profile or height loss information should be provided in the normal or non-normal section of the AFM, as applicable.
b. Specifying a Minimum Use Height (MUH). If a MUH or a height loss value is applicable, it should be specified as follows:
(1) Takeoff - Autopilot engagement altitude or height.
(2) Cruise - height loss.
(3) Approach - MUH or height loss.
(a) Approach With Vertical Path Reference. The MUH should be determined based on clearance above a 1:29 plane using the
deviation profile method, as discussed in AC 25-7C, paragraph 181b(9)(e), and shown in Figure 181-2, Deviation Profile Method, of that AC.
(b) Approach Without Vertical Path Reference. The height loss should be determined using the height loss method, as discussed in
AC 25-7C, paragraph 181b(9)(e), and shown in Figure 181-3, Height Loss Method, of that AC.
(c) Assessment of Approach with Vertical Path Reference as shown in AC 25-7C, Figure 181-2, Deviation Profile Method.
c. Maximum Displacement Deviation. If minimum engagement altitude(s) or height(s) are not specified, then “maximum displacement
deviation” information from a pertinent takeoff flight path and approach profile should be provided in the AFM normal procedures section, or in
the associated flightcrew operation manual (FCOM).
111. Limitations. The AFM limitations section presents those FGS operating limitations appropriate to the airplane model as established in the
course of the type certification process. The FGS operational limitations listed in the AFM (should any exist) must specify any
configuration/envelope restrictions. [See §§ 25.1581(a)(1), and 25.1583]
112. Non-normal/emergency procedures. The AFM must include non-normal or emergency procedures appropriate to the FGS identified
during the certification program. [See §§ 25.1581(a)(1), and 25.1585(a)(2), (a)(3)]
113. Normal procedures.
a. Documentation of Normal Procedures. The normal procedures for use of the FGS must be documented in the AFM. [See §§ 25.1581(a)(1),
and 25.1585(a)(1)] These procedures should be demonstrated during the type certification process.
b. Maximum Displacement Deviation. In lieu of specification of minimum engagement altitude(s) or height(s) (see paragraph 110, above),
the AFM may alternately specify “maximum displacement deviations” from a specified takeoff flight path or from a specified approach profile.
This information may be based on typical departure or approach flight paths suited for the aircraft type and for failure conditions that are
determined applicable to the type of FGS and modes suitable for use.
c. Procedures for Use of FGS in Icing Conditions. The flight manual should include any necessary procedures for the use of the FGS in icing
conditions (including moderate and heavy icing conditions). In particular, the procedures should include any necessary changes in operating
speeds, required either operationally or as a result of relevant design features of the speed protection function of the FGS. For example, variations
in minimum speeds as a function of de/anti-icing system selection, speed increments during approach, and landing in turbulence should be part of
the documented procedures.
d. Aircraft With Published Flightcrew Operations Manuals (FCOM). The AFMs for aircraft for which the manufacturer has published a
FCOM must contain essential information on normal operating procedures that are considered unique to the operation of the FGS for the aircraft
type or are otherwise necessary for safe operation. [See § 25.1581(a)(2)] FGS description and integration with the overall flight deck design

Page 41
philosophy, specification, and operational procedures that are normally associated with FGSs should be included in the FCOM. If applicable, a
FCOM may contain the “maximum displacement deviation” information described in paragraph 110, above, in either numeric or graphic form.
e. Aircraft Without Published FCOMs. For aircraft that rely on the AFM as the sole operating manual, the AFM must contain operating
information sufficient for flightcrew reference. [See § 25.1581(a)(2)] The FGS description and integration with the overall flight deck design
philosophy, specification and operational procedures normally associated with FGSs, should be made available so that an appropriately trained
flightcrew may operate the FGS under normal conditions.
Appendix 1. Safety assessment
1. General. This appendix provides material that may be useful in supporting the safety assessment activities identified in Chapter 8, Safety
Assessment.
2. Identification of failure conditions. The following cases should be considered for applicability when establishing failure conditions, as
indicated in Chapter 8.
a. Loss of autopilot in single or multiple axes.
b. Loss of guidance in single or multiple axes.
c. Loss of thrust control.
d. Partial loss or degradation of autopilot function.
e. Unintended autopilot commands in a single axis or multiple axes simultaneously (for example, hardover, slowover, and oscillatory failure
modes).
f. Unintended guidance commands in a single axis or multiple axes.
g. Unintended thrust control.
h. A sustained out-of-trim condition with the autopilot engaged without an alert.
i. Autopilot disengagement in an out-of-trim condition.
j. Autopilot disengagement without a warning.
k. Inability to disengage the autopilot or autothrust function.
l. Uncommanded engagement of an autopilot or autothrust.
m. Jamming or loading of primary flight controls.
n. Unintended thrust asymmetry.
A typical failure condition statement may be of the form:
‘[Failure]’ during ‘[Phase of Flight]’ that ‘[Effect]’ when ‘[Mitigation Consideration]’ Failure conditions may result from failures within the
FGS or from failure associated with aircraft interfacing systems or components (for example, NAV receivers, attitude heading reference systems,
flight management systems (FMS), hydraulics, electrical systems, etc.).
3. Considerations when assessing the severity of failure condition effects.
a. Complete Definition of Failure Condition. The “failure condition” definition is complete (as defined in AC 25.1309-1A, System Design
and Analysis) when the effects resulting from the failure are identified. The complete definition of the “failure condition” and its effect will then
support the subsequent failure condition hazard classification.
b. Factors To Consider. When assessing the effect that results from a failure, the following factors should be considered for various phases of
flight:
(1) The impact of the loss of control or unintended control on the structural integrity of the airplane as a result of simple loading or as a
result of excitation of aerodynamic or structural modes-both at the time of occurrence and while the flight continues.
(2) Implications of the airplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on
flightcrew performance.
(3) Degradation in the stability or other flying qualities of the airplane.
(4) The duration of the condition.
(5) The aircraft configuration.
(6) The aircraft motion cues that will be used by the flightcrew for recognition.
(7) Availability, level, and type of alerting provided to the flightcrew.
(8) Expected flightcrew corrective action on detection of the failure.
c. Possible Characteristics of Failure Conditions. Failure conditions may include the following characteristics:
(1) “Hardover” effects-typically are considered significant and are readily detectable by the flightcrew, based on the resulting aircraft
Page 42
motion or guidance cues.
(2) “Slowover” effects-typically are not readily detected by the flightcrew. The effect may involve departures from intended flight path
that are not initially detectable by aircraft motion alone and may be detectable only by motion cues when a significant flight path deviation has
occurred or by an appropriate flightcrew alert.
(3) “Oscillatory” effects-typically are repetitive motions or guidance conditions not related to intended guidance or control. The
magnitude, period, and duration of the condition and any mitigation considerations will determine the final effect.
(4) “Loss of” effects-typically is the removal of control, guidance or functionality that may have an immediate effect or may not be
immediately apparent to the flightcrew.
NOTE:
Chapter 9, Compliance Demonstration Using Flight Test and Simulation, provides guidance on crew recognition considerations.
4. Failure condition classification. The following are examples of the type of failure condition effects that have been identified in previous
airplane certification programs. The specific number and type of failure condition may vary with airplane type, airplane system architecture, and
FGS design philosophy (for example, failure detection, redundancy management, failure annunciation, etc.).
a. Catastrophic Failure Conditions. The following effects have been assessed catastrophic in previous airplane certification programs:
(1) A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing.
(2) Unrecoverable loss of flight path control.
(3) Exceedance of VDF/MDF (demonstrated flight dive speed/demonstrated flight dive Mach).
(4) Flutter or vibration that causes a structural failure preventing safe flight and landing.
(5) A temporary loss of control (for example, stall) where the flightcrew is unable to prevent contact with obstacles or terrain.
(6) Deviations in flight path from which the flightcrew are unable to prevent contact with obstacles, terrain, or other aircraft.
b. Hazardous Failure Conditions. The following effects have been assessed hazardous in previous airplane certification programs:
(1) Exceedance of an airspeed halfway between VMO (maximum operating limit speed) and VDF or a Mach number halfway between
MMO (maximum operating limit Mach) and MDF.
(2) A stall, even if the flightcrew is able to recover safe flight path control.
(3) A load factor less than zero.
(4) Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 1000 ft. (304.8 m above an applicable airport
elevation).
(5) Degradation of the flying qualities of the airplane that excessively increases flightcrew workload.
(6) Failure that could result in a rejected takeoff (RTO) and high speed overrun (for example, 60 knots).
(7) A flight path deviation that requires a severe maneuver to prevent contact with obstacle, terrain or other aircraft.
NOTE:
Severe maneuver includes risk of serious injury or death of a small number of occupants.
c. Major Failure Conditions. The following effects have been assessed “major” in previous airplane certification programs:
(1) A flight path deviation, including the required recovery maneuver, which may result in passenger injuries. Consideration should be
given to phases of flight where the occupants may reasonably be moving about the airplane or be serving or consuming hot drinks. See Appendix
2, for the definition of significant transient.
(2) Degradation of the flying qualities of the airplane that significantly increase flightcrew workload.
Appendix 2. Definitions
The following definitions apply to the requirements of § 25.1329 and the guidance material provided in this AC. They should not be assumed to
apply to the same or similar terms used in other regulations or ACs. Terms for which standard dictionary definitions apply are not defined in this
AC.
TERM DEFINITION
Abnormal Condition See non-normal condition.
Advisory Crew awareness is required and subsequent crew action may be required.
Alert A generic term used to describe a flight deck indication meant to attract the attention of the
flightcrew to a non-normal operational or airplane system condition without implying the
degree or level of urgency for recognition and corrective action by the crew. Warnings,
cautions, and advisories are considered alerts.
Analysis The terms “analysis” and “assessment” are used throughout. Each has a broad definition
Page 43
and the two terms are to some extent interchangeable. However, the term analysis
generally implies a more specific, more detailed evaluation, while the term assessment may
be a more general or broader evaluation but may include one or more types of analysis.
Arm A condition where the intent to transition to a new mode or state has been established but
the criteria necessary to make that transition has not been satisfied.
Assessment See the definition of analysis above.
Autopilot The autopilot function provides automatic control of the airplane, typically in pitch, roll,
and yaw. The term includes the sensors, computers, power supplies,
servo-motors/actuators and associated wiring, necessary for its function. It includes any
indications and controllers necessary for the pilot to manage and supervise the system. Any
part of the autopilot system that remains connected to the primary flight controls when the
autopilot is not in use is regarded as a part of the primary flight controls.
Autothrust The autothrust function provides automatic control of the thrust of the airplane. The term
includes the sensors, computers, power supplies, servo-motors/actuators and associated
wiring, necessary for its function. It includes any indications and controllers necessary for
the pilot to manage and supervise the system. Any part of the autothrust that remains
connected to the engine controls when the autothrust is not in use is regarded as a part of
the engine control system.
Caution A flight deck indication that alerts the flightcrew to a non-normal operational or airplane
system condition that requires immediate crew awareness. Subsequent pilot corrective
compensatory action will be required.
Cognitive Task Analysis An analysis that focuses on the mental processes, skills, strategies, and use of information
required for task performance.
Complex A system is complex when its operation, failure modes, or failure effects are difficult to
comprehend without the aid of analytical methods.
Conformal Positioned and scaled with respect to the outside view.
Control Wheel Steering A flight guidance system (FGS) function which, when engaged, enables the pilot/first
(CWS) officer to manually fly the airplane by positioning the flight control surfaces using the
autopilot servos. The positions of the flight deck controls (for example, control column,
control wheel) are determined by the FGS, which converts them into autopilot servo
commands. The autopilot servos, in turn, drive the appropriate flight control surfaces.
Conventional A system is considered to be conventional if its functionality, the technological means used
to implement its functionality, and its intended usage are all the same as, or closely similar
to, that of previously approved systems that are commonly used.
Engage A steady state that exists when a flightcrew request for mode or system functionality has
been satisfied.
Error An omission or incorrect action by a crewmember or maintenance personnel, or a mistake
in requirements, design, or implementation.
Failure An occurrence that affects the operation of a component, part, or element such that it can
no longer function as intended (this includes both loss of function and malfunction).
Note: Errors may cause failures, but are not considered to be failures.
Failure Condition A condition having an effect on the airplane and/or its occupants, either direct or
consequential, which is caused or contributed to by one or more failures or errors,
considering flight phase and relevant adverse operational or environmental conditions, or
external events.
Fail Operational System A system capable of completing an operation, following the failure of any single element
or component of that system, without pilot action.
Fail Passive System A system which, in the event of a failure, results in:
(a) no significant deviation in the aircraft flight path or attitude, and
(b) no out-of-trim condition at disengagement that is not easily controlled by the
pilot.
Flight Director (FD) A visual cue or set of cues that are used during manual control of the airplane as command
information to direct the pilot how to maneuver the airplane, usually in pitch, roll and/or
yaw, to track a desired flight path. The FD, displayed on the pilot's primary head down
attitude indicator (ADI) or head up display (HUD), is a component of the flight guidance
system (FGS) and is integrated with airborne attitude, air data, and navigation (NAV)
systems.
Flight Guidance System A system consisting of one or more of the following elements:
(FGS) • autopilot
• flight director (FD), and
• automatic thrust control.
A flight guidance system (FGS) also includes any interactions with stability augmentation
and trim systems.
Flight Management System An aircraft area navigation (RNAV) system and associated displays and input/output
Page 44
(FMS) devices(s) having complex multi-waypoint lateral (LNAV) and vertical (VNAV) capability
(or equivalent), data entry capability, data base memory to store route and instrument flight
procedure information, and display readout of NAV parameters. The flight management
system (FMS) provides guidance commands to the FGS for the purpose of automatic
navigation and speed control when the FGS is engaged in an appropriate mode or modes
(for example, VNAV, LNAV, RNAV).
Head Up Display (HUD) A transparent optical display system located level with and between the pilot and the
forward windscreen. The HUD displays a combination of control, performance, navigation
(NAV), and command information superimposed on the external field of view. It includes
the display element, sensors, computers and power supplies, indications and controls. It is
integrated with airborne attitude, air data and navigation NAV systems, and as a display of
command information is considered a component of the flight guidance system (FGS).
Inadvertent A condition or action that was not planned or intended.
Latent Failure A failure is latent until it is made known to the flightcrew or maintenance personnel. A
significant latent failure is one which would, in combination with one or more specific
failures or events, result in a hazardous or catastrophic failure condition.
Limit Flight Envelope The outermost flight envelope of the airplane, normally associated with the limit loads of
the airplane structure.
Minimum Engage Height The minimum height after takeoff at which the flightcrew is permitted to engage the
autopilot. Also referred to as minimum use height takeoff. See “minimum use height.”
Minimum Use Height A height specified during airworthiness demonstration or review above which, under
(MUH) standard or specified conditions, a probable failure of a system is not likely to cause a
significant path displacement unacceptably reducing flight path clearance from specified
reference surfaces (for example, airport elevation) or specified obstacle clearance surfaces.
Minor Transient See “Transient.”
Mode A mode is system configuration that corresponds to a single (or set of) FGS behavior(s).
Mode Reversion An automatic mode change that returns the FGS to a previously engaged mode or to a
pre-determined “default” mode for that condition. This may occur due to several reasons,
such as specific criteria becoming satisfied or because the FGS cannot perform the
currently selected operation. This type of mode change is not requested by the flightcrew
and therefore may be unexpected.
Non-Normal Condition A condition or configuration of the airplane that would not normally be experienced during
routine flight operations-usually due to failures. Also includes unusual airplane ferry
configurations, such as transporting a spare engine or landing gear locked down ferry
flight.
Normal Condition Any fault free condition typically experienced in normal flight operations. Operations
typically well within the aircraft flight envelope, and with routine atmospheric and
environmental conditions.
Normal Flight Envelope The range of altitude and operating speeds that are defined by the airplane manufacturer as
consistent with conducting flight operations for which the airplane is designed. This
envelope is generally associated with practical, routine operation and/or prescribed
conditions, whether all-engine or engine inoperative.
Other Than Normal The summation of rare normal and non-normal conditions.
Condition
Override (of engaged FGS An action taken by the flightcrew intended to prevent, oppose, or alter an operation being
functions) conducted by a flight guidance function, without first disengaging that function.
Rare Normal Condition A fault-free condition that is experienced infrequently by the airplane due to severe
environmental conditions (for example, significant wind, turbulence, or asymmetric icing).
Redundancy The presence of more than one independent means for accomplishing a given function or
flight operation.
Select The flightcrew action of requesting functionality or an end state condition.
Significant Transient See “Transient.”
Stability Augmentation Automatic systems that provide or enhance stability for specific aerodynamic
System characteristics of an airplane (for example, yaw damper, longitudinal stability
augmentation system, Mach trim).
System A combination of components, parts, and elements that are inter-connected to perform one
or more specific functions.
Transient A disturbance in the control or flight path of the airplane that is not consistent with
response to flightcrew inputs or environmental conditions.
Minor Transient: A transient that would not significantly reduce safety margins and which involves
flightcrew actions that are well within their capabilities involving a slight increase in
flightcrew workload or some physical discomfort to passengers or cabin crew.
Significant Transient: A transient that would lead to a significant reduction in safety margins, an increase in
flightcrew workload, discomfort to the flightcrew, or physical distress to passengers or
Page 45
cabin crew, possibly including non-fatal injuries.
Note: The flightcrew should be able to respond to any significant transient without:
• Exceptional piloting skill, alertness, or strength,
• Forces greater than those given in § 25.143(d), and
• Accelerations or attitudes in the airplane that might result in further hazard to
secured or non-secured occupants.
Warning A flight deck indication that alerts the flightcrew to a non-normal operational or airplane
system requiring immediate recognition. Immediate corrective or compensatory action by
the flightcrew is required.
Appendix 3. Acronyms
AC Advisory Circular
ADI Attitude Director Indicator
AFM Airplane Flight Manual
AGL Above Ground Level
AIM Airman's Information Manual
ARP Aerospace Recommended Practice
ATC Air Traffic Control
AWO All Weather Operations
CDI Course Deviation Indicator
CG Center of Gravity
CFR Code of Federal Regulations
CWS Control Wheel Steering
DA Decision Altitude
DA(H) Decision Altitude (Height)
DME Distance Measuring Equipment
EFIS Electronic Flight Instrument System
EVS Enhanced Vision System
FAA Federal Aviation Administration
FCOM Flightcrew Operations Manual
FD Flight Director
FGS Flight Guidance System
FL Flight Level
FMA Flight Mode Annunciator
FMS Flight Management System
GA Go-Around
GBAS Ground-Based Augmentation System
GLS GBAS Landing System
GPWS Ground Proximity Warning System
HDD Head Down Display
HUD Head Up Display
IAS Indicated Airspeed
ICAO International Civil Aviation Organization
ILS Instrument Landing System
IMA Integrated Modular Avionics
IMC Instrument Meteorological Conditions
LNAV Lateral Navigation
LOC Instrument Landing System Localizer
MDA(H) Minimum Descent Altitude (Height)
MLS Microwave Landing System
MSL Mean Sea Level
MSP Mode Select Panel
MUH Minimum Use Height [autopilot]
NAV Navigation
ND Navigation Display
NDB Non Directional Beacon

Page 46
NPRM Notice of Proposed Rulemaking
PAN-OPS Procedures for Air Navigation Services-Operations
PF Pilot Flying
PFD Primary Flight Display
PNF Pilot Not Flying
RNAV Area Navigation
RNP Required Navigation Performance
RTO Rejected Takeoff
RVSM Reduced Vertical Separation Minimum
SAE Society of Automotive Engineers
TCAS Traffic Alert and Collision Avoidance System
TCS Touch Control Steering
TERPS Terminal Instrument Procedures
TO Takeoff
TOGA Takeoff or Go-Around
VDF/ MDF Demonstrated Flight Dive Speed/Demonstrated Flight
Dive Mach
VMO/ MMO Maximum Operating Limit Speed/Maximum Operating
Limit Mach
VR Rotation Speed
VSR Reference Stall Speed (See § 25.103)
V2 Takeoff Safety Speed
VMC Visual Meteorological Conditions
VNAV Vertical Navigation
VOR Very High Frequency Omnirange Station
WAT Weight Altitude Temperature
xLS ILS, MLS, or GLS

Page 47

Printing - SUMMIT - AC 25.1329-1B

Uploaded by

Copyright:

Available Formats

Printing - SUMMIT - AC 25.1329-1B

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Printing - SUMMIT - AC 25.1329-1B

Uploaded by

Copyright:

Available Formats

AC 25.

1329-1B - APPROVAL OF FLIGHT GUIDANCE SYSTEMS

July 17, 2006

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 2. Overview of flight guidance systems (FGS)

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Table 2-1 Cross-References

Paragraph 29, Autothrust Engagement,

Paragraph 30, Override of the FGS

(1) A minor transient would not significantly reduce

(2) A significant transient may lead to a significant

(i) Exceptional piloting skill, alertness, or strength.

(ii) Forces applied by the pilot which are greater than

(iii) Accelerations or attitudes in the airplane that might

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 3. FGS engagement, disengagement, indications, and override

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 4. Controls, Indications, and Alerts

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 5. Performance of Function

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 6. Characteristics of Specific Modes

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

2 Airspeed at engine failure for failures between V2 and V2 + X.

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 7. FGS Integration

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 8. Safety Assessment

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 9. Compliance Demonstration Using Flight Test and Simulation

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Chapter 10. Airplane Flight Manual

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Appendix 1. Safety assessment

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

Printed from Summit Aviation's Digital Aviation Reference Library, 21.01.2015

You might also like