[Federal Register Volume 66, Number 42 (Friday, March 2, 2001)]
[Notices]
[Pages 13113-13118]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 01-5023]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

[Policy Statement Number ANM-99-01]


Improving Flightcrew Awareness During Autopilot Operation

AGENCY: Federal Aviation Administration, DOT.

ACTION: Final policy statement.

-----------------------------------------------------------------------

SUMMARY: This document announces an FAA general statement of policy 
applicable to the type certification of transport category airplanes. 
This document advises the public, in particular manufacturers of 
transport category airplanes and automatic flight control (autopilot) 
systems, that the FAA, when certifying automatic pilot installations, 
intends to evaluate various items that will improve the flightcrew's 
awareness during autopilot operation.

FOR FURTHER INFORMATION CONTACT: Gregg Bartley, Federal Aviation 
Administration, Transport Airplane Directorate, Transport Standards 
Staff, Airplane and Flight Crew Interface Branch, ANM 111, 1601 Lind 
Avenue SW., Renton, WA 98055-4056; telephone (425) 227-2889; fax (425) 
227-1100; e-mail: [email protected].

SUPPLEMENTARY INFORMATION:

Background

    Recent incidents and accidents that have occurred worldwide 
involving pilot-autopilot interactions have emphasized to the FAA the 
need to reexamine the current certification policy relative to 
autopilot issues.
    In 1991, the National Transportation Safety Board (NTSB) began an 
investigation of an incident involving a transport category airplane 
that experienced an in-flight upset. When the airplane was in cruise at 
flight level 310, the flightcrew noted that the inertial navigation 
system ``FAIL'' lights had illuminated. When the flightcrew cross-
checked the instrument panel, they determined that the airplane was in 
a steep right-wing-down banking angle. The flight lost nearly 10,000 
feet of altitude and the airplane approached supersonic speeds before 
the pilots could complete a recovery. The airplane eventually made a 
successful landing, and there were no injuries.
    Investigation of the incident revealed, among other things, that a 
failure in the autopilot system could cause an airplane to roll slowly 
into a banking attitude. The roll rate induced from such a failure of 
the autopilot system may be barely perceptible to the flightcrew; it 
also may be difficult to detect without external visual attitude 
references or continuous close monitoring of the flight attitude 
instruments.
    The NTSB has advised the FAA of its concern that some autopilot 
failures can result in changes in attitude at rates that may be 
imperceptible to the flightcrew, and thus remain undetected until the 
airplane reaches significant attitude deviations.

FAA Evaluation of Flightcrew/Flight Deck Automation Interfaces

    In 1994, the FAA launched a study to evaluate all flightcrew/flight 
deck automation interfaces of current generation transport category 
airplanes. The FAA chartered a Human Factors Team to conduct the study. 
Team members included experts from the FAA, the European Joint 
Airworthiness Authorities (JAA), and academia. The objective of the 
study was to look beyond the label of ``flightcrew error,'' and examine 
the contributing factors from the perspective of design; flightcrew 
training and qualifications; operations; and regulatory processes. The 
FAA also tasked the team to develop recommendations to address any 
problems identified.
    With regard to autopilot issues, the Team identified several 
specific problematic issues, including:
     Pilot/autopilot interactions that create hazardous out-of-
trim conditions;
     Autopilots that can produce hazardous speed conditions and 
may attempt maneuvers that would not normally be expected by a pilot; 
and
     Insufficient wording in the Airplane Flight Manual 
regarding the capabilities and limitations of the autopilot.

Regulatory Initiatives

    The FAA has acknowledged the autopilot issues raised by both the 
NTSB and the Human Factors Team, and has taken steps to address them. 
For example, the FAA has tasked the Aviation Regulation Advisory 
Committee (ARAC) to review and propose harmonized revisions to the 
following documents:
     14 CFR 25.1329 (``Automatic pilot system''), which 
contains FAA's standards for certifying automatic pilot systems on 
transport category airplanes;
     14 CFR 25.1335 (``Flight director systems''), which 
contains FAA's standards for certifying flight director systems on 
transport category airplanes; and
     Advisory Circular (AC) 25-1329-1A (``Automatic Pilot 
Systems Approval,'' dated July 8, 1968), which describes an acceptable 
means by which compliance with the automatic pilot installation 
requirements of Sec. 25.1329 may be shown.
    The work of ARAC currently is in progress.

Current Certification Standards

    In general, the FAA has traditionally certified automatic pilot 
systems on transport category airplanes in accordance with Sec. 25.1329 
on the basis that:
     The systems are conveniences to reduce flightcrew 
workload, and
     The systems do not relieve the flightcrew of any 
responsibility for assuring proper flight path management.
    As a result, the autopilot evaluation criteria contained in AC 
25.1329-1A, are chiefly concerned with the effects of autopilot 
failures on the airplane. The most recent revision to AC 25-7A, 
``Flight Test Guide for Certification of Transport Category 
Airplanes,'' also defines some evaluation criteria for determining 
whether the autopilot is performing its intended function of relieving 
the flightcrew of some of their control functions.

[[Page 13114]]

    Accordingly, even when the flightcrew is not manually performing a 
specific flight path control function, the FAA expects the flightcrew 
to be ``aware'' when this function is not being performed safely, and 
to take appropriate and timely corrective action. The installation 
certification guidelines presented in AC 25.1329-1A, for example, state 
``* * * at least one pilot [should] monitor the behavior of the 
airplane and associated autopilot performance at all times.''
    In certifying all autopilot systems to date, the FAA has accepted 
the premise that the capability for this flightcrew ``awareness'' comes 
from either:
     Adherence to operational training and/or procedures;
     A dedicated failure detection and annunciation feature on 
the flight deck; or
     Inherent aircraft operational cues (for example, a 
perceived change of aircraft attitude or change of engine noise).
    As shown by recent relevant accident and incident cases, one cannot 
assume that the flightcrew will reliably detect and accommodate adverse 
autopilot behavior solely from inherent operational cues; other cues 
are needed.
    Inherent operational cues can be insufficient because:
    1. During normal autopilot operations, the flightcrew may not be 
able to detect operational cues related to significant changes in 
aerodynamic characteristics, such as drag and controllability, as 
effectively as during manual operation. One specific example of this is 
the change of control response or ``feel'' during low speed operations 
as ice accumulates on the airplane surfaces, gradually and 
imperceptibly reducing control authority. This condition can progress, 
intangible to the flightcrew, until the autopilot exhausts its control 
authority and automatically disengages. The flightcrew then is suddenly 
required to take manual control of the airplane, which (1) is not in 
proper trim, (2) is at a low margin-to-stall, and (3) has significantly 
degraded aerodynamic performance.
    2. As pointed out by the NTSB, and recognized by the FAA, some 
autopilot failures can result in changes in attitude at rates that may 
be imperceptible to the flightcrew, and thus remain undetected until 
the airplane reaches significant attitude deviations.
    Neither the certification standards nor the relevant advisory 
material currently contain actions or detailed guidance to address 
these types of situations. Because of this, the FAA has found it 
necessary and appropriate to provide additional guidelines for the 
provision of design features needed to enable flightcrew control and 
awareness of the unintended changes of speed and attitude during the 
operation of the autopilot system.

Discussion of Proposed Policy Statement

    On, August 30, 1999, the FAA issued a proposed general statement of 
policy (64 FR 49043, September 9, 1999) concerning how the FAA would 
evaluate various items when certifying automatic pilot installations in 
transport category airplanes. (A correction was later published on 
September 20, 1999 (64 FR 50872).) This information, presented in the 
form of a general statement of policy, was intended to clarify, detail, 
and formally state items that the FAA:
     Assumes about the flightcrew's awareness capability;
     Employs or accepts on an on-going basis in making 
compliance findings relative to autopilot systems; and
     Considers frequently in developing a means to prevent 
recurrences of the accident/incident situations described previously, 
or to enable an appropriate and timely response to other situations 
that could result in similar circumstances.

Comments Received in Response to Proposed Policy Statement

    The FAA received comments on the proposed policy statement from 
five commenters. Many of the comments submitted were editorial in 
nature and did not take issue with the content of the policy itself. We 
have incorporated most of these editorial changes into the final policy 
statement where they made the information clearer or corrected 
typographical errors.
    The remainder of the comments were substantive in nature and 
addressed the correctness, merit, or appropriateness of the policy's 
technical details. These are discussed below, divided by the issues 
addressed and by comments related to specific paragraphs of the 
proposed policy statement.

``Rulemaking by Policy''

    One commenter states that the proposed policy statement differs 
significantly from existing regulatory and advisory material, and 
constitutes ``rulemaking by policy.'' This commenter further states 
that industry would rather see a statement of the issue and defer the 
exact mechanism to address that issue to the applicant. The commenter 
suggests that any new direction should be harmonized with the 
activities of ARAC.
    The FAA does not agree with the commenter. With regard to this 
policy statement being ``rulemaking by policy,'' all features discussed 
in the policy statement are covered by the current 14 CFR 25.1309 
(especially Sec. 25.1309(c)) and Sec. 25.1329, as well as several other 
regulations. This policy statement (and the planned revisions to the 
associated advisory circulars) only defines one possible implementation 
that would be acceptable to the regulatory authorities when determining 
compliance with existing regulations. Neither this policy statement nor 
any current or future advisory circulars define regulations.
    The FAA does intend to incorporate all the material described in 
the policy statement in the upcoming revision of AC 25.1329-1A. 
Likewise, the European Joint Aviation Authorities (JAA) also plan to 
incorporate this material into their parallel Advisory Circular Joint 
(ACJ) 25.1329.

Change in Role of Flightcrew

    One commenter states that current autopilot systems have been 
shown, by operational experience, to be safe. This commenter asserts 
that the new policy would change the role of the flightcrew, who are 
currently required to monitor the performance of an engaged autopilot 
at all times. It could make them more dependent on automatic functions 
and, thereby, less likely to be constantly monitoring the state of the 
aircraft.
    The FAA does not agree with this commenter. Crew alerting features 
are intended to increase pilot awareness, not replace or reduce the 
requirement for crew vigilance and professional aviation skills. 
Current crew alerting features--such as Enhanced Ground Proximity 
Warning System, Terrain Awareness and Warning System, Engine Fail 
Indications, or any other alert on modern transport category aircraft--
enhance safety. The autopilot alert described in the policy statement 
is no different in this respect.
    While the autopilot systems currently in service are safe, there 
have been several serious incidents and accidents of transport category 
aircraft over the last 10 years that have involved the automatic 
disconnection of an engaged autopilot when the aircraft was in a mis-
trimmed configuration or an unusual attitude. The new features 
described in the policy statement are in direct response those 
incidents and accidents.
    The FAA does not intend for this policy to alter the roles and 
responsibilities of the flightcrew as they are currently defined. The 
autopilot alerts discussed are intended as an added safeguard to a 
vigilant flightcrew. History has shown that pilots sometimes

[[Page 13115]]

do miss cues (be they subtle or overt) of a developing or ongoing 
unusual situation. The accidents and incidents mentioned previously 
have occurred when an engaged autopilot disconnected automatically 
during a time when the aircraft was in a significantly mis-trimmed 
condition or an unusual attitude. These accidents and incidents may 
have been avoided if that condition had been brought to the attention 
of the flightcrew prior to the disconnection of the autopilot. The 
autopilot alert described in the policy statement is intended to 
preclude a recurrence of accidents and incidents of that type.

Conflict Between Policy and New Advisory Material or Rules

    Several commenters suggest that the policy statement should include 
language specifying that rules or advisory material promulgated as a 
result of the parallel work of ARAC (and the Flight Guidance Systems 
Harmonization Working Group) would supersede this or any existing 
policy statement if there is a conflict between the two.
    The FAA does not consider the suggested language necessary. We plan 
to ``cancel'' this policy statement when the next revision of AC 
25.1329-1A is published. As indicated previously, this policy statement 
is interim guidance until the new revision of AC 25.1329-1A is issued. 
Therefore, there is no need for language in the policy statement that 
would give priority to any specific document.

Comments on Paragraph 2., ``Definitions''

    One commenter requests the FAA to clarify the definition of 
``hazardous flight path deviations,'' which appeared as paragraph 2.c. 
in the proposed policy statement. The commenter states that the term 
``hazardous'' is used in multiple ways and this may create confusion.
    The FAA finds it appropriate to delete this definition from the 
final policy statement to avoid confusion. Additionally, the term is 
not used anywhere else in the policy statement, so its appearance under 
the heading ``Definitions'' is not necessary.

Comments on Paragraph 4., ``System Response''

    Several commenters suggest various changes to proposed paragraph 4. 
to make it clearer and more consistent with guidance that is already in 
or planned for inclusion in FAA and JAA advisory material. For example, 
one commenter suggests that paragraph 4.b. of the proposal be revised 
to make clear that the autopilot should not be allowed to command 
unsafe maneuvers, regardless of the ease of recovery. The commenter 
also suggests that the restrictions on out-of-trim conditions in the 
event of a manual autopilot disconnect, which were listed in proposed 
paragraph 4.d., should be added to paragraph 4.c.'s description of the 
automatic disconnect case. Additionally, the commenter suggests that 
examples of maneuvers that might be considered ``dangerous'' be 
included.
    Other commenters state that the text of proposed paragraph 4.d. 
allows no ``credit'' for a mis-trim warning and, thus, would require 
autopilots to have a critical trim function, which most autopilots do 
not support. Other commenters suggest use of the term ``ultimate 
loads'' instead of ``limit loads'' in proposed paragraph 4.d., because 
catastrophic failure conditions are normally associated with ``ultimate 
loads,'' not ``limit loads.'' These commenters also suggest using the 
term ``unsafe maneuver'' instead of ``dangerous maneuver'' (as used in 
proposed paragraph 4.f.), because ``dangerous'' cannot be explicitly 
defined.
    The FAA has considered these suggestions and has rewritten 
paragraph 4 with the following specific changes:
     Paragraph 4.a. is unchanged from the proposed version.
     Paragraph 4.b. refers to the autopilot providing guidance 
or control, as appropriate, for the intended function in a safe and 
predictable manner.
     Paragraph 4.c. describes the expected system response to 
the presence of transient flight control movements during non-
maneuvering flight and under dynamic conditions.
     Paragraph 4.d. describes the expected system response, 
relative to significant transient flight control movements, during 
automatic or manual disengagement of the autopilot.
     Paragraph 4.e. describes the expected system response, 
relative to significant transients, during other than normal 
conditions.
     Proposed paragraph 4.f. has been deleted as a result of 
these changes.
    (Note that previous references to ``dangerous'' maneuvers and to 
``limit loads'' have been deleted from the final text.)
    The wording in the final policy statement reflects the text that 
will appear in the upcoming revision of AC 25.1329-1A.

Comments on Paragraph 5., ``Controls, Displays, and Alerting''

    Several commenters consider that the autopilot alert defined in 
paragraph 5.e. of the policy statement constitutes a significant design 
challenge. First, these commenters point out that paragraphs 5.e.(1) 
and 5.e.(2) require ``the autopilot to remain engaged for some time 
period after a failure has been detected by a monitor (assuming that a 
monitor exists to detect all failure conditions).'' To these 
commenters, this appears contrary to safety in almost all failure 
conditions. Many failure conditions require an immediate automatic 
disconnection of the autopilot in order to minimize the adverse effects 
of the failure. If autopilot engagement is maintained for some time 
after the failure, the undesirable effects of the failure will persist 
and, consequently, increase the severity of the failure condition.
    Second, these commenters point to paragraph 5.e.(4), which lists 
the conditions for which the flightcrew alert, and possibly automatic 
disengagement of the autopilot, should be considered. The commenters 
state that some of the warning conditions listed in that paragraph are 
within the normal operating flight envelope, and that it would be 
difficult to provide useful alerts without producing frequent nuisance 
alarms.
    The commenters request clarification on the intent of paragraph 
5.e. and the conditions that should or should not result in an 
automatic disengagement.
    The FAA agrees that clarification is necessary. We recognize that 
any alert must be carefully designed so it does not cause a nuisance 
alert and, in doing so, precipitate unnecessary crew actions. This 
policy statement calls for a more advanced (earlier) autopilot alert to 
increase the flightcrew's awareness of a potentially dangerous 
condition that the flightcrew might not otherwise detect in a timely 
manner.
    Examples of situations that could warrant advance crew notification 
are listed in paragraph 5.e.(4) of the policy statement. It is not 
required that the crew be alerted prior to any automatic disconnect of 
an engaged autopilot. All failure conditions that require an immediate 
automatic disconnect, and whose onset cannot be detected prior to the 
actual failure condition, must still cause an immediate automatic 
disconnect. No preceding alert is required. We have clarified the 
wording of the final policy statement in this regard.

[[Page 13116]]

Comments on Paragraph 7., ``Airplane Flight Manual''

    Several commenters consider the detailed list of design 
specifications contained in paragraph 7 of the proposed policy 
statement inappropriate for inclusion in an Airplane Flight Manual. One 
of these commenters states that it is more appropriate for this 
information to be included in Operations Manuals and training material. 
Another commenter states that the AFM operating procedures should be 
limited to only a general description of the autopilot capability. The 
commenters state that the literal interpretation of what is asked for 
in this section would require reproduction of extensive logical 
expressions that are implemented in either hardware or software. These 
commenters question the usefulness of this information for the 
flightcrew in actual flight operations.
    The FAA agrees somewhat with the commenters. We have revised 
paragraph 7 in the final policy statement to provide guidance on 
material that should be provided in the AFM to ensure that the 
appropriate information related to operation of the flight guidance 
system is translated into air carrier operations. This information is 
similar to guidance that will be provided in the upcoming revision to 
AC 25.1329-1A.

Effect of General Statement of Policy

    Much of the information presented in this final policy statement 
has been developed from service experience garnered and flightcrew 
conventions practiced throughout the years since the guidance contained 
in AC 25.1329-1A was published in 1968. The FAA has assembled this 
information and is presenting it in this general statement of policy as 
a set of ``guidelines'' that are appropriate for use with Sec. 25.1329 
for autopilot certification.
    Additionally, as discussed previously, actions currently are 
underway to revise the applicable airworthiness standards 
(Sec. 25.1329) and associated advisory material (AC 25.1329-1A) to more 
fully address the autopilot system and other flight deck issues. Until 
then, the guidance provided in this general statement of policy would 
serve as a reference to assist in the certification of new autopilot 
systems.
    The general policy stated in this document is not intended to 
establish a binding norm; it does not constitute a new regulation and 
the FAA would not apply or rely upon it as a regulation. The FAA 
Aircraft Certification Offices (ACO) that certify transport category 
airplanes and/or the automatic pilot systems installed on them should 
generally attempt to follow this policy, when appropriate. However, in 
determining compliance with certification standards, each ACO has the 
discretion not to apply these guidelines where it determines that they 
are inappropriate. The ACO should coordinate with the Transport 
Airplane Directorate, for purposes of standardization, whenever the ACO 
determines that some deviation from this policy is appropriate. 
Applicants should expect that the certificating officials would 
consider this information when making findings of compliance relevant 
to new certificate actions.
    Applicants may consider the material contained in this policy 
statement as supplemental to that currently contained in AC 25.1329-1A 
when developing a means of compliance with the relevant certification 
standards.
    As with all advisory material, this statement of policy identifies 
one means, but not the only means, of compliance.
    For the convenience of the reader, we have formatted this general 
statement of policy in outline form.

The General Statement of Policy

1. General

    1.a. Operational experience has shown that flightcrews may not have 
adequate awareness of potentially hazardous aircraft states or adequate 
capability to anticipate sudden, unexpected actions of the autopilot. 
In this regard, the autopilot design should take into consideration 
conditions that could create hazardous deviations in the flight path, 
specifically (ref: 14 CFR 25.1329(f), ``Automatic pilot system''):
     Conditions that could make continued autopilot operation 
unsafe; or
     Conditions that could cause the manual control of an upset 
following autopilot disengagement to require exceptional piloting skill 
or alertness.
    Note that automatic disengagement may not be the safest autopilot 
response for all cases, particularly with trim conditions that could 
lead to a significant upset.
    1.b. If automatic functions are provided that may be used with the 
autopilot (e.g., automatic thrust control or yaw damper), and use of 
the autopilot is permitted with any of these functions inoperative, 
then the design of the autopilot should comply with the provisions of 
this general policy statement and Advisory Circular 25.1329-1A, 
``Automatic Pilot Systems Approval'' with these functions operative and 
inoperative.
    1.c. The autopilot should perform its intended function in all 
configurations in which it may be used throughout all appropriate 
maneuvers and environmental conditions, including turbulence and icing, 
unless an appropriate operating limitation or statement is included in 
the Airplane Flight Manual.

2. Definitions

    2.a. The term autopilot is synonymous with the term automatic 
pilot. The term autopilot includes the sensors, computers, power 
supplies, servo-motors, servo-actuators, and associated wiring 
necessary for its function. It includes any displays and controls 
necessary for the pilot to manage and supervise the system.
    2.b. The term autothrust is synonymous with the term autothrottle 
or automatic throttle control.
    2.c. The term extremely improbable is defined as the average 
probability per flight hour of the occurrence of an event (e.g., a 
failure condition), which is on the order of 1  x  10-\9\ or 
less. Catastrophic failure conditions must be extremely improbable 
(ref. Sec. 25.1309(b)(1)).
    2.d. The term warning is defined as an indication for a hazard 
requiring immediate corrective action by the flightcrew.
    2.e. The term caution is defined as an indication for an event 
requiring immediate crew awareness and possibly requiring subsequent 
timely corrective crew action.

3. Design, Installation, and Maintenance

    3.a. The autopilot system design should not possess 
characteristics, in normal operation or when failed, that would degrade 
safety or lead to an unsafe condition, unless such failures can be 
limited by design or the effects can be limited and mitigated by the 
pilot response within a reasonable time. The allowable probability of 
any failure should be based on its safety effects in accordance with 
the requirements of Sec. 25.1309.
    3.b. Adequate precautions should be taken in the design process, 
and adequate procedures should be specified in the maintenance manual, 
to prevent the incorrect installation, connection, or adjustment of 
parts of the autopilot if such errors would create a hazard to the 
airplane (e.g., torque clutches or limit switches with a range of 
adjustment such that maladjustment could be hazardous).
    3.c. The autopilot should be designed and installed so that the 
tolerances demonstrated during certification tests can be maintained in 
service.

[[Page 13117]]

4. System Response

    4.a. The autopilot should not cause nuisance oscillations, undue 
control activity, or sudden large attitude changes, especially when 
configuration or power changes are taking place. All maneuvers should 
be accomplished smoothly, accurately, and in a manner similar to normal 
pilot control.
    4.b. The autopilot should provide guidance or control, as 
appropriate, for the intended function of the active mode(s) in a safe 
and predictable manner within the normal flight envelope.
    4.c. In non-maneuvering flight, the engagement of the autopilot 
should be free of perceptible transient flight control movement. Under 
dynamic conditions, including maneuvering flight, some minimal flight 
control transients may be acceptable if they do not cause significant 
operational difficulty for the flightcrew or unsafe conditions for the 
occupants.
    4.d. Under normal conditions, automatic or manual disengagement of 
the autopilot should be free of significant transients or out of trim 
forces that are not consistent with the maneuvers being conducted by 
the airplane at the time of disengagement. If multiple autopilots are 
engaged, any disengagement of an individual autopilot should be free of 
significant transients and should not adversely affect the operation of 
the remaining autopilot.
    4.e. In other than normal conditions, disengagement of the 
autopilot may result in a significant transient. The flightcrew should 
be able to respond to a significant transient without:
     Exceptional piloting skill, alertness, or strength;
     Forces greater than those given in Sec. 25.143 (c); and
     Accelerations or attitudes in the airplane that might 
result in a hazard to secured or non-secured occupants.

5. Controls, Displays, and Alerting

    5.a. Unless the probability of failure of the quick-disconnect 
button on the control wheel, or equivalent, is shown to be extremely 
improbable, an alternative means of disengagement, that is readily 
accessible in flight, should be provided.
    5.b. The controls, displays, and alerts should be designed to 
minimize crew errors.
    5.c. Mode, state, status, and malfunction indications should be 
presented in a manner compatible with the procedures and assigned tasks 
of the flightcrew. The indications should be grouped in a logical and 
consistent manner and be visible from each pilot's station under all 
expected lighting conditions.
    5.d. Autopilot Disconnect Warning:
    5.d.(1) Disengagement of the autopilot, whether intended by the 
pilot or not, should trigger both an aural alert and visual warning 
during any phase of flight, since immediate pilot action is required.
    5.d.(2) The aural alert associated with the autopilot disconnect 
should be unique and distinct. The aural alert should be cancelable by 
the pilot pushing the quick-disconnect button on the control wheel or 
stick. The aural alert should sound until cancelled by the pilot, 
except that a minimum cycle should sound. If the autopilot is 
disengaged by means of the quick-disconnect button, then an additional 
push of this button should be required to cancel the aural alert.
    5.e. An aural alert and a visual caution should be provided to the 
flightcrew for conditions that:
     Could make continued autopilot operation unsafe, or
     Could cause the manual control of an upset following 
autopilot disengagement to require exceptional piloting skill or 
alertness.
    5.e.(1) The flightcrew alert should be generated before the 
conditions lead to a situation that could require exceptional piloting 
skill or alertness, such as an automatic disconnect while the airplane 
is in an unusual attitude, significantly out of trim, or near stall 
warning.
    5.e.(2) Whenever possible, the alert should provide the flightcrew 
enough time to be prepared to place their hands on the controls and to 
take appropriate corrective action (e.g., change thrust, set trim, 
disconnect autopilot).
    5.e.(3) The thresholds for triggering the flightcrew alert should 
be designed carefully, with consideration for undue distraction (e.g., 
nuisance alerts) and potential ``rippling'' of multiple alerts 
triggered by the same or related conditions, which could mask or 
override the sounding of this alert.
    5.e.(4) Conditions that should be considered for a flightcrew alert 
and possibly automatic disengagement include, but are not limited to:
     Limits of autopilot control authority;
     Out-of-trim;
     Excessive trim rates;
     Airspeeds greater than those intended for autopilot 
operations;
     Low speeds (e.g., less than 1.2 VS1 for the 
current flap configuration, but greater than 1.07 VS); and
     Bank and pitch angles beyond those intended for autopilot 
operation.
    5.e.(5) Detected failure conditions that require an immediate 
autopilot disconnect, such as a fault within the autopilot processing 
unit or a failed autopilot servo, do not require an alert to be 
displayed prior to automatic disconnection. Only those conditions that 
are sustained and/or build up over time such that an advance warning 
could be given to the flightcrew prior to automatic autopilot 
disengagement (e.g., the autopilot close to its maximum authority in 
the roll axis for a specific period of time), or conditions that would 
not by themselves cause an automatic autopilot disengagement, are 
candidates for an alert.
    5.f. The means provided to comply with Sec. 25.1329(h) (mode 
indications when coupled with airborne navigation equipment) should 
also give an appropriate indication when:
    5.f.(1) The autopilot cannot engage the mode selected by the 
flightcrew; and
    5.f.(2) The system automatically makes a mode change or mode 
disengagement that is considered operationally significant and, 
perhaps, unexpected. (For example, a change from altitude capture to 
altitude hold is significant, but expected; while a change from 
vertical path mode to vertical speed mode is both operationally 
significant and unexpected.)
    5.g. If the autopilot has envelope limiting or protection 
capability, the system should provide an alert to indicate to the 
pilots when envelope limiting or protection is invoked and the 
condition is sustained and/or flightcrew action is necessary.

6. Engagement

    If a flight director is available and active, the autopilot should 
engage in the same mode as the flight director and provide consistent 
flight path guidance.

7. Airplane Flight Manual (AFM)

    The following paragraphs provide guidance on material to be 
provided in the Airplane Flight Manual (AFM) to ensure that the 
appropriate information related to flight guidance system (FGS) 
operation is translated into air carrier operations. For additional 
guidance, note that FAA Advisory Circular (AC) 25.1581-1 (``Airplane 
Flight Manual,'' dated July 14 1997) addresses requirements of the AFM 
for transport category aircraft and distinguishes between those 
aircraft that are used in air carrier operations and those not in air 
carrier service. The terminology used in the AFM should be consistent 
with the intended operational use. Appropriate AFM information related 
to

[[Page 13118]]

low-visibility operations is addressed in:
     AC 120-28D, ``Criteria for Approval of Category III 
Weather Minima for Takeoff, Landing, and Rollout,'' and
     AC 120-29A, ``Criteria for Approving Category 1 and 
Category II Landing Minima for FAR 121 Operators.''
    7.a. Limitations. The Limitations section of the AFM presents those 
FGS operating limitations appropriate to the airplane model as 
established in the course of the type certification process, and as 
necessary. The FGS operational limitations (should any exist) should 
specify, but not be limited to, the following:
     Minimum engagement altitude(s) or height(s), if and when 
necessary.

    Note: If Minimum Engagement Altitude(s) or height(s) are not 
specified, then ``maximum displacement deviation'' information from 
a pertinent takeoff flight path and approach profile should be 
provided in the AFM Normal Procedures section, or in the associated 
Flight Crew Operation Manual (FCOM).

     Mandatory disengagement requirements, if necessary.
     Configuration/envelope restrictions, if and as applicable.
    7.b. Abnormal/Emergency Procedures. Any FGS anomaly that is 
addressed to the flight crew by a non-normal procedure must be included 
in the AFM.
    7.c. Normal Procedures.
    7.c.(1) General. The normal procedures for use of the FGS should be 
documented in the AFM or Flight Crew Operation Manuals (FCOM), as 
appropriate. These procedures should be demonstrated during the type 
certification process. In lieu of specification of minimum engagement 
altitude(s) or height(s), the AFM may alternately specify ``maximum 
displacement deviations'' from a specified takeoff flight path, or from 
a specified approach profile. This information may be based on typical 
departure or approach flight paths suited for the aircraft type and for 
and failure conditions that are determined applicable to the type of 
FGS system and modes suitable for use.
    7.c.(2) Aircraft with Published Flight Crew Operation Manuals 
(FCOM). Airplane Flight Manuals for aircraft for which the manufacturer 
has published FCOM's should contain essential information on normal 
operating procedures that are considered ``peculiar'' to the operation 
of the FGS for the aircraft type or are otherwise necessary for safe 
operation. System description, specification, and operational 
procedures that are normally associated with flight guidance systems 
may be described in the FCOM.
    7.c.(3) Aircraft without Published FCOM's. For aircraft that rely 
on the AFM as the sole operating manual, the AFM should contain 
operating information sufficient for crew reference. System 
description, operation, checklists, and normal operating procedures 
should be amplified in sufficient detail so that an appropriately 
trained flight crew may operate the FGS under normal conditions.

Conclusion

    As discussed previously, the FAA intends to update 14 CFR 25.1329 
and associated Advisory Circular (AC) 25.1329-1A to more fully address 
the autopilot issues found in this general statement of policy and 
others. Until then, this general statement of policy serves as a 
reference to supplement Sec. 25.1329, and for use in the certification 
of new autopilot systems. Please inform the appropriate flight controls 
and systems designated engineering representatives (DER) of this 
proposed general statement of policy.

    Issued in Renton, Washington, on February 22, 2001.
D.L. Riggin,
Acting Manager, Transport Airplane Directorate, Aircraft Certification 
Service.
[FR Doc. 01-5023 Filed 3-1-01; 8:45 am]
BILLING CODE 4910-13-U