01-5023. Improving Flightcrew Awareness During Autopilot Operation

AGENCY:

Federal Aviation Administration, DOT.

ACTION:

Final policy statement.

SUMMARY:

This document announces an FAA general statement of policy applicable to the type certification of transport category airplanes. This document advises the public, in particular manufacturers of transport category airplanes and automatic flight control (autopilot) systems, that the FAA, when certifying automatic pilot installations, intends to evaluate various items that will improve the flightcrew's awareness during autopilot operation.

FOR FURTHER INFORMATION CONTACT:

Gregg Bartley, Federal Aviation Administration, Transport Airplane Directorate, Transport Standards Staff, Airplane and Flight Crew Interface Branch, ANM 111, 1601 Lind Avenue SW., Renton, WA 98055-4056; telephone [phone]; fax [phone]; e-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

Background

Recent incidents and accidents that have occurred worldwide involving pilot-autopilot interactions have emphasized to the FAA the need to reexamine the current certification policy relative to autopilot issues.

In 1991, the National Transportation Safety Board (NTSB) began an investigation of an incident involving a transport category airplane that experienced an in-flight upset. When the airplane was in cruise at flight level 310, the flightcrew noted that the inertial navigation system “FAIL” lights had illuminated. When the flightcrew cross-checked the instrument panel, they determined that the airplane was in a steep right-wing-down banking angle. The flight lost nearly 10,000 feet of altitude and the airplane approached supersonic speeds before the pilots could complete a recovery. The airplane eventually made a successful landing, and there were no injuries.

Investigation of the incident revealed, among other things, that a failure in the autopilot system could cause an airplane to roll slowly into a banking attitude. The roll rate induced from such a failure of the autopilot system may be barely perceptible to the flightcrew; it also may be difficult to detect without external visual attitude references or continuous close monitoring of the flight attitude instruments.

The NTSB has advised the FAA of its concern that some autopilot failures can result in changes in attitude at rates that may be imperceptible to the flightcrew, and thus remain undetected until the airplane reaches significant attitude deviations.

FAA Evaluation of Flightcrew/Flight Deck Automation Interfaces

In 1994, the FAA launched a study to evaluate all flightcrew/flight deck automation interfaces of current generation transport category airplanes. The FAA chartered a Human Factors Team to conduct the study. Team members included experts from the FAA, the European Joint Airworthiness Authorities (JAA), and academia. The objective of the study was to look beyond the label of “flightcrew error,” and examine the contributing factors from the perspective of design; flightcrew training and qualifications; operations; and regulatory processes. The FAA also tasked the team to develop recommendations to address any problems identified.

With regard to autopilot issues, the Team identified several specific problematic issues, including:

• Pilot/autopilot interactions that create hazardous out-of-trim conditions;
• Autopilots that can produce hazardous speed conditions and may attempt maneuvers that would not normally be expected by a pilot; and
• Insufficient wording in the Airplane Flight Manual regarding the capabilities and limitations of the autopilot.

Regulatory Initiatives

The FAA has acknowledged the autopilot issues raised by both the NTSB and the Human Factors Team, and has taken steps to address them. For example, the FAA has tasked the Aviation Regulation Advisory Committee (ARAC) to review and propose harmonized revisions to the following documents:

• 14 CFR 25.1329 (“Automatic pilot system”), which contains FAA's standards for certifying automatic pilot systems on transport category airplanes;
• 14 CFR 25.1335 (“Flight director systems”), which contains FAA's standards for certifying flight director systems on transport category airplanes; and
• Advisory Circular (AC) 25-1329-1A (“Automatic Pilot Systems Approval,” dated July 8, 1968), which describes an acceptable means by which compliance with the automatic pilot installation requirements of § 25.1329 may be shown.

The work of ARAC currently is in progress.

Current Certification Standards

In general, the FAA has traditionally certified automatic pilot systems on transport category airplanes in accordance with § 25.1329 on the basis that:

• The systems are conveniences to reduce flightcrew workload, and
• The systems do not relieve the flightcrew of any responsibility for assuring proper flight path management.

As a result, the autopilot evaluation criteria contained in AC 25.1329-1A, are chiefly concerned with the effects of autopilot failures on the airplane. The most recent revision to AC 25-7A, “Flight Test Guide for Certification of Transport Category Airplanes,” also defines some evaluation criteria for determining whether the autopilot is performing its intended function of relieving the flightcrew of some of their control functions.

Accordingly, even when the flightcrew is not manually performing a specific flight path control function, the FAA expects the flightcrew to be “aware” when this function is not being performed safely, and to take appropriate and timely corrective action. The installation certification guidelines presented in AC 25.1329-1A, for example, state “* * * at least one pilot [should] monitor the behavior of the airplane and associated autopilot performance at all times.”

In certifying all autopilot systems to date, the FAA has accepted the premise that the capability for this flightcrew “awareness” comes from either:

• Adherence to operational training and/or procedures;
• A dedicated failure detection and annunciation feature on the flight deck; or
• Inherent aircraft operational cues (for example, a perceived change of aircraft attitude or change of engine noise).

As shown by recent relevant accident and incident cases, one cannot assume that the flightcrew will reliably detect and accommodate adverse autopilot behavior solely from inherent operational cues; other cues are needed.

Inherent operational cues can be insufficient because:

1. During normal autopilot operations, the flightcrew may not be able to detect operational cues related to significant changes in aerodynamic characteristics, such as drag and controllability, as effectively as during manual operation. One specific example of this is the change of control response or “feel” during low speed operations as ice accumulates on the airplane surfaces, gradually and imperceptibly reducing control authority. This condition can progress, intangible to the flightcrew, until the autopilot exhausts its control authority and automatically disengages. The flightcrew then is suddenly required to take manual control of the airplane, which (1) is not in proper trim, (2) is at a low margin-to-stall, and (3) has significantly degraded aerodynamic performance.

2. As pointed out by the NTSB, and recognized by the FAA, some autopilot failures can result in changes in attitude at rates that may be imperceptible to the flightcrew, and thus remain undetected until the airplane reaches significant attitude deviations.

Neither the certification standards nor the relevant advisory material currently contain actions or detailed guidance to address these types of situations. Because of this, the FAA has found it necessary and appropriate to provide additional guidelines for the provision of design features needed to enable flightcrew control and awareness of the unintended changes of speed and attitude during the operation of the autopilot system.

Discussion of Proposed Policy Statement

On, August 30, 1999, the FAA issued a proposed general statement of policy (64 FR 49043, September 9, 1999) concerning how the FAA would evaluate various items when certifying automatic pilot installations in transport category airplanes. (A correction was later published on September 20, 1999 (64 FR 50872).) This information, presented in the form of a general statement of policy, was intended to clarify, detail, and formally state items that the FAA:

• Assumes about the flightcrew's awareness capability;
• Employs or accepts on an on-going basis in making compliance findings relative to autopilot systems; and
• Considers frequently in developing a means to prevent recurrences of the accident/incident situations described previously, or to enable an appropriate and timely response to other situations that could result in similar circumstances.

Comments Received in Response to Proposed Policy Statement

The FAA received comments on the proposed policy statement from five commenters. Many of the comments submitted were editorial in nature and did not take issue with the content of the policy itself. We have incorporated most of these editorial changes into the final policy statement where they made the information clearer or corrected typographical errors.

The remainder of the comments were substantive in nature and addressed the correctness, merit, or appropriateness of the policy's technical details. These are discussed below, divided by the issues addressed and by comments related to specific paragraphs of the proposed policy statement.

“Rulemaking by Policy”

One commenter states that the proposed policy statement differs significantly from existing regulatory and advisory material, and constitutes “rulemaking by policy.” This commenter further states that industry would rather see a statement of the issue and defer the exact mechanism to address that issue to the applicant. The commenter suggests that any new direction should be harmonized with the activities of ARAC.

The FAA does not agree with the commenter. With regard to this policy statement being “rulemaking by policy,” all features discussed in the policy statement are covered by the current 14 CFR 25.1309 (especially § 25.1309(c)) and § 25.1329, as well as several other regulations. This policy statement (and the planned revisions to the associated advisory circulars) only defines one possible implementation that would be acceptable to the regulatory authorities when determining compliance with existing regulations. Neither this policy statement nor any current or future advisory circulars define regulations.

The FAA does intend to incorporate all the material described in the policy statement in the upcoming revision of AC 25.1329-1A. Likewise, the European Joint Aviation Authorities (JAA) also plan to incorporate this material into their parallel Advisory Circular Joint (ACJ) 25.1329.

Change in Role of Flightcrew

One commenter states that current autopilot systems have been shown, by operational experience, to be safe. This commenter asserts that the new policy would change the role of the flightcrew, who are currently required to monitor the performance of an engaged autopilot at all times. It could make them more dependent on automatic functions and, thereby, less likely to be constantly monitoring the state of the aircraft.

The FAA does not agree with this commenter. Crew alerting features are intended to increase pilot awareness, not replace or reduce the requirement for crew vigilance and professional aviation skills. Current crew alerting features—such as Enhanced Ground Proximity Warning System, Terrain Awareness and Warning System, Engine Fail Indications, or any other alert on modern transport category aircraft—enhance safety. The autopilot alert described in the policy statement is no different in this respect.

While the autopilot systems currently in service are safe, there have been several serious incidents and accidents of transport category aircraft over the last 10 years that have involved the automatic disconnection of an engaged autopilot when the aircraft was in a mis-trimmed configuration or an unusual attitude. The new features described in the policy statement are in direct response those incidents and accidents.

The FAA does not intend for this policy to alter the roles and responsibilities of the flightcrew as they are currently defined. The autopilot alerts discussed are intended as an added safeguard to a vigilant flightcrew. History has shown that pilots sometimes do miss cues (be they subtle or overt) of a developing or ongoing unusual situation. The accidents and incidents mentioned previously have occurred when an engaged autopilot disconnected automatically during a time when the aircraft was in a significantly mis-trimmed condition or an unusual attitude. These accidents and incidents may have been avoided if that condition had been brought to the attention of the flightcrew prior to the disconnection of the autopilot. The autopilot alert described in the policy statement is intended to preclude a recurrence of accidents and incidents of that type.

Conflict Between Policy and New Advisory Material or Rules

Several commenters suggest that the policy statement should include language specifying that rules or advisory material promulgated as a result of the parallel work of ARAC (and the Flight Guidance Systems Harmonization Working Group) would supersede this or any existing policy statement if there is a conflict between the two.

The FAA does not consider the suggested language necessary. We plan to “cancel” this policy statement when the next revision of AC 25.1329-1A is published. As indicated previously, this policy statement is interim guidance until the new revision of AC 25.1329-1A is issued. Therefore, there is no need for language in the policy statement that would give priority to any specific document.

Comments on Paragraph 2., “Definitions”

One commenter requests the FAA to clarify the definition of “hazardous flight path deviations,” which appeared as paragraph 2.c. in the proposed policy statement. The commenter states that the term “hazardous” is used in multiple ways and this may create confusion.

The FAA finds it appropriate to delete this definition from the final policy statement to avoid confusion. Additionally, the term is not used anywhere else in the policy statement, so its appearance under the heading “Definitions” is not necessary.

Comments on Paragraph 4., “System Response”

Several commenters suggest various changes to proposed paragraph 4. to make it clearer and more consistent with guidance that is already in or planned for inclusion in FAA and JAA advisory material. For example, one commenter suggests that paragraph 4.b. of the proposal be revised to make clear that the autopilot should not be allowed to command unsafe maneuvers, regardless of the ease of recovery. The commenter also suggests that the restrictions on out-of-trim conditions in the event of a manual autopilot disconnect, which were listed in proposed paragraph 4.d., should be added to paragraph 4.c.'s description of the automatic disconnect case. Additionally, the commenter suggests that examples of maneuvers that might be considered “dangerous” be included.

Other commenters state that the text of proposed paragraph 4.d. allows no “credit” for a mis-trim warning and, thus, would require autopilots to have a critical trim function, which most autopilots do not support. Other commenters suggest use of the term “ultimate loads” instead of “limit loads” in proposed paragraph 4.d., because catastrophic failure conditions are normally associated with “ultimate loads,” not “limit loads.” These commenters also suggest using the term “unsafe maneuver” instead of “dangerous maneuver” (as used in proposed paragraph 4.f.), because “dangerous” cannot be explicitly defined.

The FAA has considered these suggestions and has rewritten paragraph 4 with the following specific changes:

• Paragraph 4.a. is unchanged from the proposed version.
• Paragraph 4.b. refers to the autopilot providing guidance or control, as appropriate, for the intended function in a safe and predictable manner.
• Paragraph 4.c. describes the expected system response to the presence of transient flight control movements during non-maneuvering flight and under dynamic conditions.
• Paragraph 4.d. describes the expected system response, relative to significant transient flight control movements, during automatic or manual disengagement of the autopilot.
• Paragraph 4.e. describes the expected system response, relative to significant transients, during other than normal conditions.
• Proposed paragraph 4.f. has been deleted as a result of these changes.

(Note that previous references to “dangerous” maneuvers and to “limit loads” have been deleted from the final text.)

The wording in the final policy statement reflects the text that will appear in the upcoming revision of AC 25.1329-1A.

Comments on Paragraph 5., “Controls, Displays, and Alerting”

Several commenters consider that the autopilot alert defined in paragraph 5.e. of the policy statement constitutes a significant design challenge. First, these commenters point out that paragraphs 5.e.(1) and 5.e.(2) require “the autopilot to remain engaged for some time period after a failure has been detected by a monitor (assuming that a monitor exists to detect all failure conditions).” To these commenters, this appears contrary to safety in almost all failure conditions. Many failure conditions require an immediate automatic disconnection of the autopilot in order to minimize the adverse effects of the failure. If autopilot engagement is maintained for some time after the failure, the undesirable effects of the failure will persist and, consequently, increase the severity of the failure condition.

Second, these commenters point to paragraph 5.e.(4), which lists the conditions for which the flightcrew alert, and possibly automatic disengagement of the autopilot, should be considered. The commenters state that some of the warning conditions listed in that paragraph are within the normal operating flight envelope, and that it would be difficult to provide useful alerts without producing frequent nuisance alarms.

The commenters request clarification on the intent of paragraph 5.e. and the conditions that should or should not result in an automatic disengagement.

The FAA agrees that clarification is necessary. We recognize that any alert must be carefully designed so it does not cause a nuisance alert and, in doing so, precipitate unnecessary crew actions. This policy statement calls for a more advanced (earlier) autopilot alert to increase the flightcrew's awareness of a potentially dangerous condition that the flightcrew might not otherwise detect in a timely manner.

Examples of situations that could warrant advance crew notification are listed in paragraph 5.e.(4) of the policy statement. It is not required that the crew be alerted prior to any automatic disconnect of an engaged autopilot. All failure conditions that require an immediate automatic disconnect, and whose onset cannot be detected prior to the actual failure condition, must still cause an immediate automatic disconnect. No preceding alert is required. We have clarified the wording of the final policy statement in this regard.

Comments on Paragraph 7., “Airplane Flight Manual”

Several commenters consider the detailed list of design specifications contained in paragraph 7 of the proposed policy statement inappropriate for inclusion in an Airplane Flight Manual. One of these commenters states that it is more appropriate for this information to be included in Operations Manuals and training material. Another commenter states that the AFM operating procedures should be limited to only a general description of the autopilot capability. The commenters state that the literal interpretation of what is asked for in this section would require reproduction of extensive logical expressions that are implemented in either hardware or software. These commenters question the usefulness of this information for the flightcrew in actual flight operations.

The FAA agrees somewhat with the commenters. We have revised paragraph 7 in the final policy statement to provide guidance on material that should be provided in the AFM to ensure that the appropriate information related to operation of the flight guidance system is translated into air carrier operations. This information is similar to guidance that will be provided in the upcoming revision to AC 25.1329-1A.

Effect of General Statement of Policy

Much of the information presented in this final policy statement has been developed from service experience garnered and flightcrew conventions practiced throughout the years since the guidance contained in AC 25.1329-1A was published in 1968. The FAA has assembled this information and is presenting it in this general statement of policy as a set of “guidelines” that are appropriate for use with § 25.1329 for autopilot certification.

Additionally, as discussed previously, actions currently are underway to revise the applicable airworthiness standards (§ 25.1329) and associated advisory material (AC 25.1329-1A) to more fully address the autopilot system and other flight deck issues. Until then, the guidance provided in this general statement of policy would serve as a reference to assist in the certification of new autopilot systems.

The general policy stated in this document is not intended to establish a binding norm; it does not constitute a new regulation and the FAA would not apply or rely upon it as a regulation. The FAA Aircraft Certification Offices (ACO) that certify transport category airplanes and/or the automatic pilot systems installed on them should generally attempt to follow this policy, when appropriate. However, in determining compliance with certification standards, each ACO has the discretion not to apply these guidelines where it determines that they are inappropriate. The ACO should coordinate with the Transport Airplane Directorate, for purposes of standardization, whenever the ACO determines that some deviation from this policy is appropriate. Applicants should expect that the certificating officials would consider this information when making findings of compliance relevant to new certificate actions.

Applicants may consider the material contained in this policy statement as supplemental to that currently contained in AC 25.1329-1A when developing a means of compliance with the relevant certification standards.

As with all advisory material, this statement of policy identifies one means, but not the only means, of compliance.

For the convenience of the reader, we have formatted this general statement of policy in outline form.

The General Statement of Policy

1. General

1.a. Operational experience has shown that flightcrews may not have adequate awareness of potentially hazardous aircraft states or adequate capability to anticipate sudden, unexpected actions of the autopilot. In this regard, the autopilot design should take into consideration conditions that could create hazardous deviations in the flight path, specifically (ref: 14 CFR 25.1329(f), “Automatic pilot system”):

• Conditions that could make continued autopilot operation unsafe; or
• Conditions that could cause the manual control of an upset following autopilot disengagement to require exceptional piloting skill or alertness.

Note that automatic disengagement may not be the safest autopilot response for all cases, particularly with trim conditions that could lead to a significant upset.

1.b. If automatic functions are provided that may be used with the autopilot (e.g., automatic thrust control or yaw damper), and use of the autopilot is permitted with any of these functions inoperative, then the design of the autopilot should comply with the provisions of this general policy statement and Advisory Circular 25.1329-1A, “Automatic Pilot Systems Approval” with these functions operative and inoperative.

1.c. The autopilot should perform its intended function in all configurations in which it may be used throughout all appropriate maneuvers and environmental conditions, including turbulence and icing, unless an appropriate operating limitation or statement is included in the Airplane Flight Manual.

2. Definitions

2.a. The term autopilot is synonymous with the term automatic pilot. The term autopilot includes the sensors, computers, power supplies, servo-motors, servo-actuators, and associated wiring necessary for its function. It includes any displays and controls necessary for the pilot to manage and supervise the system.

2.b. The term autothrust is synonymous with the term autothrottle or automatic throttle control.

2.c. The term extremely improbable is defined as the average probability per flight hour of the occurrence of an event (e.g., a failure condition), which is on the order of 1 × 10⁻⁹ or less. Catastrophic failure conditions must be extremely improbable (ref. § 25.1309(b)(1)).

2.d. The term warning is defined as an indication for a hazard requiring immediate corrective action by the flightcrew.

2.e. The term caution is defined as an indication for an event requiring immediate crew awareness and possibly requiring subsequent timely corrective crew action.

3. Design, Installation, and Maintenance

3.a. The autopilot system design should not possess characteristics, in normal operation or when failed, that would degrade safety or lead to an unsafe condition, unless such failures can be limited by design or the effects can be limited and mitigated by the pilot response within a reasonable time. The allowable probability of any failure should be based on its safety effects in accordance with the requirements of § 25.1309.

3.b. Adequate precautions should be taken in the design process, and adequate procedures should be specified in the maintenance manual, to prevent the incorrect installation, connection, or adjustment of parts of the autopilot if such errors would create a hazard to the airplane (e.g., torque clutches or limit switches with a range of adjustment such that maladjustment could be hazardous).

3.c. The autopilot should be designed and installed so that the tolerances demonstrated during certification tests can be maintained in service.

4. System Response

4.a. The autopilot should not cause nuisance oscillations, undue control activity, or sudden large attitude changes, especially when configuration or power changes are taking place. All maneuvers should be accomplished smoothly, accurately, and in a manner similar to normal pilot control.

4.b. The autopilot should provide guidance or control, as appropriate, for the intended function of the active mode(s) in a safe and predictable manner within the normal flight envelope.

4.c. In non-maneuvering flight, the engagement of the autopilot should be free of perceptible transient flight control movement. Under dynamic conditions, including maneuvering flight, some minimal flight control transients may be acceptable if they do not cause significant operational difficulty for the flightcrew or unsafe conditions for the occupants.

4.d. Under normal conditions, automatic or manual disengagement of the autopilot should be free of significant transients or out of trim forces that are not consistent with the maneuvers being conducted by the airplane at the time of disengagement. If multiple autopilots are engaged, any disengagement of an individual autopilot should be free of significant transients and should not adversely affect the operation of the remaining autopilot.

4.e. In other than normal conditions, disengagement of the autopilot may result in a significant transient. The flightcrew should be able to respond to a significant transient without:

• Exceptional piloting skill, alertness, or strength;
• Forces greater than those given in § 25.143 (c); and
• Accelerations or attitudes in the airplane that might result in a hazard to secured or non-secured occupants.

5. Controls, Displays, and Alerting

5.a. Unless the probability of failure of the quick-disconnect button on the control wheel, or equivalent, is shown to be extremely improbable, an alternative means of disengagement, that is readily accessible in flight, should be provided.

5.b. The controls, displays, and alerts should be designed to minimize crew errors.

5.c. Mode, state, status, and malfunction indications should be presented in a manner compatible with the procedures and assigned tasks of the flightcrew. The indications should be grouped in a logical and consistent manner and be visible from each pilot's station under all expected lighting conditions.

5.d. Autopilot Disconnect Warning:

5.d.(1) Disengagement of the autopilot, whether intended by the pilot or not, should trigger both an aural alert and visual warning during any phase of flight, since immediate pilot action is required.

5.d.(2) The aural alert associated with the autopilot disconnect should be unique and distinct. The aural alert should be cancelable by the pilot pushing the quick-disconnect button on the control wheel or stick. The aural alert should sound until cancelled by the pilot, except that a minimum cycle should sound. If the autopilot is disengaged by means of the quick-disconnect button, then an additional push of this button should be required to cancel the aural alert.

5.e. An aural alert and a visual caution should be provided to the flightcrew for conditions that:

• Could make continued autopilot operation unsafe, or
• Could cause the manual control of an upset following autopilot disengagement to require exceptional piloting skill or alertness.

5.e.(1) The flightcrew alert should be generated before the conditions lead to a situation that could require exceptional piloting skill or alertness, such as an automatic disconnect while the airplane is in an unusual attitude, significantly out of trim, or near stall warning.

5.e.(2) Whenever possible, the alert should provide the flightcrew enough time to be prepared to place their hands on the controls and to take appropriate corrective action (e.g., change thrust, set trim, disconnect autopilot).

5.e.(3) The thresholds for triggering the flightcrew alert should be designed carefully, with consideration for undue distraction (e.g., nuisance alerts) and potential “rippling” of multiple alerts triggered by the same or related conditions, which could mask or override the sounding of this alert.

5.e.(4) Conditions that should be considered for a flightcrew alert and possibly automatic disengagement include, but are not limited to:

• Limits of autopilot control authority;
• Out-of-trim;
• Excessive trim rates;
• Airspeeds greater than those intended for autopilot operations;
• Low speeds (e.g., less than 1.2 V_S1 for the current flap configuration, but greater than 1.07 V_S); and
• Bank and pitch angles beyond those intended for autopilot operation.

5.e.(5) Detected failure conditions that require an immediate autopilot disconnect, such as a fault within the autopilot processing unit or a failed autopilot servo, do not require an alert to be displayed prior to automatic disconnection. Only those conditions that are sustained and/or build up over time such that an advance warning could be given to the flightcrew prior to automatic autopilot disengagement (e.g., the autopilot close to its maximum authority in the roll axis for a specific period of time), or conditions that would not by themselves cause an automatic autopilot disengagement, are candidates for an alert.

5.f. The means provided to comply with § 25.1329(h) (mode indications when coupled with airborne navigation equipment) should also give an appropriate indication when:

5.f.(1) The autopilot cannot engage the mode selected by the flightcrew; and

5.f.(2) The system automatically makes a mode change or mode disengagement that is considered operationally significant and, perhaps, unexpected. (For example, a change from altitude capture to altitude hold is significant, but expected; while a change from vertical path mode to vertical speed mode is both operationally significant and unexpected.)

5.g. If the autopilot has envelope limiting or protection capability, the system should provide an alert to indicate to the pilots when envelope limiting or protection is invoked and the condition is sustained and/or flightcrew action is necessary.

6. Engagement

If a flight director is available and active, the autopilot should engage in the same mode as the flight director and provide consistent flight path guidance.

7. Airplane Flight Manual (AFM)

The following paragraphs provide guidance on material to be provided in the Airplane Flight Manual (AFM) to ensure that the appropriate information related to flight guidance system (FGS) operation is translated into air carrier operations. For additional guidance, note that FAA Advisory Circular (AC) 25.1581-1 (“Airplane Flight Manual,” dated July 14 1997) addresses requirements of the AFM for transport category aircraft and distinguishes between those aircraft that are used in air carrier operations and those not in air carrier service. The terminology used in the AFM should be consistent with the intended operational use. Appropriate AFM information related to low-visibility operations is addressed in:

• AC 120-28D, “Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout,” and
• AC 120-29A, “Criteria for Approving Category 1 and Category II Landing Minima for FAR 121 Operators.”

7.a. Limitations. The Limitations section of the AFM presents those FGS operating limitations appropriate to the airplane model as established in the course of the type certification process, and as necessary. The FGS operational limitations (should any exist) should specify, but not be limited to, the following:

• Minimum engagement altitude(s) or height(s), if and when necessary.

Note:

If Minimum Engagement Altitude(s) or height(s) are not specified, then “maximum displacement deviation” information from a pertinent takeoff flight path and approach profile should be provided in the AFM Normal Procedures section, or in the associated Flight Crew Operation Manual (FCOM).

• Mandatory disengagement requirements, if necessary.
• Configuration/envelope restrictions, if and as applicable.

7.b. Abnormal/Emergency Procedures. Any FGS anomaly that is addressed to the flight crew by a non-normal procedure must be included in the AFM.

7.c. Normal Procedures.

7.c.(1) General. The normal procedures for use of the FGS should be documented in the AFM or Flight Crew Operation Manuals (FCOM), as appropriate. These procedures should be demonstrated during the type certification process. In lieu of specification of minimum engagement altitude(s) or height(s), the AFM may alternately specify “maximum displacement deviations” from a specified takeoff flight path, or from a specified approach profile. This information may be based on typical departure or approach flight paths suited for the aircraft type and for and failure conditions that are determined applicable to the type of FGS system and modes suitable for use.

7.c.(2) Aircraft with Published Flight Crew Operation Manuals (FCOM). Airplane Flight Manuals for aircraft for which the manufacturer has published FCOM's should contain essential information on normal operating procedures that are considered “peculiar” to the operation of the FGS for the aircraft type or are otherwise necessary for safe operation. System description, specification, and operational procedures that are normally associated with flight guidance systems may be described in the FCOM.

7.c.(3) Aircraft without Published FCOM's. For aircraft that rely on the AFM as the sole operating manual, the AFM should contain operating information sufficient for crew reference. System description, operation, checklists, and normal operating procedures should be amplified in sufficient detail so that an appropriately trained flight crew may operate the FGS under normal conditions.

Conclusion

As discussed previously, the FAA intends to update 14 CFR 25.1329 and associated Advisory Circular (AC) 25.1329-1A to more fully address the autopilot issues found in this general statement of policy and others. Until then, this general statement of policy serves as a reference to supplement § 25.1329, and for use in the certification of new autopilot systems. Please inform the appropriate flight controls and systems designated engineering representatives (DER) of this proposed general statement of policy.

Issued in Renton, Washington, on February 22, 2001.

D.L. Riggin,

Acting Manager, Transport Airplane Directorate, Aircraft Certification Service.