1 Purpose.
2 Applicability.
4 Background.
AC 25.671-1 • Section 25.302, Interaction of systems and structures.
• Section 25.671, Control Systems—General.
• Section 25.683 , Operation tests • Section 25.685 , Control system details • Section 25.1309, Equipment, systems, and installations.
• Section 25.1322, Flightcrew alerting .
• Section 25.1329, Flight guidance system .
3.2 Advisory Circulars.
The following ACs are related to the guidance in this AC. Please refer to the latest version of each AC referenced in this document; they are available at FAA Advisory Circulars and in the Dynamic Regulatory System (DRS) .
• AC 25-7D, Flight Test Guide for Certification of Transport Category Airplanes .
• AC 25.1309-1B, System Design and Analysis .
• AC 25.1322-1, Flightcrew Alerting .
• AC 25.1329-1C, Change 1, Approval of Flight Guidance Systems .
3.3 Other Documents.
The following FAA documents are related to the guidance in this AC. If the documents are revised after publication of this AC, you should refer to the latest version for guidance.
• PS-ANM-25-12, Certification of Structural Elements in Flight Control Systems , dated March 13, 2015. Accessible at FAA Dynamic Regulatory System (DRS) at FAA DRS .
• Certification Authorities for Large Transport Aircraft (CATA) Worklist Item FAA- 005 – Flight Control System – Operation Tests, dated October 14, 2022. Accessible at FAA CATA Worklist Item FAA-005 .
4 BACKGROUND.
4.1 The FAA is issuing this AC concurrently with several rule changes that address system safety and structural design criteria, such as §§ 25.302, 25.671, 25.1309, and others.
The FAA developed these rule changes, and corresponding advisory material, based on service experience and recommendations from several Aviation Rulemaking Advisory Committee (ARAC) working groups.
5 Definitions.
AC 25.671-1 4.2 In 2001, the ARAC Flight Controls Harmonization Working Group (FCHWG) provided recommendations for changes to § 25.671 and the corresponding advisory material. The FAA used these recommendations to develop this AC. These recommendations included a requirement to minimize the risk that could be caused by latent failures in flight control systems.
4.3 In addition to the FCHWG, several other working groups separately developed different criteria for latent failures in system designs. In 2010, the ARAC Airplane-Level Safety Analysis Working Group reviewed all the previous recommendations and developed a common approach for addressing latent failures. These latent failure criteria are now included in § 25.1309 and apply to all equipment and systems, including flight control systems.
5 DEFINITIONS.
The following definitions apply to the requirements of § 25.671 and the guidance in this AC. Refer to AC 25.1309-1B for additional definitions including “latent failure,” “event” and “error.” 5.1 Continued Safe Flight and Landing.
The capability for continued controlled flight and landing at an airport without requiring exceptional pilot skill or strength.
5.2 Exceptional Pilot Skill or Strength.
Skill or strength capabilities that exceed that of the average pilot.
5.3 Exposure Time.
The time between when an item was last known to be operating properly and when it will be known to be operating properly again.
5.4 Failure.
An occurrence that affects the operation of a component, part, or element such that it no longer functions as intended. This includes both loss of function and malfunction.
Note 1: Errors may cause failures or influence their effects but are not considered to be failures.
Note 2: Some of the types of failures to consider in showing compliance with § 25.671(c) are listed in paragraphs 5.4.1 through 5.4.6 . Since the type of failure and the failure’s effect will depend on system architecture, this list is not all-inclusive, but serves as a general guideline. Compliance with § 25.302 and § 25.1309 may also be required for some of these failure conditions. Refer to AC 25.1309-1B.
5.4.1 Jam.
A failure or event that results in a control surface, pilot control, or component becoming fixed in one position.
AC 25.671-1 5.4.1.1 If the control surface or pilot control is fixed in position due to a physical interference, it is regulated by § 25.671(c)(3). Causes may include corroded bearings, interference with a foreign or loose object, control system icing, seizure of an actuator, or a disconnect that results in a jam by creating an interference. Jams of this type must be assumed to occur and should be evaluated at positions up to and including the normally encountered positions defined in paragraph 8.3 of this AC.
5.4.1.2 All other failures or events that result in either a control surface, pilot control, or component being fixed in position are addressed under § 25.671(c)(1) and (c)(2) and § 25.302 where applicable. Depending on system architecture and the location of the failure, some jam failures or events may not always result in a fixed surface or pilot control; for example, a jammed valve could result in a surface runaway.
5.4.2 Loss of Control of Surface.
A failure that results in a control surface not properly responding to commands. Failure sources include mechanical disconnection, control cable disconnection, actuator disconnection, loss of hydraulic power, or loss of control commands due to flight control computer, data path or actuator electronics failures. In these conditions, the position of the surface(s) or controls can be determined by analyzing the system architecture and airplane aerodynamic characteristics; common positions include surface centered (0°) or zero hinge-moment position (surface float).
5.4.3 Oscillatory Failure.
A failure that results in surface oscillation. Failure sources include control loop destabilization, oscillatory sensor failure, and oscillatory computer or actuator electronics failure. The duration of the oscillation, its frequency, and amplitude depend on the control loop, monitors, limiters, and other system features.
5.4.4 Restricted Control.
A failure that results in limitation of the achievable surface deflection. Failure sources include foreign object interference, travel limiter malfunctioning, and malfunction of an envelope protection. This failure must be evaluated under § 25.671(c)(1) and (c)(2), as the system or surface can still be operated.
5.4.5 Runaway or Hardover.
A failure that results in uncommanded control surface movement. Failure sources include servo valve jamming and computer or actuator electronics malfunctioning. The speed of the runaway, the duration of the runaway (permanent or transient) and the resulting surface position (full or partial deflection, or full retraction) depend on the available monitoring, limiters, and other system features. This type of failure must be evaluated under § 25.671(c)(1) and (c)(2).
6 Evaluation of Flight Control Operation—§ 25.671(a).
AC 25.671-1 5.4.6 Stiff or Binding Controls.
A failure that results in a significant increase in control forces. Failure sources include failures of artificial feel systems, corroded bearings, jammed pulleys, and failures causing high friction. This failure must be evaluated under § 25.671(c)(1) and (c)(2), as the system or surface can still be operated. In some architectures, the higher friction may result in reduced centering of the controls.
5.5 Flight Control System.
This term refers to the following: primary flight controls from the pilots’ controls to the primary control surfaces; trim systems from the pilots’ trim input devices to the trim surfaces (including stabilizer trim); speedbrake/spoiler (drag devices) systems from the pilots’ control lever to the spoiler panels or other drag/lift-dumping devices; high lift systems from the pilots’ controls to the high lift surfaces; feel systems; load alleviation systems; stability augmentation systems; and other functions implemented through or supporting the flight control components. Other systems or devices that alter the air flow around the airplane for the purpose of flight path control or modification of aerodynamic forces or moments, for example suction or blowing systems, should also be considered part of the flight control system. Supporting systems (for example, hydraulic systems, electrical power systems, and avionics) should also be evaluated if failures in these systems have an impact on the function of the flight control system.
5.6 Normal Flight Envelope.
The normal flight envelope includes airplane operating and environmental conditions for which the airplane is designed, including the operating envelope defined by the airplane flight manual (AFM) together with any modification to that envelope associated with abnormal or emergency procedures. The normal flight envelope includes external environmental conditions that the airplane is reasonably expected to encounter, such as atmospheric turbulence, high intensity radiated fields, lightning, and precipitation. The normal flight envelope includes design speeds up to the dive speed, and the maneuvering and gust envelopes defined in subpart C of part 25. The normal flight envelope includes the time from brake release prior to takeoff until the airplane comes to a complete stop on the runway after landing.
6 EVALUATION OF FLIGHT CONTROL OPERATION—§ 25.671(a).
6.1 The first sentence of § 25.671(a) states: “Each flight control system must operate with the ease, smoothness, and positiveness appropriate to its function.” Flight control systems should be designed so that, when a movement to one position has been selected, a different position can be selected without waiting for the completion of the initially selected movement, and the system should arrive at the final selected position without further attention. The movements that follow and the time taken by the system to allow the required sequence of selection should not adversely affect the controllability of the airplane. Additionally, pilot tasks associated with closed-loop flight control systems should be shown to be free from discontinuities in forces or gains that result in excessive forces, lack of control harmony, over-control, or pilot-induced
7 Evaluation of Flight Control Assembly—§ 25.671(b).
AC 25.671-1 oscillation. Such conditions are typically evaluated for compliance with subpart B regulations during flight testing. Advisory Circular 25-7D provides additional guidance.
6.2 The second sentence of § 25.671(a) states: “The flight control system must continue to operate and respond appropriately to commands, and must not hinder airplane recovery, when the airplane is experiencing any pitch, roll, or yaw rate, or vertical load factor that could occur due to operating or environmental conditions, or when the airplane is in any attitude.” This requirement is intended to ensure there are no features or unique characteristics (including, for example, flight control law errors that might occur at certain airplane bank angles) that could negatively affect either the proper operation of the system during the stated flight conditions or the pilot’s ability to recover from those conditions. The extent of “operating or environmental conditions” are those within the normal flight envelope, as defined in this AC. For airplanes equipped with a flight envelope protection system, the attitudes of the airplane to be evaluated should include cases outside the protected envelope. Compliance should be shown by evaluation of the closed-loop flight control system. Open-loop flight control systems should also be evaluated, if applicable.
7 EVALUATION OF FLIGHT CONTROL ASSEMBLY—§ 25.671(b).
7.1 Section 25.671(b) requires that each element of each flight control system be designed, or distinctively and permanently marked, to minimize the probability of incorrect assembly that could result in failure or malfunctioning of the system. Distinctive and permanent marking may be used only where design means are impractical. Examples of the consequences of incorrect assembly include the following: • An out-of-phase action.
• Reversal in the sense of the control.
• Interconnection of the controls between two systems where this is not intended.
• Loss of function.
7.2 Applicants should take adequate precaution in the design process to minimize the probability of incorrect installation, connection, or adjustment of parts in the flight control system. The design should also minimize the probability that a flight control system element can be installed in the incorrect location, or in the wrong direction or alignment, or otherwise assembled incorrectly. The maintenance manual should specify adequate procedures, but the applicant should not rely on maintenance procedures or automated testing alone to ensure correct assembly. The applicant should account for any possible manner in which system elements could be misassembled, and if incorrect assembly is possible, the design should be modified accordingly. Also, the design should be such that only appropriate software can be loaded into the flight control system.
8 Evaluation of Flight Control System Failures—§ 25.671(c).
AC 25.671-1 8 EVALUATION OF FLIGHT CONTROL SYSTEM FAILURES—§ 25.671(c).
8.1 General.
8.1.1 Section 25.671(c) requires that the airplane be shown by analysis, test, or both, to be capable of continued safe flight and landing following failures or jams in the flight control system within the normal flight envelope.
8.1.2 Section 25.671(c)(1) requires the evaluation of any single failure, excluding the types of failures defined in § 25.671(c)(3). Section 25.671(c)(1) also requires that any single failure be considered, suggesting that an alternative means of controlling the airplane or an alternative load path be provided in the case of a single failure. All single failures must be considered, even if they are shown to be extremely improbable.
8.1.3 Section 25.671(c)(2) requires the evaluation of any combination of failures not shown to be extremely improbable, excluding the types of failures defined in § 25.671(c)(3).
Some combinations of failures, such as dual electrical system or dual hydraulic system failures, or any single failure in combination with any probable electrical or hydraulic system failure, are normally not demonstrated as being extremely improbable.
8.1.4 Relationship between §§ 25.671(c) and 25.1309 .
8.1.4.1 Section 25.1309 applies to all systems and equipment installed on the airplane, including the flight control system. Section 25.671(c) also applies to the flight control system. The safety requirements in § 25.671(c)(1) and (c)(2) correspond with those in § 25.1309(b)(1). There are no fundamental differences between these two sets of safety requirements as they apply to the flight control system. However, different methods of compliance may be used to comply with § 25.671(c)(1) and (c)(2) as compared to § 25.1309(b)(1).
8.1.4.2 Section 25.671(c)(1) and (c)(2) require the airplane be capable of continued safe flight and landing after any single failure and after any combination of failures not shown to be extremely improbable.
Section 25.1309 requires that these failure conditions not be catastrophic.
While worded differently, these requirements are equivalent. A flight control system failure condition that would prevent continued safe flight and landing should be classified as catastrophic. This AC provides specific criteria unique to the assessment of flight control system failures.
Advisory Circular 25.1309-1B also provides guidance on assessing failure conditions that applies to the flight control system.
8.1.4.3 Operating and environmental conditions within the normal flight envelope should be considered in combination with § 25.671(c)(1) and (c)(2) failure conditions as described in AC 25.1309-1B, section 7.8.
AC 25.671-1 8.1.4.4 Section 25.1309(b)(2)-(5), (c) and (e) apply to the flight control system.
There are no requirements in § 25.671 that correspond to these subparagraphs.
8.1.5 Relationship between §§ 25.671(c) and 25. 302.
8.1.5.1 Section 25.671(c) applies to all flight control systems, including structural elements in systems. Section 25.302 applies to some flight control systems, as well as other systems, and to structures affected by those systems. Specifically, § 25.302 applies to systems that affect structural performance, either directly or as a result of a failure or malfunction. A system affects structural performance if it can induce loads on the airplane or can change the response of the airplane to maneuvers or to inputs such as gusts or pilot actions. Examples of these systems include flight control systems, autopilots, stability augmentation systems, load alleviation systems, and fuel management systems.
8.1.5.2 Flight control systems covered by § 25.302 must meet the structural criteria in that regulation. Flight control systems, whether covered by § 25.302 or not, must also meet §§ 25.671 and 25.1309 requirements, which go beyond structural criteria. For example, this AC includes maneuverability criteria following a flight control system failure.
8.1.6 Development errors (e.g., mistakes in requirements, design, or implementation) should be considered when demonstrating compliance with § 25.671(c). However, the guidance provided in this paragraph is not intended to address the means of compliance related to development errors. Development errors are managed through development assurance processes and system architecture. Guidance is provided in AC 25.1309-1B.
8.2 Evaluation of Flight Control Jam Conditions.
8.2.1 Section 25.671(c)(3) requires the applicant to evaluate any failure or event that results in a jam of a flight control surface or pilot control. Section 25.671(c)(3) is intended to address failure modes that would result in the control surface or pilot’s control being fixed, at the position commanded at the time of the failure, due to some physical interference. The position at the time of the jam should be any control position that would be normally encountered during takeoff, climb, cruise, normal maneuvering, descent, approach, and landing. In some architectures, component jams within the system may result in failure modes other than a fixed surface or pilot control. Those types of jams must be evaluated under §§ 25.671(c)(1), 25.671(c)(2), 25.1309, and 25.302 if applicable.
8.2.2 Section 25.671(c)(3)(i) requires the jam to be considered at any normally encountered position of the control surface or pilot control. In the past, determining a consistent and reasonable definition of normally encountered control positions has been difficult. A review of in-service fleet experience showed that the overall rate of control system jams -6 -7 is approximately 10 to 10 per flight hour. The numerical definition of “extremely AC 25.671-1 -9 improbable” is a failure rate of less than 10 per flight hour. Therefore, considering the in-service data, a reasonable definition of normally encountered positions represents the range of control surface deflections (from neutral to the largest deflection) expected to occur in 1000 random operational flights, without considering other failures, for each of the flight segments within the normal flight envelope. The applicant may determine appropriate “normally encountered positions” using this criterion, if it has adequate data that is relevant to the airplane being certified.
8.2.3 In lieu of using in-service data as described in paragraph 8.2.2 of this AC, an applicant may use the performance-based criteria outlined in paragraph 8.3 of this AC to establish acceptable control surface deflections. These criteria were developed to eliminate any differences between airplane types. The performance-based criteria prescribe environmental and operational maneuver conditions. The resulting deflections may be considered normally encountered positions for compliance with § 25.671(c)(3).
8.2.4 Section 25.671(c)(3) requires that the airplane be capable of landing with a flight control jam, and that the airplane be evaluated for jams anywhere in the normal flight envelope. However, § 25.671(c)(3)(ii) allows the applicant to not account for jams that occur immediately before touchdown if the risk of a potential jam is minimized to the extent practical. The reason for this exception is that recovery may not be achievable when considering time delays in initiating recovery just before touchdown. To minimize the potential risk of jams occurring in this time, the applicant should perform a qualitative analysis to identify jams that could occur, with the purpose of eliminating, alleviating, or mitigating the effects of such jams. This qualitative analysis should show that all practical precautions have been taken to minimize the risk of a potential jam occurring immediately before touchdown. The phrase “immediately before touchdown” means the time before touchdown in which recovery is not achievable for the jam in question when considering time delays in initiating recovery. This time and the corresponding distance above the ground can vary among different airplane types and for different flight control systems.
8.2.5 For jams that occur during takeoff, the applicant may assume that if the jam is detected prior to V1, the takeoff will be rejected.
8.2.6 Section 25.671(c)(3)(iii) states that in the presence of a jammed flight control surface or pilot control, additional failure conditions that could prevent continued safe flight and landing must have a combined probability of 1/1000 or less. This is intended to minimize the exposure of latent failures that could occur in the flight control systems needed to mitigate the effects of a flight control jam.
8.2.6.1 To show compliance with § 25.671(c)(3)(iii), the applicant should evaluate elements of the flight control system that are needed to ensure continued safe flight and landing following the flight control jam condition. These could include elements such as a jam breakout or override, disconnect means, alternate surface control, alternate electrical or hydraulic sources, alternate cable paths, or automated systems designed to address jams, such as automatic flare systems. The failure rate of any AC 25.671-1 such element should be multiplied by its maximum exposure time to determine the probability that the element will be failed when the jam occurs. The probability of all such failure conditions, when combined, must total 1/1000 or less.
8.2.6.2 The probability criterion of 1/1000 is not a failure rate but a time-based probabilistic parameter intended to ensure a minimum residual airplane level of safety following a jam regulated by § 25.671(c)(3). This analysis should help determine intervals for scheduled maintenance activity or operational checks that ensure the availability of alleviation or compensation means.
8.2.7 An applicant may use alleviation to show compliance with § 25.671(c)(3). For this purpose, alleviation may include automatic or manual system reconfigurations, or any other features that eliminate or reduce the consequences of a jam or permit continued safe flight and landing. A local structural failure (for example, via a mechanical fuse or shear-out) that could lead to a surface departure from the airplane should not be used as a means of jam alleviation.
8.2.8 Only the airplane rigid body modes need to be considered when evaluating the airplane response to maneuvers and continued safe flight and landing. All approved airplane gross weights and center-of-gravity locations should be considered when complying with § 25.671(c). However, only critical combinations of gross weight and center of gravity need be evaluated.
8.2.9 Section 25.683 requires testing of the control system to show the system is free from jamming. The referenced CATA paper provides guidance on compliance with this regulation.
8.2.10 Section 25.685 requires each control system be designed and installed to prevent jamming. As part of compliance with this requirement, the applicant should perform a qualitative assessment of the flight control system to identify and address potential jamming scenarios and eliminate any potential sources of jamming.
8.3 Determination of Normally Encountered Flight Control Surface or Pilot Control Positions.
8.3.1 General.
8.3.1.1 Section 25.671(c)(3) requires the evaluation of a jammed flight control surface or pilot control at any normally encountered position of that flight control surface or pilot control. The control positions specified in paragraphs 8.3.2 through 8.3.8 below pertain to both the pilot control and the control surface deflections that are associated with those control positions, and they may be considered normally encountered positions for compliance with § 25.671(c)(3). Lateral (roll), longitudinal (pitch), and directional (yaw) control positions are provided for the takeoff and in- AC 25.671-1 flight phases, but not for the landing phase. The applicant may propose control positions for the landing phase if such jams are being evaluated.
See paragraph 8.2.4 . Takeoff is the time between brake release and 35 feet above ground level (AGL). The in-flight phase is from 35 feet after takeoff to 50 feet AGL prior to touchdown and includes climb, cruise, normal maneuvering, descent, and approach. Landing is the time from 50 ft AGL prior to touchdown up to the complete stop of the airplane on the runway.
8.3.1.2 Although 1 in 1000 operational takeoffs is expected to include crosswinds on the order of 25 knots, the short exposure time associated with a jam occurring between V and V allows usage of a less conservative 1 LOF crosswind magnitude when determining normally encountered lateral and directional control positions. Given that lateral and directional controls are continuously used to maintain runway centerline in a crosswind takeoff, and control inputs greater than that necessary at V will occur at speeds below V , any jam in these control axes during a crosswind takeoff will normally be detected prior to V . Considering the control jam failure rate -6 -7 of approximately 10 to 10 per flight hour combined with the short exposure time between V and V , a reasonable crosswind level for 1 LOF determination of jammed lateral or directional control positions during takeoff is 15 knots.
8.3.1.3 The jam positions to be considered in showing compliance include any position up to the maximum position determined by the following maneuvers. The maneuvers and conditions described in this section are only to provide the control surface and pilot control deflections to evaluate continued safe flight and landing capability; they are not to represent flight test maneuvers for such an evaluation. For airplanes with stability augmentation or other systems that move control surfaces independent of pilot controller positions, the control surface deflections used to evaluate continued safe flight and landing capability should be established by the normal airplane control system response to the maneuvers and conditions described in this section.
8.3.2 Jammed Lateral Control Positions.
8.3.2.1 Takeoff.
The lateral control position for wings-level at V in a steady crosswind of 15 knots at a height of 10 meters above the takeoff surface. Variations in wind speed from a height of 10 meters can be obtained using the following relationship: 1/7 V = V * (H /10.0) alt 10 meters desired Where V = Wind speed in knots at 10 meters above ground 10 meters level (AGL) AC 25.671-1 V = Wind speed at desired altitude (knots) alt H = Desired altitude for which wind speed is sought, but not lower desired than 1.5 meters.
8.3.2.2 In-flight.
8.3.2.2.1 The lateral control position to sustain a 12 degree-per-second steady roll rate from 1.23 V to V /M or V , as appropriate, but not greater SR1 MO MO FE than 50 percent of the control input.
8.3.2.2.2 Directional control inputs may only be used to the extent necessary to minimize sideslip.
8.3.3 Jammed Longitudinal Control Positions.
8.3.3.1 Takeoff.
Three longitudinal control positions should be evaluated: 8.3.3.1.1 Any control position from the position the controls naturally assume without pilot input at the start of the takeoff roll to the position that occurs at V using the manufacturer’s recommended procedures.
Note: It may not be necessary to consider this case if it can be shown that the pilot is aware of the jam before reaching V (for example, through a manufacturer’s recommended AFM procedure).
8.3.3.1.2 The longitudinal control position at V based on the manufacturer’s recommended procedures including consideration for any runway condition for which the airplane is approved to operate.
8.3.3.1.3 Using the manufacturer’s recommended procedures, the peak longitudinal control position to achieve a steady airplane pitch rate of the lesser of 5 degrees per second or the pitch rate necessary to achieve the speed used for all-engines-operating initial climb procedures (V +XX) at 35 feet.
8.3.3.2 In-flight.
The maximum longitudinal control position is the greater of the following: 8.3.3.2.1 The longitudinal control position required to achieve steady state normal accelerations from 0.8g to 1.3g at speeds from 1.23 V to V /M or SR1 MO MO V as appropriate.
FE, 8.3.3.2.2 The peak longitudinal control position commanded by the stability augmentation or other automatic system in response to atmospheric discrete vertical gust defined by 15 feet per second (fps) from sea level to 20,000 feet.
AC 25.671-1 8.3.4 Jammed Directional Control Positions. Takeoff.
The directional control position for takeoff at V1 in a steady crosswind of 15 knots (at a height of 10 meters above the takeoff surface). Variations in wind speed from a height of 10 meters can be obtained as shown in paragraph 8.3.2.1.
8.3.4.2 In-flight.
The directional control position is the greater of the following: 8.3.4.2.1 The peak directional control position commanded by the stability augmentation or other automatic system in response to atmospheric discrete lateral gust defined by 15 fps from sea level to 20,000 feet.
8.3.4.2.2 Directional control position required for lateral/directional trim from 1.23 V to the maximum all engines operating airspeed in level flight SR1 with climb power, but not to exceed V /M or V as appropriate.
MO MO FE While more commonly a characteristic of propeller aircraft, this addresses any lateral or directional asymmetry that can occur in flight with symmetric power.
8.3.5 Control Tabs, Trim Tabs, and Trimming Stabilizers.
8.3.5.1 Any tabs installed on control surfaces are assumed jammed in the position associated with the normal deflection (as defined in this section) of the control surface on which they are installed.
8.3.5.2 Trim tabs and trimming stabilizers are assumed jammed in the positions associated with the manufacturer’s recommended procedures for takeoff, and normally used throughout the flight to trim the airplane from 1.23 V to V /M or V , as appropriate.
SR1 MO MO FE 8.3.6 Speed Brakes.
The applicant should assume that speed brakes are jammed in any position for which the speed brakes are approved to operate during flight at any speed from 1.23 V to SR1 V /M or V , as appropriate. Asymmetric extension and retraction of the speed MO MO FE brakes should be considered. Roll spoiler jamming (asymmetric spoiler panel) is addressed under paragraph 8.3.2 of this AC.
8.3.7 High Lift Devices.
Leading edge and trailing edge high lift devices should be assumed to jam in any position for takeoff, climb, cruise, approach, and landing. Applicants should analyze the potential for skew, and asymmetric extension and retraction, of high lift devices.
Section 25.701 contains a requirement for flap and slat mechanical interconnection unless the airplane has safe flight characteristics with asymmetric flap and slat positions.
8.3.8 Load Alleviation Systems.
AC 25.671-1 8.3.8.1 Gust Load Alleviation Systems.
At any airspeed between 1.23 V to V /M or V as appropriate, the SR1 MO MO FE, control surfaces are assumed to jam in the maximum position commanded by the gust load alleviation system in response to a discrete atmospheric gust with the following reference velocities: • 15 fps equivalent airspeed (EAS) from sea level to 20,000 feet (vertical gust), • 15 fps EAS from sea level to 20,000 feet (lateral gust).
8.3.8.2 Maneuver Load Alleviation Systems.
At any airspeed between 1.23 V to V /M or V , as appropriate, the SR1 MO MO FE control surfaces are assumed to jam in the maximum position commanded by the maneuver load alleviation system during a pull-up maneuver to 1.3g or a pushover maneuver to 0.8g.
8.4 Assessment of Continued Safe Flight and Landing.
To show, as required by § 25.671, that the airplane remains capable of safe flight and landing after a flight control system failure, the applicant should consider the following maneuverability and structural strength criteria. A pilot assessment of the airplane handling qualities should be performed, although this does not supersede the maneuverability criteria provided below.
8.4.1 Flight Characteristics.
8.4.1.1 General.
8.4.1.1.1 Following a control system failure, appropriate operating procedures may be used, including system reconfiguration, operating limitations, and flightcrew resource management. The procedures necessary for safe flight and landing should not require exceptional piloting skill or strength.
8.4.1.1.2 Additional means of control, such as a trim system, may be used if the applicant can show that the systems are available and effective. Credit should not be given for use of differential engine thrust to maneuver the airplane. However, differential thrust may be used following the recovery to maintain lateral or directional trim following the flight control system failure.
8.4.1.1.3 For the longitudinal pilot control or control surface jam during takeoff prior to rotation, the applicant should show that the airplane can be safely rotated for liftoff without consideration of field length available.
8.4.1.2 Transient Response.
8.4.1.2.1 There should be no unsafe conditions during the transient condition following a flight control system failure. The evaluation of jam conditions AC 25.671-1 per § 25.671(c)(3) may be assumed to begin at 1g wings-level flight. For failure conditions addressed by § 25.671(c)(1) and (c)(2), operating and environmental conditions should be considered as described in paragraph 8.1.4.3 . During the transient response, continued safe flight and landing is generally defined as not exceeding any one of the following: • A load on any part of the primary structure sufficient to cause a catastrophic structural failure.
• Catastrophic loss of flight path control.
• Exceedance of V DF /M DF .
• Catastrophic flutter.
• Excessive vibration or buffeting.
• Bank angle in excess of 90 ° .
8.4.1.2.2 In connection with the transient response, applicants must show compliance with § 25.302 for applicable failure conditions. While V is F normally an appropriate airspeed limit to be considered regarding continued safe flight and landing, temporary exceedance of V may be F acceptable as long as the requirements of § 25.302 are met.
8.4.1.2.3 Section 8.3 of this AC provides a means of determining control surface deflections for the evaluation of flight control jams. In some cases, airplane roll or pitch rate, or normal acceleration are used as a basis to determine these deflections. The roll or pitch rate and/or normal acceleration used to determine the control surface deflection need not be included in the evaluation of the transient condition. For example, the in-flight lateral control position determined in paragraph 8.3.2.2 of this AC is based on a steady roll rate of 12 degrees per second. When evaluating this condition, whether by analysis, simulation, or in-flight demonstration, the resulting control surface deflection is simply input while the airplane is in wings-level flight, at the appropriate speed, altitude, and so forth. During this evaluation, the airplane’s actual roll or pitch rate may or may not be the same as the roll or pitch rate used to determine the jammed control surface position.
8.4.1.3 Delay Times.
8.4.1.3.1 Applicants should account for potential delays in pilot recognition, reaction, and operation of any disconnect systems, if applicable: Delay = Recognition + Reaction + Operation of Disconnect AC 25.671-1 8.4.1.3.2 Recognition is the time from the failure condition to the point at which a pilot in service operation may be expected to recognize the need to take action. Recognition of the malfunction may be through the behavior of the airplane or a reliable failure alerting system, and the recognition point should be identified but should not normally be less than 1 second. For flight control system failures, except the type of jams addressed in § 25.671(c)(3), control column or wheel movements alone should not be used for recognition.
8.4.1.3.3 Applicants should use the reaction times in the following table: Table 1. Reaction Times for Flight Conditions Flight Condition Reaction Time On ground 1 second* In air (<1,000 feet AGL) 1 second* Manual flight (>1,000 feet AGL) 1 second* Automatic flight (>1,000 feet AGL) 3 seconds * 3 seconds if control must be transferred between pilots.
8.4.1.3.4 The time required to operate any disconnect system should be measured either through ground tests or during flight testing. This value should be used during all analysis efforts. However, flight testing or manned simulation that requires the pilot to operate the disconnect includes this extra time; therefore, no additional delay time would be needed for these demonstrations.
8.4.1.4 Maneuver Capability for Continued Safe Flight and Landing.
The applicant should show that each of the following maneuvers can be performed, using the procedures specified in the AFM, following the failure: 8.4.1.4.1 A steady 30 ° banked turn to the left and right.
8.4.1.4.2 A roll from a steady 30 ° banked turn through an angle of 60 ° so as to reverse the direction of the turn in not more than 11 seconds. (In this maneuver, the rudder may be used to the extent necessary to minimize sideslip, and the maneuver may be unchecked.)
8.4.1.4.3 A pushover maneuver to 0.8g, and a pull-up maneuver to 1.3g.
AC 25.671-1 8.4.1.4.4 A wings-level landing flare in a 90 ° crosswind of up to 10 knots (measured at 10 meters above the ground).
Note: For the case of a lateral or directional control system jam during takeoff that is described in paragraph 8.3.2.1 or 8.3.4.1 , respectively, the applicant should show that the airplane can safely land on a suitable runway with any crosswind from 0 knots to the crosswind level and direction at which the jam was established.
8.4.1.4.5 The airplane remains on the paved runway surface during the landing roll, until reaching a complete stop.
8.4.1.5 Control Forces.
8.4.1.5.1 The short- and long-term control forces should not be greater than 1.5 times the short- and long-term control forces allowed by § 25.143(d).
8.4.1.5.2 The FAA has typically considered “short-term,” as used in § 25.143, to mean the time required to accomplish a configuration or trim change.
However, taking into account the capability of the flightcrew to share the workload, the short-term forces of § 25.143 may be appropriate for a longer duration, such as the evaluation of a jam on takeoff and return to landing. Additionally, the flightcrew may be able to control the airplane by other means, such as applying alternate control in lieu of the jammed control. In such case, procedures on load sharing or control by other means should be provided in the AFM and should be evaluated.
8.4.1.5.3 During the recovery following the failure, transient control forces may exceed these criteria to a limited extent.
8.4.2 Structural Strength for Flight Control System Failures.
8.4.2.1 Failure Conditions Specified in § 25.671(c)(1) and (c)(2).
The applicant should show that the airplane maintains structural integrity during the transient response and for continued safe flight and landing.
This should be accomplished by showing compliance with § 25.302, where applicable. For systems not covered by § 25.302, the criteria in that regulation may be used. In lieu of those criteria, the airplane should be shown capable of withstanding the loads occurring during the transient response with a factor of safety of 1.25. For the continuation of flight, the following loads should be applied: For failures that would be detected, the loads resulting from the conditions specified in paragraphs 8.4.2.2.1 and 8.4.2.2.2, considered as ultimate; for failures that would not be detected, the loads specified in § 25.302(c)(2)(i)(A)-(E), considered as ultimate. See also § 25.1329(g).
9 Evaluation of All-Engines-Failed Condition—§ 25.671(d).
AC 25.671-1 8.4.2.2 Jam Conditions Specified in § 25.671(c)(3).
Following a jam, the applicant should ensure that the flight control system can withstand the loads occurring as a result of the jam. This would include the mitigating effects of any shear-out or override functions used to alleviate the jam. The applicant should also show that the aircraft maintains structural integrity for continued safe flight and landing. For these conditions, the loads, considered as ultimate, should be derived from the following conditions, considered separately, at speeds up to the maximum speed allowed for the jammed position or for the failure condition.
8.4.2.2.1 Balanced maneuver of the airplane between 0.25g and 1.75g with high lift devices fully retracted and in en route configurations, and between 0.6g and 1.4g with high lift devices extended.
8.4.2.2.2 Vertical and lateral discrete gusts corresponding to 40 percent of the limit gust velocity specified at V in § 25.341(a) with high lift devices fully C retracted, and a 17 fps vertical and 17 fps head-on gust with high lift devices extended.
9 EVALUATION OF ALL-ENGINES-FAILED CONDITION—§ 25.671(d).
9.1 Explanation.
Section 25.671(d) states: “If all engines fail at any point in the flight, the airplane must be controllable, and an approach and flare to a landing and controlled stop, and flare to a ditching, must be possible without requiring exceptional piloting skill or strength.” 9.1.1 The intent of § 25.671(d) is to assure that in the event of failure of all engines, and given the availability of a suitable runway, the airplane will be controllable and an approach and flare to a landing and controlled stop is possible. Although the rule assumes that a suitable runway would be available, the FAA recognizes that, with all engines inoperative, it may not be possible to reach a suitable runway or landing surface; in this case, the airplane must still be able to make a flare to landing attitude.
The rule also requires that a flare to a ditching be possible in the event all engines fail.
9.1.2 Compliance with § 25.671(d) generally necessitates that fully powered flight control systems lacking manual reversion capability must have a source for emergency power, such as an air-driven generator, windmilling engines, batteries, or other power source capable of providing adequate power to the flight control system through landing.
9.1.3 An applicant may use analysis, simulation, or any combination thereof to show compliance in lieu of flight test, if the applicant shows the method to be reliable.
AC 25.671-1 9.2 Procedures.
9.2.1 Section 25.671(d) requires applicants to show that it is possible, without requiring exceptional piloting skill or strength, to maintain control following the failure of all engines. This showing should include the time it takes for activating any backup systems. The airplane should also remain controllable during restart of the most critical engine, while following the engine restart procedures recommended in the AFM.
9.2.2 The most critical flight phases, especially for airplanes with emergency power systems dependent on airspeed, are likely to be takeoff and landing. Credit may be taken for hydraulic pressure or electrical power produced while the engines are spinning down and any residual hydraulic pressure remaining in the system. Sufficient power must be available to complete a wings-level approach and flare to a landing and controlled stop.
Analyses or tests may be used to demonstrate the capability of the control systems to maintain adequate hydraulic pressure and electrical power during the time between the failure of the engines and the activation of any backup systems. If any of the backup systems rely on aerodynamic means to generate power, then a flight test demonstration should be performed to demonstrate that the backup system could supply adequate electrical and hydraulic power to the flight control systems. The flight test should be conducted at the minimum practical airspeed – in accordance with AFM recommendations – that would be required to perform an approach and flare to a safe landing and ditching attitude.
9.2.3 The maneuver capability following the failure of all engines should be sufficient to complete an approach and flare to a landing, and flare to a ditching. Note that the airplane weight could be extremely low (for example, the engine failures could be due to fuel exhaustion). The maximum speeds for approach and landing may be limited by other requirements (for example, tire speeds, flap, or landing gear speeds, and so forth), or by an evaluation of the average pilot’s ability to conduct a safe landing or ditching.
At an operational weight determined for this case and for any other critical weights and centers of gravity identified by the applicant, and at speeds down to the approach speeds appropriate to the airplane configuration, the airplane should be capable of the following: 9.2.3.1 A steady 30 ° banked turn to the left and right.
9.2.3.2 A roll from a steady 30 ° banked turn through an angle of 60 ° so as to reverse the direction of the turn in not more than 11 seconds. (In this maneuver, the rudder may be used to the extent necessary to minimize sideslip, and the maneuver may be unchecked.)
9.2.3.3 A pushover maneuver to 0.8g, and a pull-up maneuver to 1.3g.
9.2.3.4 A wings-level landing flare in a 90 ° crosswind of up to 10 knots (measured at 10 meters above the ground).
11 Evaluation of Flight Control System Submodes—§ 25.671(f).
12 Acceptable Means of Compliance.
13 evaluation of Fly-by-wire FLIGHT CONTROL systems.
AC 25.671-1 11 EVALUATION OF FLIGHT CONTROL SYSTEM SUBMODES—§ 25.671(f).
11.1 Section 25.671(f) requires appropriate flight crew alerting be provided whenever the airplane enters any mode that significantly changes or degrades the normal handling or operational characteristics of the airplane. Flightcrew alerting must meet the requirements of §§ 25.1309 and 25.1322. Some systems, especially electronic flight control systems, have sub-modes of operation not restricted to being either on or off.
The means provided to the flightcrew to indicate the current sub-mode of operation may be different from conventional flight crew alerting, provided it meets the requirements in §§ 25.1309 and 25.1322.
11.2 Mode transitions – When the flight control system transitions from one mode to another, the transient effects should not prevent continued safe flight and landing or the ability to meet the criteria in paragraph 8.4.1.2 of this AC.
11.3 Loss of protection functions due to mode changes – Mode changes can result in loss of protection functions. Appropriate flight crew alerting should be provided if the loss of these protection functions significantly degrades the normal handling or operational characteristics of the airplane.
12 ACCEPTABLE MEANS OF COMPLIANCE.
The FAA recognizes that it may be neither practical nor appropriate to demonstrate compliance by flight test for all the failure conditions noted in this AC. Except as provided elsewhere by regulation or policy, an applicant may show compliance by analysis, background simulation, a piloted simulator, flight test, or combination of these methods as agreed with the FAA. Simulation methods should include an accurate representation of the airplane characteristics and of the pilot response, including time delays as specified in paragraph 8.4.1.3 of this AC. Compliance with § 25.671 may necessitate flight manual abnormal procedures. Verification of the efficacy of these procedures may be accomplished in flight, or by using a validated piloted simulator if the agreement of the FAA is previously obtained. Advisory Circular 25-7D, or later approved revision, provides guidance on simulation and the acceptable use of simulations.
13 EVALUATION OF FLY-BY-WIRE FLIGHT CONTROL SYSTEMS .
13.1 Evaluation of Command Signal Integrity This section provides guidance and identifies issues related to command signal integrity that should be investigated for airplanes using fly-by-wire (FBW) flight controls to comply with the provisions of §§ 25.671, 25.1301, and 25.1309. It is necessary to ensure that any flight control system control signals will not be adversely altered by internal and external interference. This section documents a means of compliance with §§ 25.671, 25.1301, and 25.1309 that ensures control signals are not adversely altered from internal and external interference.
AC 25.671-1 13.1.1 Conditions that Modify Command Signal or System Response.
13.1.1.1 Perturbations, as referred to in this section, are erroneous signals resulting from either internal or external causes, such that the intended command or control signals are altered from their intended characteristics.
13.1.1.2 Internal causes include, but are not limited to, the following: • Loss of data bits.
• Unwanted transients.
• Computer capacity saturation.
• Processing of signals by asynchronous microprocessors.
• Adverse effects caused by transport lag.
• Poor resolution of digital signals.
• Sensor noise.
• Corrupted sensor signals.
• Aliasing effects.
• Inappropriate sensor monitoring thresholds.
• Frozen or erroneous values • Structural interactions (such as control surface compliance or coupling of structural modes with control modes) that may adversely affect the system operation.
13.1.1.3 External causes include, but are not limited to, the following: • Lightning.
• Electromagnetic interference effects (e.g., motor interference, ship’s electrical power and power switching transients, smaller signals if they can affect flight control, transients due to electrical failures, etc.).
• High intensity radiated fields (HIRF).
13.1.2 Compliance.
13.1.2.1 Erroneous signals resulting from the internal and external causes listed in paragraphs 13.1.1.2 and 13.1.1.3 may lead to malfunctions that produce unacceptable system responses, such as limit cycle or oscillatory failures, control surface runaway conditions, loss or reduction of control authority, unresponsive control surface, erroneous control commands, false indication/alert, and command offsets etc. Since any of these responses could present a flight hazard, it is imperative that the command signal remain continuous and free from perturbations and common cause failures. Accordingly, special design measures should be employed to AC 25.671-1 maintain system integrity to ensure capability for continued safe flight and landing. These special design measures can be evaluated through the systems safety analysis process, provided specific care is directed to development methods and quantitative/qualitative showings of compliance. System safety analysis process and probability guidelines associated with hazard assessments is established in AC 25.1309-1B, or later revision.
13.1.2.2 Applicants should consider the following when evaluating compliance with the requirements of §§ 25.671, 25.1301, and 25.1309: • The flight control system should continue to perform its intended function regardless of any malfunction in the integrated systems environment of the airplane.
• Any system in the aerodynamic loop that has a malfunction should not produce hazardous loads or hazardous deviations in the flight path and must automatically recover its ability to perform critical functions upon removal of the effects of that malfunction.
• Systems in the aerodynamic loop should not be adversely affected during or after exposure to any sources of a malfunction.
• Any disruption to an individual unit or component that occurs as a consequence of a malfunction, and that requires annunciation and flightcrew action, should be evaluated to ensure that the failure can be recognized by the flightcrew, and that the recommended flightcrew action can be expected to result in continued safe flight and landing.
• An automatic change from a normal to a degraded mode that is caused by spurious signal(s) or malfunction(s) should meet the probability guidelines associated with the hazard assessment established in AC 25.1309-1B, or later revision.
• The flight control system should operate appropriately considering other systems’ behaviors. The applicant should assure the compatibility of automatic functions that may dynamically interact or affect flight control in both normal and anticipated abnormal operating conditions and ensure that such interactions (either by airplane response, or by data transfer or data saturation) do not result in inappropriate flight control responses. This should include any potential for adverse coupling of the dynamics of one automated flight function with another (e.g., coupling between automated thrust and flight control functions).
AC 25.671-1 13.1.3 Additional Testing.
The complexity and criticality of the FBW flight control system typically necessitates additional laboratory testing beyond that required as part of individual equipment qualification, validation, and software verification. It should be shown that either the FBW flight control system signals cannot be altered unintentionally, or that altered signal characteristics meet the following criteria: • Stable gain and phase margins are maintained for all control surface closed-loop systems. Pilot control inputs (pilot in the loop) are excluded from this evaluation.
• Sufficient pitch, roll, and yaw control power is available to provide control for continued safe flight and landing considering all FBW flight control system signal malfunctions that are not extremely improbable.
• The effect of spurious signals on the systems that are included in the aerodynamic loop do not result in unacceptable transients or degradation of the airplane’s performance. Specifically, signals that would cause a significant un-commanded motion of a control surface actuator are readily detected and deactivated, or the surface motion is arrested by other means in a satisfactory manner. Small amplitude residual system motions and oscillations may be acceptable if they are easily controllable.
• It should be shown that the output from the control surface closed-loop system does not result in un-commanded, sustained oscillations of flight control surfaces that can hinder safe flight and landing. The effects of minor instabilities may be acceptable, provided they are thoroughly investigated, documented, and understood. An example of an acceptable condition would be one where a computer input is perturbed by spurious signals, but the output signal remains within the design tolerances, and the system is able to continue in its selected mode of operation unaffected by that perturbation.
13.1.4 Demonstrating System Characteristics. In the context of showing and demonstrating these system characteristics, an acceptable means of compliance with § 25.671 should include: • Systematic airplane or laboratory validation that includes a realistic representation of all relevant interfacing systems and associated software, including the control system components that are part of pitch, roll, and yaw control. Closed-loop airplane simulation/testing should be included in this laboratory validation.
• Laboratory or airplane testing to demonstrate unwanted coupling of electronic command signals and their effects on the mechanical actuators and interfacing structure over the spectrum of operating frequencies.
• Analysis or inspection to substantiate that physical or mechanical separation and segregation of equipment or components are used to minimize any potential hazards.
AC 25.671-1 13.1.5 Demonstrating Signal Integrity. A successful demonstration of signal integrity should include all elements that contribute command and control signals to the “aerodynamic closed-loop,” which actuates the aerodynamic control surfaces (e.g., ailerons, elevator, rudder, stabilizer, flaps, spoilers, etc.). The “aerodynamic closed-loop” should be evaluated for the normal and degraded modes. Elements of the integrated aerodynamic closed-loop may include, for example, digital or analog flight control computers, power control units, control feedback, major data busses, and sensor signals for items such as air data, acceleration, rate sensors, commands to the surface position, respective power supply sources, etc. Autopilot systems (including feedback functions) should be included in this demonstration if they are integrated with the FBW flight control system.
13.2 Compliance Strategy for Fly-By-Wire Flight Control Systems 13.2.1 A strategy for showing compliance for electronic or fly-by-wire flight control systems should be developed and contain the following: • Determination of the flight control characteristics that require detailed and specific test strategies; and • Substantiation of the proposed strategy (flight tests, simulator tests, analyses, etc.)
covering the characteristics and features determined above.
13.2.2 In particular, the following characteristics of flight control laws should be covered: • Discontinuities, • Robustness versus piloted maneuvers and/or adverse weather conditions, • Protection priorities, • Control law mode changes with and without failures, and • Determination of critical scenarios for multiple failures .
13.2.3 The strategy should include, but should not be limited to, operational scenarios. The determination that an adequate strategy has been achieved should be based on engineering judgment.
OMB Control Number: 2120-0746 Expiration Date: 11/30/2024 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, completing and reviewing the collection of information.
All responses to this collection of information are voluntary FAA Order 1320.46D Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Barbara Hall, 800 Independence Ave, Washington, D.C. 20590.
If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to the Directives Management Officer (9-AVS-AIR-Directives-Management-Officer@faa.gov) or (2) faxing it to the attention of AVS/AIR (fax 202-267-1813).
Subject: Date: Please mark all appropriate line items: An error (procedural or typographical) has been noted in paragraph on page .
Recommend paragraph on page be changed as follows: In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)
Other comments: I would like to discuss the above. Please contact me.
Submitted by: Date: FAA Form 1320-73 (09/22) SUPERSEDES PREVIOUS EDITIONS