**\[4910-13-U\]**

**DEPARTMENT OF TRANSPORTATION**

**Federal Aviation Administration**

**\[Policy Statement Number ANM-99-01\]**

**Improving Flightcrew Awareness during Autopilot Operation**

**AGENCY:** Federal Aviation Administration, DOT.

**ACTION:** Final policy statement.

**SUMMARY:** This document announces an FAA general statement of policy
applicable to the type certification of transport category airplanes.
This document advises the public, in particular manufacturers of
transport category airplanes and automatic flight control (autopilot)
systems, that the FAA, when certifying automatic pilot installations,
intends to evaluate various items that will improve the flightcrew's
awareness during autopilot operation.

**FOR FURTHER INFORMATION CONTACT:** Gregg Bartley, Federal Aviation
Administration, Transport Airplane Directorate, Transport Standards
Staff, Airplane and Flight Crew Interface Branch, ANM 111, 1601 Lind
Avenue SW., Renton, WA 98055-4056; telephone (425) 227-2889; fax (425)
227-1100; e-mail: gregg.bartley@faa.gov.

**SUPPLEMENTARY INFORMATION:**

**Background**

Recent incidents and accidents that have occurred worldwide involving
pilot-autopilot interactions have emphasized to the FAA the need to
reexamine the current certification policy relative to autopilot issues.

In 1991, the National Transportation Safety Board (NTSB) began an
investigation of an incident involving a transport category airplane
that experienced an in-flight upset. When the airplane was in cruise at
flight level 310, the flightcrew noted that the inertial navigation
system "FAIL" lights had illuminated. When the flightcrew cross-checked
the instrument panel, they determined that the airplane was in a steep
right-wing-down banking angle. The flight lost nearly 10,000 feet of
altitude and the airplane approached supersonic speeds before the pilots
could complete a recovery. The airplane eventually made a successful
landing, and there were no injuries.

Investigation of the incident revealed, among other things, that a
failure in the autopilot system could cause an airplane to roll slowly
into a banking attitude. The roll rate induced from such a failure of
the autopilot system may be barely perceptible to the flightcrew; it
also may be difficult to detect without external visual attitude
references or continuous close monitoring of the flight attitude
instruments.

The NTSB has advised the FAA of its concern that some autopilot failures
can result in changes in attitude at rates that may be imperceptible to
the flightcrew, and thus remain undetected until the airplane reaches
significant attitude deviations.

**FAA Evaluation of Flightcrew/Flight Deck Automation Interfaces**

In 1994, the FAA launched a study to evaluate all flightcrew/flight deck
automation interfaces of current generation transport category
airplanes. The FAA chartered a Human Factors Team to conduct the study.
Team members included experts from the FAA, the European Joint
Airworthiness Authorities (JAA), and academia. The objective of the
study was to look beyond the label of "flightcrew error," and examine
the contributing factors from the perspective of design; flightcrew
training and qualifications; operations; and regulatory processes. The
FAA also tasked the team to develop recommendations to address any
problems identified.

With regard to autopilot issues, the Team identified several specific
problematic issues, including:

-   pilot/autopilot interactions that create hazardous out-of-trim
    conditions;

-   autopilots that can produce hazardous speed conditions and may
    attempt

-   maneuvers that would not normally be expected by a pilot; and

```{=html}
<!-- -->
```
-   insufficient wording in the Airplane Flight Manual regarding the
    capabilities and limitations of the autopilot.

**Regulatory Initiatives**

The FAA has acknowledged the autopilot issues raised by both the NTSB
and the Human Factors Team, and has taken steps to address them. For
example, the FAA has tasked the Aviation Regulation Advisory Committee
(ARAC) to review and propose harmonized revisions to the following
documents:

-   [14 CFR 25.1329]{.underline} ("Automatic pilot system"), which
    contains FAA's standards for certifying automatic pilot systems on
    transport category airplanes;

-   [14 CFR 25.1335]{.underline} ("Flight director systems"), which
    contains FAA's standards for certifying flight director systems on
    transport category airplanes; and

-   [Advisory Circular (AC) 25-1329-1A]{.underline} ("Automatic Pilot
    Systems Approval," dated July 8, 1968), which describes an
    acceptable means by which compliance with the automatic pilot
    installation requirements of § 25.1329 may be shown.

The work of ARAC currently is in progress.

**Current Certification Standards**

In general, the FAA has traditionally certified automatic pilot systems
on transport category airplanes in accordance with § 25.1329 on the
basis that:

-   the systems are conveniences to reduce flightcrew workload, and

-   the systems do not relieve the flightcrew of any responsibility for
    assuring proper flight path management.

As a result, the autopilot evaluation criteria contained in AC
25.1329-1A, are chiefly concerned with the effects of autopilot failures
on the airplane. The most recent revision to AC 25-7A, "Flight Test
Guide for Certification of Transport Category Airplanes," also defines
some evaluation criteria for determining whether the autopilot is
performing its intended function of relieving the flightcrew of some of
their control functions.

Accordingly, even when the flightcrew is not manually performing a
specific flight path control function, the FAA expects the flightcrew to
be "aware" when this function is not being performed safely, and to take
appropriate and timely corrective action. The installation certification
guidelines presented in AC 25.1329-1A, for example, state " . . . at
least one pilot \[should\] monitor the behavior of the airplane and
associated autopilot performance at all times."

In certifying all autopilot systems to date, the FAA has accepted the
premise that the capability for this flightcrew "awareness" comes from
either:

-   adherence to operational training and/or procedures,

-   a dedicated failure detection and annunciation feature on the flight
    deck; or

-   inherent aircraft operational cues (for example, a perceived change
    of aircraft attitude or change of engine noise).

As shown by recent relevant accident and incident cases, one cannot
assume that the flightcrew will reliably detect and accommodate adverse
autopilot behavior solely from inherent operational cues; other cues are
needed.

Inherent operational cues can be insufficient because:

1\. During normal autopilot operations, the flightcrew may not be able
to detect operational cues related to significant changes in aerodynamic
characteristics, such as drag and controllability, as effectively as
during manual operation. One specific example of this is the change of
control response or "feel" during low speed operations as ice
accumulates on the airplane surfaces, gradually and imperceptibly
reducing control authority. This condition can progress, intangible to
the flightcrew, until the autopilot exhausts its control authority and
automatically disengages. The flightcrew then is suddenly required to
take manual control of the airplane, which (1) is not in proper trim,
(2) is at a low margin-to-stall, and (3) has significantly degraded
aerodynamic performance.

2\. As pointed out by the NTSB, and recognized by the FAA, some
autopilot failures can result in changes in attitude at rates that may
be imperceptible to the flightcrew, and thus remain undetected until the
airplane reaches significant attitude deviations.

Neither the certification standards nor the relevant advisory material
currently contain actions or detailed guidance to address these types of
situations. Because of this, the FAA has found it necessary and
appropriate to provide additional guidelines for the provision of design
features needed to enable flightcrew control and awareness of the
unintended changes of speed and attitude during the operation of the
autopilot system.

**DISCUSSION OF PROPOSED POLICY STATEMENT**

On, August 30, 1999, the FAA issued a proposed general statement of
policy (64 FR 49043, September 9, 1999) concerning how the FAA would
evaluate various items when certifying automatic pilot installations in
transport category airplanes. \[A correction was later published on
September 20, 1999 (64 FR 50872).\] This information, presented in the
form of a general statement of policy, was intended to clarify, detail,
and formally state items that the FAA:

-   assumes about the flightcrew's awareness capability;

-   employs or accepts on an on-going basis in making compliance
    findings relative to autopilot systems; and

-   considers frequently in developing a means to prevent recurrences of
    the accident/incident situations described previously, or to enable
    an appropriate and timely response to other situations that could
    result in similar circumstances.

**Comments Received in Response to Proposed Policy Statement**

The FAA received comments on the proposed policy statement from five
commenters. Many of the comments submitted were editorial in nature and
did not take issue with the content of the policy itself. We have
incorporated most of these editorial changes into the final policy
statement where they made the information clearer or corrected
typographical errors.

The remainder of the comments were substantive in nature and addressed
the correctness, merit, or appropriateness of the policy's technical
details. These are discussed below, divided by the issues addressed and
by comments related to specific paragraphs of the proposed policy
statement.

**"Rulemaking by Policy"**

One commenter states that the proposed policy statement differs
significantly from existing regulatory and advisory material, and
constitutes "rulemaking by policy." This commenter further states that
industry would rather see a statement of the issue and defer the exact
mechanism to address that issue to the applicant. The commenter suggests
that any new direction should be harmonized with the activities of ARAC.

The FAA does not agree with the commenter. With regard to this policy
statement being "rulemaking by policy," all features discussed in the
policy statement are covered by the current 14 CFR § 25.1309
\[especially § 25.1309(c)\] and § 25.1329, as well as several other
regulations. This policy statement (and the planned revisions to the
associated advisory circulars) only defines one possible implementation
that would be acceptable to the regulatory authorities when determining
compliance with existing regulations. Neither this policy statement nor
any current or future advisory circulars define regulations.

The FAA does intend to incorporate all the material described in the
policy statement in the upcoming revision of AC 25.1329-1A. Likewise,
the European Joint Aviation Authorities (JAA) also plan to incorporate
this material into their parallel Advisory Circular Joint (ACJ) 25.1329.

**Change in Role of Flightcrew**

One commenter states that current autopilot systems have been shown, by
operational experience, to be safe. This commenter asserts that the new
policy would change the role of the flightcrew, who are currently
required to monitor the performance of an engaged autopilot at all
times. It could make them more dependent on automatic functions and,
thereby, less likely to be constantly monitoring the state of the
aircraft.

The FAA does not agree with this commenter. Crew alerting features are
intended to increase pilot awareness, not replace or reduce the
requirement for crew vigilance and professional aviation skills. Current
crew alerting features \-- such as Enhanced Ground Proximity Warning
System, Terrain Awareness and Warning System, Engine Fail Indications,
or any other alert on modern transport category aircraft \-- enhance
safety. The autopilot alert described in the policy statement is no
different in this respect.

While the autopilot systems currently in service are safe, there have
been several serious incidents and accidents of transport category
aircraft over the last 10 years that have involved the automatic
disconnection of an engaged autopilot when the aircraft was in a
mis-trimmed configuration or an unusual attitude. The new features
described in the policy statement are in direct response those incidents
and accidents.

The FAA does not intend for this policy to alter the roles and
responsibilities of the flightcrew as they are currently defined. The
autopilot alerts discussed are intended as an added safeguard to a
vigilant flightcrew. History has shown that pilots sometimes do miss
cues (be they subtle or overt) of a developing or ongoing unusual
situation. The accidents and incidents mentioned previously have
occurred when an engaged autopilot disconnected automatically during a
time when the aircraft was in a significantly mis-trimmed condition or
an unusual attitude. These accidents and incidents may have been avoided
if that condition had been brought to the attention of the flightcrew
prior to the disconnection of the autopilot. The autopilot alert
described in the policy statement is intended to preclude a recurrence
of accidents and incidents of that type.

**Conflict Between Policy and New Advisory Material or Rules**

Several commenters suggest that the policy statement should include
language specifying that rules or advisory material promulgated as a
result of the parallel work of ARAC (and the Flight Guidance Systems
Harmonization Working Group) would supersede this or any existing policy
statement if there is a conflict between the two.

The FAA does not consider the suggested language necessary. We plan to
"cancel" this policy statement when the next revision of AC 25.1329-1A
is published. As indicated previously, this policy statement is interim
guidance until the new revision of AC 25.1329-1A is issued. Therefore,
there is no need for language in the policy statement that would give
priority to any specific document.

**Comments on Paragraph 2., "Definitions"**

One commenter requests the FAA to clarify the definition of "hazardous
flight path deviations," which appeared as paragraph 2.c. in the
proposed policy statement. The commenter states that the term
"hazardous" is used in multiple ways and this may create confusion.

The FAA finds it appropriate to delete this definition from the final
policy statement to avoid confusion. Additionally, the term is not used
anywhere else in the policy statement, so its appearance under the
heading "Definitions" is not necessary.

**Comments on Paragraph 4., "System Response"**

Several commenters suggest various changes to proposed paragraph 4. to
make it clearer and more consistent with guidance that is already in or
planned for inclusion in FAA and JAA advisory material. For example, one
commenter suggests that paragraph 4.b. of the proposal be revised to
make clear that the autopilot should not be allowed to command unsafe
maneuvers, regardless of the ease of recovery. The commenter also
suggests that the restrictions on out-of-trim conditions in the event of
a manual autopilot disconnect, which were listed in proposed paragraph
4.d., should be added to paragraph 4.c.'s description of the automatic
disconnect case. Additionally, the commenter suggests that examples of
maneuvers that might be considered "dangerous" be included.

Other commenters state that the text of proposed paragraph 4.d. allows
no "credit" for a mis-trim warning and, thus, would require autopilots
to have a critical trim function, which most autopilots do not support.
Other commenters suggest use of the term "ultimate loads" instead of
"limit loads" in proposed paragraph 4.d., because catastrophic failure
conditions are normally associated with "ultimate loads," not "limit
loads." These commenters also suggest using the term "unsafe maneuver"
instead of "dangerous maneuver" (as used in proposed paragraph 4.f.),
because "dangerous" cannot be explicitly defined.

The FAA has considered these suggestions and has rewritten paragraph 4
with the following specific changes:

-   [Paragraph 4.a.]{.underline} is unchanged from the proposed version.

```{=html}
<!-- -->
```
-   [Paragraph 4.b]{.underline}. refers to the autopilot providing
    guidance or control, as appropriate, for the intended function in a
    safe and predictable manner.

-   [Paragraph 4.c]{.underline}. describes the expected system response
    to the presence of transient flight control movements during
    non-maneuvering flight and under dynamic conditions.

-   [Paragraph 4.d]{.underline}. describes the expected system response,
    relative to significant transient flight control movements, during
    automatic or manual disengagement of the autopilot.

-   [Paragraph 4.e]{.underline}. describes the expected system response,
    relative to significant transients, during other than normal
    conditions.

-   Proposed [paragraph 4.f]{.underline}. has been deleted as a result
    of these changes.

(Note that previous references to "dangerous" maneuvers and to "limit
loads" have been deleted from the final text.)

The wording in the final policy statement reflects the text that will
appear in the upcoming revision of AC 25.1329-1A.

**Comments on Paragraph 5., "Controls, Displays, and Alerting"**

Several commenters consider that the autopilot alert defined in
paragraph 5.e. of the policy statement constitutes a significant design
challenge. First, these commenters point out that paragraphs 5.e.(1) and
5.e.(2) require "the autopilot to remain engaged for some time period
after a failure has been detected by a monitor (assuming that a monitor
exists to detect all failure conditions)." To these commenters, this
appears contrary to safety in almost all failure conditions. Many
failure conditions require an immediate automatic disconnection of the
autopilot in order to minimize the adverse effects of the failure. If
autopilot engagement is maintained for some time after the failure, the
undesirable effects of the failure will persist and, consequently,
increase the severity of the failure condition.

Second, these commenters point to paragraph 5.e.(4), which lists the
conditions for which the flightcrew alert, and possibly automatic
disengagement of the autopilot, should be considered. The commenters
state that some of the warning conditions listed in that paragraph are
within the normal operating flight envelope, and that it would be
difficult to provide useful alerts without producing frequent nuisance
alarms.

The commenters request clarification on the intent of paragraph 5.e. and
the conditions that should or should not result in an automatic
disengagement.

The FAA agrees that clarification is necessary. We recognize that any
alert must be carefully designed so it does not cause a nuisance alert
and, in doing so, precipitate unnecessary crew actions. This policy
statement calls for a more advanced (earlier) autopilot alert to
increase the flightcrew\'s awareness of a potentially dangerous
condition that the flightcrew might not otherwise detect in a timely
manner.

Examples of situations that could warrant advance crew notification are
listed in paragraph 5.e.(4) of the policy statement. It is not required
that the crew be alerted prior to any automatic disconnect of an engaged
autopilot. All failure conditions that require an immediate automatic
disconnect, and whose onset cannot be detected prior to the actual
failure condition, must still cause an immediate automatic disconnect.
No preceding alert is required. We have clarified the wording of the
final policy statement in this regard.

**Comments on Paragraph 7., "Airplane Flight Manual"**

Several commenters consider the detailed list of design specifications
contained in paragraph 7 of the proposed policy statement inappropriate
for inclusion in an Airplane Flight Manual. One of these commenters
states that it is more appropriate for this information to be included
in Operations Manuals and training material. Another commenter states
that the AFM operating procedures should be limited to only a general
description of the autopilot capability. The commenters state that the
literal interpretation of what is asked for in this section would
require reproduction of extensive logical expressions that are
implemented in either hardware or software. These commenters question
the usefulness of this information for the flightcrew in actual flight
operations.

The FAA agrees somewhat with the commenters. We have revised paragraph 7
in the final policy statement to provide guidance on material that
should be provided in the AFM to ensure that the appropriate information
related to operation of the flight guidance system is translated into
air carrier operations. This information is similar to guidance that
will be provided in the upcoming revision to AC 25.1329-1A.

**EFFECT OF GENERAL STATEMENT OF POLICY**

Much of the information presented in this final policy statement has
been developed from service experience garnered and flightcrew
conventions practiced throughout the years since the guidance contained
in AC 25.1329-1A was published in 1968. The FAA has assembled this
information and is presenting it in this general statement of policy as
a set of "guidelines" that are appropriate for use with § 25.1329 for
autopilot certification.

Additionally, as discussed previously, actions currently are underway to
revise the applicable airworthiness standards (§ 25.1329) and associated
advisory material (AC 25.1329-1A) to more fully address the autopilot
system and other flight deck issues. Until then, the guidance provided
in this general statement of policy would serve as a reference to assist
in the certification of new autopilot systems.

The general policy stated in this document is not intended to establish
a binding norm; it does not constitute a new regulation and the FAA
would not apply or rely upon it as a regulation. The FAA Aircraft
Certification Offices (ACO) that certify transport category airplanes
and/or the automatic pilot systems installed on them should generally
attempt to follow this policy, when appropriate. However, in determining
compliance with certification standards, each ACO has the discretion not
to apply these guidelines where it determines that they are
inappropriate. The ACO should coordinate with the Transport Airplane
Directorate, for purposes of standardization, whenever the ACO
determines that some deviation from this policy is appropriate.
Applicants should expect that the certificating officials would consider
this information when making findings of compliance relevant to new
certificate actions.

Applicants may consider the material contained in this policy statement
as supplemental to that currently contained in AC 25.1329-1A when
developing a means of compliance with the relevant certification
standards.

As with all advisory material, this statement of policy identifies one
means, but not the only means, of compliance.

For the convenience of the reader, we have formatted this general
statement of policy in outline form.

**THE GENERAL STATEMENT OF POLICY**

**1. General**

1.a. Operational experience has shown that flightcrews may not have
adequate awareness of potentially hazardous aircraft states or adequate
capability to anticipate sudden, unexpected actions of the autopilot. In
this regard, the autopilot design should take into consideration
conditions that could create hazardous deviations in the flight path,
specifically \[ref: 14 CFR § 25.1329(f), "Automatic pilot system"\]:

-   conditions that could make continued autopilot operation unsafe; or

-   conditions that could cause the manual control of an upset following
    autopilot disengagement to require exceptional piloting skill or
    alertness.

Note that automatic disengagement may not be the safest autopilot
response for all cases, particularly with trim conditions that could
lead to a significant upset.

1.b. If automatic functions are provided that may be used with the
autopilot (e.g., automatic thrust control or yaw damper), and use of the
autopilot is permitted with any of these functions inoperative, then the
design of the autopilot should comply with the provisions of this
general policy statement and Advisory Circular 25.1329-1A, "Automatic
Pilot Systems Approval" with these functions operative and inoperative.

1.c. The autopilot should perform its intended function in all
configurations in which it may be used throughout all appropriate
maneuvers and environmental conditions, including turbulence and icing,
unless an appropriate operating limitation or statement is included in
the Airplane Flight Manual.

**2. Definitions**

2.a. The term [autopilot]{.underline} is synonymous with the [term
automatic]{.underline} pilot. The term autopilot includes the sensors,
computers, power supplies, servo-motors, servo-actuators, and associated
wiring necessary for its function. It includes any displays and controls
necessary for the pilot to manage and supervise the system.

2.b. The term [autothrust]{.underline} is synonymous with the [term
autothrottle]{.underline} or [automatic throttle control]{.underline}.

2.c. The term [extremely improbable]{.underline} is defined as the
average probability per flight hour of the occurrence of an event (e.g.,
a failure condition), which is on the order of 1 x 10^-9^ or less.
Catastrophic failure conditions must be extremely improbable \[ref. §
25.1309(b)(1)\].

2.d. The term [warning]{.underline} is defined as an indication for a
hazard requiring immediate corrective action by the flightcrew.

2.e. The term [caution]{.underline} is defined as an indication for an
event requiring immediate crew awareness and possibly requiring
subsequent timely corrective crew action.

**3. Design, Installation, and Maintenance**

3.a. The autopilot system design should not possess characteristics, in
normal operation or when failed, that would degrade safety or lead to an
unsafe condition, unless such failures can be limited by design or the
effects can be limited and mitigated by the pilot response within a
reasonable time. The allowable probability of any failure should be
based on its safety effects in accordance with the requirements of §
25.1309.

3.b. Adequate precautions should be taken in the design process, and
adequate procedures should be specified in the maintenance manual, to
prevent the incorrect installation, connection, or adjustment of parts
of the autopilot if such errors would create a hazard to the airplane
(e.g., torque clutches or limit switches with a range of adjustment such
that maladjustment could be hazardous).

3.c. The autopilot should be designed and installed so that the
tolerances demonstrated during certification tests can be maintained in
service.

**4. System Response**

4.a. The autopilot should not cause nuisance oscillations, undue control
activity, or sudden large attitude changes, especially when
configuration or power changes are taking place. All maneuvers should be
accomplished smoothly, accurately, and in a manner similar to normal
pilot control.

4.b. The autopilot should provide guidance or control, as appropriate,
for the intended function of the active mode(s) in a safe and
predictable manner within the normal flight envelope.

4.c. In non-maneuvering flight, the engagement of the autopilot should
be free of perceptible transient flight control movement. Under dynamic
conditions, including maneuvering flight, some minimal flight control
transients may be acceptable if they do not cause significant
operational difficulty for the flightcrew or unsafe conditions for the
occupants.

4.d. Under normal conditions, automatic or manual disengagement of the
autopilot should be free of significant transients or out of trim forces
that are not consistent with the maneuvers being conducted by the
airplane at the time of disengagement. If multiple autopilots are
engaged, any disengagement of an individual autopilot should be free of
significant transients and should not adversely affect the operation of
the remaining autopilot.

4.e. In other than normal conditions, disengagement of the autopilot may
result in a significant transient. The flightcrew should be able to
respond to a significant transient without:

-   exceptional piloting skill, alertness, or strength;

-   forces greater than those given in § 25.143 (c); and

-   accelerations or attitudes in the airplane that might result in a
    hazard to secured or non-secured occupants.

**5. Controls, Displays, and Alerting**

5.a. Unless the probability of failure of the quick-disconnect button on
the control wheel, or equivalent, is shown to be extremely improbable,
an alternative means of disengagement, that is readily accessible in
flight, should be provided.

5.b. The controls, displays, and alerts should be designed to minimize
crew errors.

5.c. Mode, state, status, and malfunction indications should be
presented in a manner compatible with the procedures and assigned tasks
of the flightcrew. The indications should be grouped in a logical and
consistent manner and be visible from each pilot\'s station under all
expected lighting conditions.

5.d. [Autopilot Disconnect Warning]{.underline}:

5.d.(1) Disengagement of the autopilot, whether intended by the pilot or
not, should trigger both an aural alert and visual warning during any
phase of flight, since immediate pilot action is required.

5.d.(2) The aural alert associated with the autopilot disconnect should
be unique and distinct. The aural alert should be cancelable by the
pilot pushing the quick-disconnect button on the control wheel or stick.
The aural alert should sound until cancelled by the pilot, except that a
minimum cycle should sound. If the autopilot is disengaged by means of
the quick-disconnect button, then an additional push of this button
should be required to cancel the aural alert.

5.e. An aural alert and a visual caution should be provided to the
flightcrew for conditions that:

-   could make continued autopilot operation unsafe, or

```{=html}
<!-- -->
```
-   could cause the manual control of an upset following autopilot
    disengagement to require exceptional piloting skill or alertness.

5.e.(1) The flightcrew alert should be generated before the conditions
lead to a situation that could require exceptional piloting skill or
alertness, such as an automatic disconnect while the airplane is in an
unusual attitude, significantly out of trim, or near stall warning.

5.e.(2) Whenever possible, the alert should provide the flightcrew
enough time to be prepared to place their hands on the controls and to
take appropriate corrective action (e.g., change thrust, set trim,
disconnect autopilot).

5.e.(3) The thresholds for triggering the flightcrew alert should be
designed carefully, with consideration for undue distraction (e.g.,
nuisance alerts) and potential "rippling" of multiple alerts triggered
by the same or related conditions, which could mask or override the
sounding of this alert.

5.e.(4) Conditions that should be considered for a flightcrew alert and
possibly automatic disengagement include, but are not limited to:

-   limits of autopilot control authority;

-   out-of-trim;

-   excessive trim rates; airspeeds greater than those intended for
    autopilot operations;

-   low speeds (e.g., less than 1.2 V~S1~ for the current flap
    configuration, but greater than 1.07 V~S~ ); and

-   bank and pitch angles beyond those intended for autopilot operation.

5.e.(5) Detected failure conditions that require an immediate autopilot
disconnect, such as a fault within the autopilot processing unit or a
failed autopilot servo, do not require an alert to be displayed prior to
automatic disconnection. Only those conditions that are sustained and/or
build up over time such that an advance warning could be given to the
flightcrew prior to automatic autopilot disengagement (e.g., the
autopilot close to its maximum authority in the roll axis for a specific
period of time), or conditions that would not by themselves cause an
automatic autopilot disengagement, are candidates for an alert.

5.f. The means provided to comply with § 25.1329(h) (mode indications
when coupled with airborne navigation equipment) should also give an
appropriate indication when:

5.f.(1) the autopilot cannot engage the mode selected by the flightcrew;
and

5.f.(2) the system automatically makes a mode change or mode
disengagement that is considered operationally significant and, perhaps,
unexpected. (For example, a change from altitude capture to altitude
hold is significant, but expected; while a change from vertical path
mode to vertical speed mode is both operationally significant and
unexpected.)

5.g. If the autopilot has envelope limiting or protection capability,
the system should provide an alert to indicate to the pilots when
envelope limiting or protection is invoked and the

condition is sustained and/or flightcrew action is necessary.

**6. Engagement:**

If a flight director is available and active, the autopilot should
engage in the same mode as the flight director and provide consistent
flight path guidance.

**7. Airplane Flight Manual (AFM).**

The following paragraphs provide guidance on material to be provided in
the Airplane Flight Manual (AFM) to ensure that the appropriate
information related to flight guidance system (FGS) operation is
translated into air carrier operations. For additional guidance, note
that FAA Advisory Circular (AC) 25.1581-1 ("Airplane Flight Manual,"
dated July 14 1997) addresses requirements of the AFM for transport
category aircraft and distinguishes between those aircraft that are used
in air carrier operations and those not in air carrier service. The
terminology used in the AFM should be consistent with the intended
operational use. Appropriate AFM information related to low-visibility
operations is addressed in:

-   AC 120-28D, "Criteria for Approval of Category III Weather Minima
    for Takeoff, Landing, and Rollout," and

-   AC 120-29A, "Criteria for Approving Category 1 and Category II
    Landing Minima for FAR 121 Operators."

**7.a. Limitations.** The Limitations section of the AFM presents those
FGS operating limitations appropriate to the airplane model as
established in the course of the type certification process, and as
necessary. The FGS operational limitations (should any exist) should
specify, but not be limited to, the following:

-   Minimum engagement altitude(s) or height(s), if and when necessary.

> [NOTE]{.underline}: If Minimum Engagement Altitude(s) or height(s) are
> not specified, then "maximum displacement deviation" information from
> a pertinent takeoff flight path and approach profile should be
> provided in the AFM Normal Procedures section, or in the associated
> Flight Crew Operation Manual (FCOM).

-   Mandatory disengagement requirements, if necessary.

-   Configuration/envelope restrictions, if and as applicable.

**7.b. Abnormal/Emergency Procedures.** Any FGS anomaly that is
addressed to the flight crew by a non-normal procedure must be included
in the AFM.

**7.c. Normal Procedures.**

7.c.(1) [General]{.underline}. The normal procedures for use of the FGS
should be documented in the AFM or Flight Crew Operation Manuals (FCOM),
as appropriate. These procedures should be demonstrated during the type
certification process. In lieu of specification of minimum engagement
altitude(s) or height(s), the AFM may alternately specify "maximum
displacement deviations" from a specified takeoff flight path, or from a
specified approach profile. This information may be based on typical
departure or approach flight paths suited for the aircraft type and for
and failure conditions that are determined applicable to the type of FGS
system and modes suitable for use.

7.c.(2) [Aircraft with Published Flight Crew Operation Manuals
(FCOM).]{.underline} Airplane Flight Manuals for aircraft for which the
manufacturer has published FCOM's should contain essential information
on normal operating procedures that are considered "peculiar" to the
operation of the FGS for the aircraft type or are otherwise necessary
for safe operation. System description, specification, and operational
procedures that are normally associated with flight guidance systems may
be described in the FCOM.

7.c.(3) [Aircraft without Published FCOM's]{.underline}. For aircraft
that rely on the AFM as the sole operating manual, the AFM should
contain operating information sufficient for crew reference. System
description, operation, checklists, and normal operating procedures
should be amplified in sufficient detail so that an appropriately
trained flight crew may operate the FGS under normal conditions.

**CONCLUSION**

As discussed previously, the FAA intends to update 14 CFR § 25.1329 and
associated Advisory Circular (AC) 25.1329-1A to more fully address the
autopilot issues found in this general statement of policy and others.
Until then, this general statement of policy serves as a reference to
supplement § 25.1329, and for use in the certification of new autopilot
systems. Please inform the appropriate flight controls and systems
designated engineering representatives (DER) of this proposed general
statement of policy.

Issued in Renton, Washington, on February 22, 2001.

ORIGINAL SIGNED BY:

D. L. Riggin, Acting Manager

Transport Airplane Directorate

Aircraft Certification Service