Flightcrew situation awareness issues included vulnerabilities in, for example:

The team concluded that these vulnerabilities exist because of some interrelated deficiencies in the current aviation system:

Not all widereaching problems uncovered by the human factors team listed above can be corrected in one rulemaking project. The safety issues addressed in this proposal are the following:

Function of the Flight Guidance System

The FGS is intended to assist the flightcrew in the basic control and guidance of the airplane. The FGS provides workload relief to the flightcrew and a means to more accurately fly an intended flight path. The following functions make up the flight guidance system:

1. Autopilotautomated airplane maneuvering and handling capabilities.

2. Autothrustautomated propulsion control.

3. Flight Directorthe display of steering commands that provide vertical and horizontal path guidance, whether displayed ``heads down'' or ``heads up.'' A heads up display is a flight instrumentation that allows the pilot of an airplane to watch the instruments while looking ahead of the airplane for the approach lights or the runway.

Flight guidance systems functions also include the flight deck alerting, status, mode annunciations (instrument displays), and any situational information required by those functions displayed to the flightcrew. Also included are those functions necessary to provide guidance and control with an approach and landing system, such as:

The FGS definition does not include flight planning, flight path construction, or any other function normally associated with a Flight Management System (FMS).

Statement of the Problem

Several NTSB safety recommendations, as well as the FAA study discussed above, have highlighted flight guidance system
vulnerabilities. The current regulations (Sec. 25.1329) regarding flight guidance systems address only the autopilot system, except for one specific regulation regarding the flight director switch position (Sec. 25.1335). Not addressed is the autothrust system, and how it relates to flight guidance. Therefore, there is a need to consolidate and standardize regulations for all flight guidance system functionality (autopilot, autothrust, and flight director).

Also needed is an updating of existing regulations to match technology advances. Current regulations do not fully address the latest technology or new functionality available. In addition, proposed and recent rulemaking activity, such as the interaction of systems and structure, flight test, and human factors, will make certain aspects of the existing flight guidance systems regulations redundant, in conflict with other regulations, or confusing and difficult to understand.

Finally, there is a need to harmonize regulations between the FAA and the Joint Aviation Authorities (JAA) that would not only benefit the aviation industry economically, but also maintain the necessary high level of aviation safety.

NTSB Recommendations

Safety recommendations issued by the NTSB in recent years that highlight vulnerabilities in the flight guidance systems of today's transport airplanes are listed below:

In the United States, the airworthiness standards for type certification of transport category airplanes are contained in Title 14, Code of Federal Regulations (CFR) part 25. Manufacturers of transport category airplanes must show that each airplane they produce of a different type design complies with the appropriate part 25 standards. These standards apply to:

What Are the Relevant Airworthiness Standards in Europe?

In Europe, the airworthiness standards for type certification of transport category airplanes are contained in Joint Aviation Requirements (JAR)25, which are based on part 25. These were developed by the Joint Aviation Authorities (JAA) of Europe to provide a common set of airworthiness standards within the European aviation community. Thirtyseven European countries accept airplanes type certificated to the JAR25 standards, including airplanes manufactured in the U.S. that are type certificated to JAR25 standards for export to Europe. What Is ``Harmonization'' and How Did It Start?

Although part 25 and JAR25 are very similar, they are not identical in every respect. When airplanes are type certificated to both sets of standards, the differences between part 25 and JAR25 can result in substantial added costs to manufacturers and operators. These added costs, however, often do not bring about an increase in safety. Often, part 25 and JAR25 may contain different requirements to accomplish the same safety intent. Consequently, manufacturers are usually burdened with meeting the requirements of both sets of standards without a corresponding increase in the level of safety.

Recognizing that a common set of standards would not only benefit the aviation industry economically, but also maintain the necessary high level of safety, the FAA and the JAA began an effort in 1988 to ``harmonize'' their respective aviation standards. The goal of the harmonization effort is to ensure that:

The FAA and JAA have identified many significant regulatory differences (SRD) between the wording of part 25 and JAR25. Both the FAA and the JAA consider ``harmonization'' of the two sets of standards a high priority.

What Is the European Aviation Safety Authority?

The new European Aviation Safety Authority (EASA) was established and formally came into being on September 28, 2003. The JAA worked with the European Commission (EC) to develop a plan to ensure a smooth transition from JAA to EASA. As part of the transition, the EASA will absorb all functions and activities of the JAA, including its efforts to harmonize JAA regulations with those of the U.S. This rule is a result of the FAA and JAA harmonization rulemaking activities. These JAR standards have already been incorporated into the EASA ``Certification Specifications for Large Aeroplanes'' CS25, in similar if not identical language. The EASA CS25 became effective October 17, 2003.

What Is ARAC and What Role Does It Play in Harmonization?

After initiating the first steps towards harmonization, the FAA and JAA soon realized that traditional methods of rulemaking and accommodating different administrative procedures was neither sufficient nor adequate to make appreciable progress towards fulfilling the harmonization goal. The FAA identified the Aviation Rulemaking Advisory Committee (ARAC) as an ideal resource for assisting in resolving harmonization issues, and, in 1992, the FAA tasked ARAC to undertake the entire harmonization effort.

The FAA had formally established ARAC in 1991 (56 FR 2190, January 22, 1991), to provide advice and recommendations concerning the full range of the FAA's safetyrelated rulemaking activity. The FAA sought this advice to develop better rules in less overall time and using fewer FAA resources than previously needed. The committee provides the FAA firsthand
[[Page 50243]]
information and insight from interested parties regarding potential new rules or revisions of existing rules.

There are 74 member organizations on the committee representing a wide range of interests within the aviation community. Meetings of the committee are open to the public, except as authorized by section 10(d) of the Federal Advisory Committee Act.

The ARAC establishes working groups to develop recommendations for resolving specific airworthiness issues. Tasks assigned to working groups are published in the Federal Register. Although working group meetings are not generally open to the public, the FAA solicits participation in working groups from interested members of the public who possess knowledge or experience in the task areas. Working groups report directly to the ARAC, and the ARAC must accept a working group proposal before ARAC presents the proposal to the FAA as an advisory committee recommendation.

The activities of the ARAC will not, however, circumvent the public rulemaking procedures; nor is the FAA limited to the rule language ``recommended'' by ARAC. If the FAA accepts an ARAC recommendation, the agency proceeds with the normal public rulemaking procedures. Any ARAC participation in a rulemaking package is fully disclosed in the public docket.

This rulemaking has been identified as a ``fast track'' project. Further details on the Fast Track Program can be found in the tasking statement (64 FR 66522, November 26, 1999) and the first NPRM published under this program, Fire Protection Requirements for Powerplant Installations on Transport Category Airplanes (65 FR 36978, June 12, 2000).
What Are the Current 14 CFR and JAR Standards, Certification Specifications for Large Airplanes?

The current text of 14 CFR 25.1329 (amendment 2546) is: Sec. 25.1329 Automatic pilot system.
(a) Each automatic pilot system must be approved and must be designed so that the automatic pilot can be quickly and positively disengaged by the pilots to prevent it from interfering with their control of the airplane.
(b) Unless there is automatic synchronization, each system must have a means to readily indicate to the pilot the alignment of the actuating device in relation to the control system it operates. (c) Each manually operated control for the system must be readily accessible to the pilots.
(d) Quick release (emergency) controls must be on both control wheels, on the side of each wheel opposite the throttles.
(e) Attitude controls must operate in the plane and sense of motion specified in Sec. Sec. 25.777(b) and 25.779(a) for cockpit controls. The direction of motion must be plainly indicated on, or adjacent to, each control.
(f) The system must be designed and adjusted so that, within the range of adjustment available to the human pilot, it cannot produce hazardous loads on the airplane, or create hazardous deviations in the flight path, under any condition of flight appropriate to its use either during normal operation, or in the event of a
malfunction, assuming that corrective action begins within a reasonable period of time.
(g) If the automatic pilot integrates signals from auxiliary controls or furnishes signals for operation of other equipment, there must be positive interlocks and sequencing of engagement to prevent improper operation. Protection against adverse interaction of integrated components, resulting from a malfunction, is also required.
(h) If the automatic pilot system can be coupled to airborne navigation equipment, means must be provided to indicate to the flight crew the current mode of operation. Selector switch position is not acceptable as a means of indication.

The current text of 14 CFR 25.1335 (amendment 2541) is: Sec. 25.1335 Flight director systems.

If a flight director system is installed, means must be provided to indicate to the flight crew its current mode of operation. Selector switch position is not acceptable as a means of indication.

The current text of JAR 25.1329 (Change 15) is:
JAR 25.1329 Automatic Pilot System.
(a) Each automatic pilot system must be approved and must be designed so that the automatic pilot can be quickly and positively disengaged by the pilots to prevent it from interfering with their control of the aeroplane.
(b) Unless there is automatic synchronization, each system must have a means to readily indicate to the pilot the alignment of the actuating device in relation to the control system it operates. (c) Each manually operated control for the system must be readily accessible to the pilots.
(d) Quick release (emergency) controls must be on both control wheels, on the side of each wheel opposite the throttles.
(e) Attitude controls must operate in the plane and sense of motion specified in JAR 25.777(b) and JAR 25.779(a) for cockpit controls. The direction of motion must be plainly indicated on, or adjacent to, each control.
(f) The system must be designed and adjusted so that, within the range of adjustment available to the human pilot, it cannot produce hazardous loads on the aeroplane, or create hazardous deviations in the flight path, under any condition of flight appropriate to its use, either during normal operation, or in the event of a
malfunction, assuming that corrective action begins within a reasonable period of time.
(g) If the automatic pilot integrates signals from auxiliary controls or furnishes signals for operation of other equipment, there must be positive interlocks and sequencing of engagement to prevent improper operation. Protection against adverse interaction of integrated components, resulting from a malfunction, is also required.
(h) Means must be provided to indicate to the flight crew the current mode of operation and any modes armed by the pilot. Selector switch position is not acceptable as a means of indication. (i) A warning must be provided to each pilot in the event of automatic or manual disengagement of the automatic pilot. (See JAR 25.1322 and its AMJ.)

The current text of JAR 25.1335 (Change 15) is:

JAR 25.1335 Flight Director Systems.

Means must be provided to indicate to the flight crew the current mode of operation and any modes armed by the pilot. Selector switch position is not acceptable as a means of indication. What Are the Differences in the Standards and What Do Those Differences Result In?

The only appreciable difference between the U.S. and European rules is that the JAR requires a warning to each pilot in the event of automatic or manual disengagement of the automatic pilot. This requirement does not appear in 14 CFR 25.1329. American manufacturers have been providing such a warning, however, as part of compliance with 14 CFR 25.1309, which requires that warning information be provided to alert the crew to unsafe operating conditions. There is a minor difference in the sounding period of the warning provided in American and Europeanmanufactured airplanes that has resulted from differences in advisory materials and accepted practice, and that difference does affect certification. The harmonization of this rule (and accompanying advisory material) would remove that difference.
What, if Any, Are the Differences in the Means of Compliance?

Compliance with the Sec. 25.1329 rule has largely followed the advisory material found in FAA AC 25.13291A, dated July 8, 1968, or in JAA Advisory Circular Joint (ACJ) 25.1329. Advances in autopilot technology have outpaced both the FAA guidance and the more current JAA ACJ 25.1329 material. Autopilotrelated issue papers and interim policy have been used to fill these gaps in the regulatory and acceptable means of compliance material.

The regulations are applied in certification and validation of products. To market Americanmanufactured airplanes in Europe, the applicant must meet the requirements of part 25 and
[[Page 50244]]
JAR25. As a result, the certification is typically done to the more stringent JAR25 requirement.

Related Activity

Under the ARAC rulemaking process, the FAA provides ARAC with an opportunity to review, discuss, and comment on the FAA's draft NPRM. For this rulemaking, ARAC recommended several changes to the NPRM. (A more detailed discussion of this process appears later in this document.) The FAA agrees with some of those recommendations and has revised the NPRM accordingly. However, we disagree with others, and those recommendations, and our reasons for disagreeing are described below in the Discussion of the Proposal section.
Discussion of the Proposal

What Is the General Scope of the Proposal?

The proposed change would revise, reorganize, and add additional material to Sec. 25.1329. This change would address the autopilot, autothrust, and flight director in a single section. It would change the name of Sec. 25.1329 from ``Automatic pilot system'' to ``Flight guidance system'' to reflect the inclusion of autothrust and flight director. This proposed rule would cover the portion of the Heads Up Display (HUD) that contains flightguidance information displayed to the pilot while manually flying the airplane. Other aspects of HUDs are covered by various regulations that govern flight deck displays and navigation information. This ensures consistency between the Heads Up and Heads Down flightguidance information displayed in the flight deck.

The proposed change would incorporate new requirements specifically to target potential pilot confusion about automatic mode reversions, hazardous disengagement transients, speed protection, and potential hazards during an autopilot override. The proposed change would remove Sec. 25.1335, ``Flight director systems,'' and would amend Sec. 25.1329 to add a new paragraph (i).
How Does the Changed Product Rule (CPR) (Sec. 21.101Designation of Applicable Regulations) Relate to This Change?

The CPR must be considered when updating or adding a flight guidance system. If a proposed change to a flight guidance system is part of a significant product change, then Sec. 21.101(a) is applicable unless one of the other exceptions of Sec. 21.101(b) applies. Section 21.101(a) states that ``An applicant for a change must show that the changed product complies with the airworthiness requirements applicable to the category of the product in effect on the date of the application for the change and with parts 34 and 36 of this chapter.'' If a flight guidance system change is categorized as (or is part of) a product change that is not significant, then the applicable regulation would be Sec. 21.101(b), which states that ``an applicant may show that the changed product complies with an earlier amendment of a regulation required by paragraph (a) of this section.'' The operative question used to determine whether a change is significant or not is, ``Does the change invalidate the original design and certification assumptions at the product level?'' If the answer is ``yes,'' an applicant must comply with the latest regulations, in accordance with Sec. 21.101(a) unless one of the other exceptions of Sec. 21.101(b) applies. If the answer is ``no,'' an applicant may show that the product meets an earlier amendment of the regulation, provided the earlier amendment has been determined by the FAA to be adequate.

Advisory Circular 21.1011, Change 1, further discusses how to evaluate whether a change made to a previously certified product is significant or not significant. Appendix 1 gives several examples involving autopilot systems for part 23 and part 25 aircraft. (The reference to part 23 aircraft is helpful in making a determination of significance because the examples given in AC 21.1011 for autopilots in that section are much more descriptive than those provided in the part 25 examples.)

The FAA's position on the Changed Product Rule is documented in Sec. 21.101 and AC 21.1011. The only time a change may be considered a ``significant change'' is when a substantially new function is included to an already certified product. The AC gives the initial addition of an autoland system as an example of a significant change. That addition invalidates the original design assumptions and certification basis for that airplane. Therefore, for the changed system, an applicant would be required to comply with the regulations in effect on the date of the application. If, on the other hand, an applicant is updating an airplane by replacing an old, analogbased technology autopilot system with a new digital technology autopilot, that change, by itself is considered not significant. The original configuration of the airplane has not been changed and the certification assumptions remain valid. In that case, representative of a change made under a supplemental type certificate (STC), the applicant may choose to use a previous amendment of the regulations, as it applies to the autopilot system. The applicant cannot use an amendment level in effect any earlier than the time of the original certification of the product, but it can use one earlier than the ones in effect at the time of application for the STC.

An exception would be when making a change to the autopilot system as part of a larger change, such as an update of the flight deck from analog ``steam gauges'' to a modern flight deck with large displays, an addition of a flight management system, for example. The overall change to the airplane may be, in total, categorized as a significant change. In that case, the regulations in effect on the date of application would apply to the flight guidance system, as well as to the rest of the flight deck upgrade.

The FAA provided this guidance to help clarify when a flight guidance system change may be considered significant for addressing the Changed Product Rule (Sec. 21.101). However, the FAA did not consider those potential certification projects in the economic evaluation for this proposed rule. While a change may be determined significant under Sec. 21.101, one of the additional exceptions in that rule is that the applicant may show that complying with the latest requirement is impractical (Sec. 21.101(b)(3)). One method to show that complying with the latest requirement is impractical is to show that applying the latest amendment of the rule would result in added resource requirements that are not commensurate with safety benefits. That method is further discussed in paragraph 8c(2)(b) and Appendix 2 of AC 21.1011.

The FAA assumes that those applicants proposing significant changes would not use the latest amendment of the flight guidance system rule if it was determined to be impractical. So, all such applications of the latest amendment will occur only if it is cost beneficial. Therefore, the final conclusions from the economic evaluation of this proposed rule would not be affected by considering the economic impact of flight guidance system changes. The applicant and the FAA may consider the question of whether or not complying with the latest amendment of the rule is impractical during the certification of a changed product.

What Are the Specific Proposed Changes?

This action would change the name of Sec. 25.1329 and remove Sec. 25.1335. It would revise paragraphs (a) through (h),
[[Page 50245]]
and add new paragraphs (i) through (m) of Sec. 25.1329.

Proposed Sec. 25.1329(a)

Paragraph (a) would be revised to contain the requirements relative to quick disengagement controls and their placement on both control wheels for easy accessibility [currently contained in paragraphs (a), (c) and (d)]. Requirements for quick and easily accessible disengagement controls for the automatic thrust systems would be added. These requirements would meet the recognized need for the pilot to be able to disengage the autothrust system during a high workload condition without moving his or her hands from the primary controls and throttle levers, a situation that would hinder task performance. The phrase ``or equivalent'' would be added after the reference to the control wheel. This is because some FGS designs would feature flight deck controls other than the traditional control wheels as the pilot's primary control mechanism.

Proposed Sec. 25.1329(b)

Paragraph (b) would be revised to add a new requirement that would address the specific failure of the disconnect switch(es). Paragraph (b) would mandate that designers and manufacturers must assess what would happen if a system fails to disengage the autopilot or autothrust when the pilot manually commands them. That failure would then have to be addressed in relation to Sec. 25.1309 which requires that a warning be provided to alert the crew to unsafe system operating conditions, and to enable them to take appropriate corrective action. The entire FGS must be evaluated to show compliance with Sec. 25.1309. If the Sec. 25.1309 assessment asserts that the aircraft can be landed manually with the autopilot or autothrust system engaged, then this should be demonstrated during a flight test.

Proposed Sec. 25.1329(c), (d), and (e)

Current paragraphs (c), (d) and (e) would be revised to provide updated standards for transients for FGS engagement, switching, and normal and otherthannormal (rare normal and nonnormal)
disengagements. The current paragraph (b) addresses the need to limit transients during engagement, disengagement, and mode changes of the autopilot system. Current paragraph (b) is technically obsolete and does not have any bearing on modern autopilot systems. The intent of the current paragraph (b) regulation would be encompassed in revised paragraphs (c), (d), and (e).

Use the following definitions when determining compliance with proposed paragraphs (c), (d), and (e). The definitions of minor and significant transients are part of the proposed rule text. They are included here for completeness and understandability.

Transient: A disturbance in the control or flight path of the airplane that is not consistent with response to flight crew inputs or current environmental conditions.

Minor transient: A transient that would not significantly reduce safety margins, and which involves flightcrew actions that are well within their capabilities involving a slight increase in flightcrew workload or some physical discomfort to passengers or cabin crew.

Significant transient: A transient that would lead to a significant reduction in safety margins, a significant increase in flightcrew workload, discomfort to the flightcrew, or physical distress to passengers or cabin crew, possibly including nonfatal injuries. The flightcrew are able to respond to any significant transient without:

1. Exceptional piloting skill, alertness, or strength,

2. Forces greater than those given in Sec. 25.143(c), and

3. Accelerations or attitudes in the airplane that might result in further hazard to secured or nonsecured occupants.

The definition of a ``minor transient'' correlates to the definition provided in Advisory Circular 25.13091A of a ``minor failure condition.'' Section 25.1309 addresses failure conditions. Therefore, the term ``minor transient'' used in Sec. 25.1329 cannot be directly related to the hazard classification used in Sec. 25.1309, as the transients may or may not have anything to do with failure conditions. However, the concept for a result of a minor transient can be correlated to a failure condition that result in a minor hazard in Sec. 25.1309. Similarly, the definition of a ``significant transient'' correlates to the definition of a ``major failure condition'' defined in the same AC. A transient larger than significant corresponds to a hazardous or catastrophic failure condition. In this way, the transient response of the flight guidance system can be correlated to well understood hazard classifications provided by Sec. 25.1309 and AC 25.13091A.

The terms ``minor transient'' and ``significant transient,'' are not absolute, that is, there is not always an unequivocally ``correct/ incorrect'' or ``yes/no'' answer to each item being evaluated. They are dependent on the specific airplane type being evaluated. An example of this might be acceleration levels (also known as ``g'' forces) experienced by the cabin occupants inside a small commuter airplane during a transient. This transient, based on the criteria above, is determined to be significant. The ``g'' forces during this transient were measured to be a certain value. However, an identical ``g'' force value experienced by a jumbo transport category airplane during a transient does not necessarily mean that this transient must also be categorized as a significant transient. Other possible mitigating factors, such as those listed in the definition of ``significant transient'' above, should also be included in the evaluation. As with other terms used in Sec. 25.1329, each case must be assessed individually, with consideration given to factors considered appropriate for that specific case.

Proposed paragraphs (c), (d), and (e) have been revised from the original ARAC proposal. The original proposed paragraphs read as follows:
(c) Engagement or switching of the flight guidance system, a mode, or a sensor must not produce a significant transient response affecting the control or flight path of the airplane.
(d) Under normal conditions, the disengagement of any automatic control functions of a flight guidance system must not produce any significant transient response affecting the control or flight path of the airplane, nor require a significant force to be applied by the pilot to maintain the desired flight path.
(e) Under other than normal conditions, transients affecting the control or flight path of the airplane resulting from the
disengagement of any automatic control functions of a flight guidance system must not require exceptional piloting skill or strength to remain within, or recover to, the normal flight envelope.

The FAA has revised the ARAC report for proposed paragraphs (c), (d), and (e) of Sec. 25.1329. The ARAC proposed paragraphs (c) and (d) did not allow a significant transient. There was no distinction made between the lesser transients allowed by proposed paragraphs (c) and (d) and the more substantial transient allowed by proposed paragraph (e). Therefore, proposed paragraphs (c) and (d) are revised to not allow anything more than a minor transient. The definition of ``minor transient'' is contained in proposed paragraph (c). Proposed paragraph (e) is revised to refer to the significant transient, and that term is then defined. These changes allow proposed rule paragraphs (c) and (d) to be independent of proposed rule paragraph (e).

[[Page 50246]]

Another change that was made to the original ARAC recommendation was to include the definitions for ``minor transient'' and ``significant transient'' in the rule text. The ARAC preferred to have these definitions included in the advisory material, rather than attempt to define very complicated technical terms in a way that can be included in a rule paragraph. An FAA advisory circular describes an acceptable means for showing compliance with the requirements. The guidance is neither mandatory nor regulatory in nature. The AC may explain or define what specific rule language means. One option would be to put these definitions in the preamble. This may be acceptable from a legal standpoint, as the preamble can be used to interpret or explain the rule language. However, for these particular rule paragraphs, the FAA finds that the rule will be more clear and effective if these definitions are included in the rule text. These concepts are difficult to grasp and do not have universally understood definitions. The FAA considers that an applicant is better served to have these terms defined within the rule text, rather than have an applicant research these terms.

Also, the original proposal for paragraph (e) referred to ``other than normal conditions.'' This is revised for clarity to ``rare normal and nonnormal conditions.'' The ARAC discussed and accepted these proposed changes.

Proposed paragraphs (c), (d), and (e) use the terms ``normal conditions,'' ``rare normal conditions,'' and ``nonnormal
conditions.'' ``Rare normal'' refers to challenging environmental operating conditions that are not normally encountered during routine service of the airplane. The proposed terms ``normal'' and ``rare normal'' are not intended to imply a specific probability of these events occurring. ``Rare normal'' is within the normal operating envelope of the airplane and encompasses all foreseeable operating conditions. ``Rare normal'' is intended to make a distinction regarding the severity of the environmental and operational conditions encountered, not the probability of encountering those conditions, from those contained in the ``normal'' conditions. The proposed term ``non normal conditions'' refers to failure conditions, both of the FGS and of other airplane systems. Note that with these definitions, ``rare normal conditions'' and ``nonnormal conditions'' are two different concepts. That is, ``rare normal'' is not a subset of ``nonnormal'' conditions. They can both be grouped under the term ``other than normal conditions.''

The following table gives examples of what constitutes ``normal,'' ``nonnormal'' and ``rare normal'' conditions. It does not fully define every condition that may be encountered during an airplane's life and clearly categorize that condition. Rather, the table is intended to explain the intent of the rule language. There will always be, by the nature of the phenomena involved, some subjectivity to these categorizations. In addition, the same conditions may affect different airplane models in very different ways. These differences should be considered in determining how to characterize the severity of the conditions discussed below.

The three categories of operating conditions as discussed in this proposed rule are the following:

Normal Conditions

No failure conditions.... All airplane systems that are associated with airplane performance are fully operational. Failures of those systems could impair the flight guidance system's ability to perform its functions.

Light to moderate winds.. Constant wind in a specific direction that may cause a slight deviation in intended flight path or a small difference between airspeed and groundspeed.

Light to moderate wind Variation in wind velocity as a function gradients. of altitude, position, or time, which may cause slight erratic or unpredictable changes in intended flight path.

Light to moderate gusts.. Nonrepetitive momentary changes in wind velocity that can cause changes in altitude and/or attitude to occur, but the aircraft remains in positive control at all times.

Light turbulence......... Turbulence that momentarily causes slight, erratic changes in altitude and/ or attitude (pitch, roll, or yaw).

Moderate turbulence...... Similar to light turbulence but of greater intensity. Changes in altitude and/or attitude occur but the aircraft remains in positive control at all times.

Light chop............... Turbulence that causes slight, rapid, and somewhat rhythmic bumpiness without appreciable changes in altitude or attitude.

Moderate chop............ Similar to light chop but of greater intensity. It causes rapid bumps or jolts without appreciable changes in aircraft altitude or attitude.

Icing.................... All icing conditions covered by 14 CFR Part 25, Appendix C, with the exception of ``asymmetric icing'' discussed under ``Rare Normal Conditions'' below. Rare Normal Conditions

Significant winds........ Constant wind in a specific direction that may cause a large change in intended flight path or groundspeed, or cause a large difference between airspeed and groundspeed.

Significant wind Variation in wind velocity as a function gradients. of altitude, position, or time, which may cause large changes in intended flight path.

Windshear/microburst..... A wind gradient of such magnitude that it may cause damage to the aircraft.

Large gusts.............. Nonrepetitive momentary changes in wind velocity that can cause large changes in altitude and/or attitude to occur. Aircraft may be momentarily out of control.

Severe turbulence........ Turbulence that causes large, abrupt changes in altitude or attitude. It usually causes large variations in indicated airspeed. Aircraft may be momentarily out of control.

Asymmetric icing......... Icing conditions that result in ice accumulations that cause the flight guidance system, if engaged, to counter the aerodynamic effect of the icing conditions with a sustained pitch, roll, or yaw command that approaches its maximum authority.

NonNormal Conditions

Significant fuel Large variation of the amount of fuel imbalance. between the two wing tanks (and center and tail tanks, if so equipped) that causes the flight guidance system, if engaged, to counter the aerodynamic effect of the fuel imbalance with a pitch, roll, or yaw command that is approaching maximum system authority. [[Page 50247]]

Asymmetric lift or drag.. Asymmetric lift between the left and right wings due to high lift or primary flight control system failures, or damage to the aerodynamic surfaces on wing or tail.

Inoperative engine(s).... Loss of one or more engines that causes the flight guidance system, if engaged, to counter the aerodynamic effect of the difference in thrust with a pitch, roll, or yaw command that is approaching maximum system authority.

Loss of one or more Loss of one or more hydraulic systems, hydraulic systems. down to the minimum amount of remaining operational systems that the FGS is certified to operate.

Inoperative ice detection/ Loss of ice detection/protection system protection system. on an airplane so equipped, in a situation where the FGS is certified for operation in icing conditions with that failure present.

The intent of these proposed paragraphs is that all FGS function disconnects, both manual and automatic, result in the least disturbance to the flight path of the airplane possible. Under more adverse operating conditions, a larger transient may be impossible for the FGS by itself to prevent. Proposed paragraph (e) recognizes that the FGS will not be able to cope as well in these adverse conditions as they might in the relatively benign, nofailure conditions defined in proposed paragraph (d). Therefore, the proposed requirement for the allowable transient upon autopilot disengagement has been relaxed for these more adverse conditions.

Unless the FGS design uses a specific flight deck alert to let the flightcrew know of a significant/sustained outoftrim condition, compliance with these proposed paragraphs should be assessed with an assumption of a reasonable response to the upset event by the pilot. The pilot should be ``hands off'' at the point of autopilot disengagement. Appropriate time delays for pilot recognition of and reaction to the failure or anomalous airplane behavior must be added to the upset recovery maneuver. The time for pilot recognition of an upset is normally less than one second. Reaction time varies with the phase of flight. In cruise, climb, descent, and holding, the pilot should not initiate the recovery action until at least three seconds after the recognition point. During approach, since the pilot is actively engaged in monitoring the progress of the airplane, an assumed reaction time of one second is appropriate.

A flight deck alert (sometimes referred to as ``bark before bite'') may be used to prompt the flightcrew to mitigate transients and therefore would be used to show compliance with these proposed paragraphs. The flight deck alert would notify the crew that an outof trim condition exists that would, if a disconnect were to occur at that time, cause a significant transient or more. The crew procedure would be, in response to this alert, to firmly grasp the controls, manually disconnect the autopilot, and retrim the flight control system as necessary. Having been alerted, the pilot is aware of the possibility of a transient and is expecting to counter it when the autopilot releases control. None of the failure recognition or reaction times discussed above need be applied during the recovery maneuver if the airplane is equipped with such an alert.

These proposed paragraphs would cover transients resulting from engagement, switching, and automatic and manual disengagements of the flight guidance system. A subset of automatic autopilot disengagement is when an autopilot disengages because of pilot override. An override occurs when the pilot or copilot applies input to the flight deck controls without first manually disengaging the autopilot. Autopilot systems have not always been designed to safely deal with this situation. Designers assumed the pilot would always manually disengage the autopilot before making inputs into the flight deck controls if he or she was not satisfied with the performance of the autopilot. These proposed regulations have been developed to address the accidents and incidents that have occurred involving this specific scenario. The proposed Sec. 25.1329(d) would include transients occurring from autopilot disconnect caused by pilot override and specifies that under normal conditions autopilot override must not result in a significant transient. An automatic autopilot disconnect that results from a pilot override is a normal event. The system is to be designed for this occurrence, and should react in a safe, predictable manner. This is not intended to mean that a pilot override is the normal or preferred method of disengaging an engaged autopilot. It is just intended to mean that a pilot override is not a nonnormal event.

Note: For the situation involving either an autopilot override that does not result in automatic disengagement of the autopilot or the resultant airplane configuration that occurs prior to an automatic disengagement, see proposed paragraph Sec. 25.1329(l). Proposed Sec. 25.1329(f)

The proposed paragraph (f) is adapted from the requirements in the current Sec. Sec. 25.1329(e) and 25.777(b). Proposed paragraph (f) would state that attitude controls must operate relative to the sense of motion involved, including the motion effect of the controls and airplane operation. For cockpit controls, proposed paragraph (f) would state that the attitude controls must have the direction of motion plainly indicated on, or adjacent to, each control. The proposed paragraph (f) would extend the requirement beyond attitude controls to all command reference controls.

The increasing variety of flight guidance systems can lead to non intuitive designs that may promote flightcrew error. Command reference controls, which are parameters the pilot can set for airspeed, vertical speed, flight path angle, heading, altitude, and so on, are considered vulnerable to crew error if the sense of motion and control marking and the resulting airplane response are not consistent. If a specific FGS mode is active, changing that particular control position may have an immediate impact on the heading, altitude, or speed of the airplane. If, however, the appropriate FGS mode is not active, then manipulation of this control may only set a referenced target (for example, selected altitude). That referenced target remains until the control is manipulated again, or the appropriate FGS mode becomes active. At this point, the FGS will then actively ``seek'' that target. The FAA chose the term ``command reference controls'' instead of ``attitude controls,'' because the use of a term limited specifically to ``attitude'' might lead to confusion in the application of this rule.

Proposed paragraph (f) has been revised from the original ARAC recommendation. The original proposed paragraph read as follows: (f) Command reference controls, such as heading select or vertical speed, must operate consistently with the criteria specified in Sec. Sec. 25.777(b) and 25.779(a) for cockpit controls. The function and direction of motion of each control must be plainly indicated on, or adjacent to, each control if necessary to prevent inappropriate use or confusion.

After discussion of proposed paragraph (f) within ARAC, the proposed wording was revised to remove the first sentence. The ARAC [[Page 50248]]
felt that this information was redundant. The FGS controls must already comply with Sec. 25.777(b) without restating it in Sec. 25.1329. Also, the reference to Sec. 25.779(a) was incorrect, because that paragraph deals with trim tabs, primary controls, and flaps. This reference was therefore removed.

Proposed Changes to Sec. 25.1329(g)

Proposed paragraph (g) would have the same requirement stated in current Sec. 25.1329(f). This proposed requirement has been reworded and reformatted for clarity. It mandates that the system must be designed so it cannot produce hazardous loads on the airplane or create hazardous deviations in the flight path. This requirement applies during normal operation or in the event of a malfunction, assuming corrective action begins within a reasonable period. The phrase ``within the range of adjustment available to the human pilot'' contained in the original wording of Sec. 25.1329(f) has been removed from proposed Sec. 25.1329(g). This phrase adds little to the meaning of the regulation, as there is no real adjustment of the autopilot system available to the pilot that could affect airplane loads.

Proposed paragraph (g) has been revised from the original ARAC working group proposal. The original proposed paragraph read as follows:
(g) Under any condition of flight appropriate to its use, the Flight Guidance System must not:

This applies to both faultfree operation and in the event of a malfunction, and assumes that the pilot begins corrective action within a reasonable period of time.

The first ARAC recommendation referred to proposed Sec. 25.302 titled ``Interaction of systems and structure.'' During the FGS Harmonization Working Group activities, the ARAC Structures Harmonization Working Group was developing proposed Sec. 25.302. The FAA planned to issue and publish these two proposed rules (Sec. Sec. 25.1329 and 25.302) concurrently in the Federal Register. The FAA has since placed proposed Sec. 25.302 on hold because of other rulemaking priorities. Therefore, the working group revised their proposed paragraph (g) to remove the reference to proposed Sec. 25.302. This change, with minor editing and reformatting, removes the current text of paragraph (f) and adds it to proposed paragraph (g).

This proposed change does not affect the harmonization effort between the FAA and JAA. The JAA version (which is the original ARAC working group proposal) references the new material in JAR 25.302, and it defines exactly how to assess what is an ``unacceptable load.'' With the current Sec. 25.1329(f), an assessment of compliance must actually come from the analyses and testing required by Sec. 25.1309. This will also be true of proposed Sec. 25.1329(g). Therefore, the intent of the JAA and proposed FAA rules remains identical. The FAA proposed Sec. 25.1329(g) would depend upon compliance with Sec. 25.1309 for evaluating the interaction of the FGS and the airplane structure.

One member of the working group expressed a concern that the FAA may assume a mandatory compliance method, and that flight testing would be the only method acceptable to show compliance with some proposed paragraphs of Sec. 25.1329. Of particular concern is flight guidance system operation in icing conditions. Section 25.1329 proposed paragraphs (d), (e), and (g) do not specify a compliance method. They simply set forth design criteria. Proposed AC 25.1329XX would provide guidance for one method of compliance. However, as with all advisory material, that proposed guidance would be one acceptable means, but not the only means for demonstrating compliance with this proposed regulation. Public comments concerning proposed AC 25.1329XX are invited by separate notice published elsewhere in this issue of the Federal Register.

These paragraphs are not intended to require proof of compliance for amended type certificates (ATC) and supplemental type certificates (STC) solely through flight tests, especially when relevant service history data exists. An analysis of such data, and its determination of applicability to a given project, may be used by the applicant to meet the proposed requirement(s). Regarding certain environmental factors such as icing, and for ATC and STC projects (for example where an existing, approved autopilot is replaced by another autopilot), conducting a review of field history data may help in determining the extent of required flight testing. If the applicant can show that there is a lack of autopilotrelated accidents and/or incidents in the icing environment involving a type certificated airplane, it may be possible to show compliance without needing additional flight tests with ice shapes or in natural icing. The responsible aircraft certification office must approve the applicant's justification.

Proposed Sec. 25.1329(h)

This would be a new requirement for speed protection. It would include both high and low speed protection. It would require that when the flight guidance system is in use, a means must be provided to avoid excursions beyond an acceptable margin from the speed range of the normal flight envelope. If the airplane experiences an excursion outside this range, the flight guidance system must not provide guidance or control to an unsafe speed. The phrase ``to an unsafe speed'' is intended to mean that the flight guidance system should not control or provide guidance that would eventually lead to an aerodynamic stall or a speed that is in excess of the maximum operating speed, regardless of the maneuver being conducted at the time.

The FAA Human Factors Team completed a report in 1996 that evaluated flightcrew/flight deck automation interfaces. The Background section of this document contains a summary of that report. One of the Team's conclusion was that during FGS operation, flightcrew awareness of, or attention to, airspeed may not be sufficient to provide timely detection of unintended speed changes that could possibly compromise safety. In addition, in certain conditions, the current modes of the autopilot and/or autothrust may not be designed to prevent speed excursions outside the normal range.

This proposed requirement would prevent unwanted airspeed excursions. The preferred implementation is for the FGS to automatically provide control and/or guidance to avoid these excursions. However, an implementation providing increased awareness of airspeed and/or alerts for immediate crew recognition and intervention of a potential airspeed excursion may also be an acceptable means of complying with this regulation. Proposed AC 25.1329XX would provide guidance for several methods of compliance. However, as with all advisory material, that proposed guidance would be one acceptable means, but not the only means, for demonstrating compliance with this proposed regulation. Public com

FOR FURTHER INFORMATION CONTACT Gregg Bartley, FAA, Airplane and Flight Crew Interface Branch (ANM111), Transport Airplane Directorate, Aircraft Certification Service, 1601 Lind Avenue SW., Renton, Washington 980554056; telephone (425) 2272889; facsimile 425227 1320; email gregg.bartley@faa.gov.