AMC 25.703 Take-off Configuration Warning Systems

ED Decision 2012/008/R

1.       PURPOSE. This AMC provides guidance for the certification of take-off configuration warning systems installed in large aeroplanes. Like all AMC material, this AMC is not mandatory and does not constitute a requirement. It is issued to provide guidance and to outline a method of compliance with the rules.

2.       RELATED CERTIFICATION SPECIFICATIONS.

CS 25.703, 25.1301, 25.1309, 25.1322, 25.1357, 25.1431, and 25.1529.

3.       RELATED MATERIAL.

a.       Federal Aviation Administration and EASA Documents.

(1)     Advisory Circular 25.1309-( ), System Design and Analysis and AC 25-11 Transport Category Airplane Electronic Display Systems. Advisory circulars can be obtained from the U.S. Department of Transportation, M-443.2, Subsequent Distribution Unit, Washington, D.C. 20590.

(2)     Report DOT/FAA/RD-81/38, II, Aircraft Alerting Systems Standardization Study, Volume II, Aircraft Alerting Systems Design Guidelines. This document can be obtained from the National Technical Information Service, Springfield, Virginia 22161.

(3)     FAA report, Review of Take-off Configuration Warning Systems on Large Jet Transports, dated April 29, 1988. This document can be obtained from the Federal Aviation Administration, Transport Airplane Directorate, 1601 Lind Avenue, S.W., Renton, Washington, 98055-4056.

(4)     EASA AMC 25.1322 (Alerting Systems).

(5)     EASA AMC 25-11 (Electronic Display Systems).

(6)     EASA AMC 25.1309 (System Design and Analysis).

(7)     EASA AMC 20-115 (Software Considerations for Airborne Systems and Equipment Certification)

b.       Industry Documents.

(1)     Aerospace Recommended Practice (ARP) 450D, Flight Deck Visual, Audible and Tactile Signals; ARP 4012/4, Flight Deck Alerting Systems (FAS). These documents can be obtained from the Society of Automotive Engineers, Inc. (SAE), 400 Commonwealth Drive, Warrendale, Pennsylvania 15096.

(2)     EUROCAE ED-14D/RTCA document DO-160D or latest version, Environmental Conditions and Test Procedures for Airborne Equipment; AMC 20-115, Software Considerations for Airborne Systems and Equipment Certification. RTCA documents can be obtained from the RTCA, One McPherson Square, Suite 500, 1425 K Street Northwest, Washington, D.C. 20005.

(3)     ARINC 726, Flight Warning Computer System. This document can be obtained from the ARINC, 2551 Riva Road, Annapolis, Maryland 21401.

4.       BACKGROUND. A number of aeroplane accidents have occurred because the aeroplane was not properly configured for take-off and a warning was not provided to the flight crew by the take-off configuration warning system. Investigations of these accidents have indicated a need for guidance material for design and approval of take-off configuration warning systems.

5.       DISCUSSION.

a.       Regulatory Basis.

(1)     CS 25.703, "Take-off warning system," requires that a take-off configuration warning system be installed in large aeroplanes. This requirement was introduced with JAR-25 Amendment 5 effective 1.1.79. On the FAR side, this was added to FAR Part 25 by Amendment 25-42 effective on March 1, 1978. CS 25.703 requires that a take-off warning system be installed and provide an aural warning to the flight crew during the initial portion of the take off roll, whenever the aeroplane is not in a configuration which would allow a safe take-off. The intent of this rule is to require that the take-off configuration warning system cover (a) only those configurations of the required systems which would be unsafe, and (b) the effects of system failures resulting in wrong surface or system functions if there is not a separate and adequate warning already provided. According to the preamble of FAR Part 25 Amendment 25-42, the take-off warning system should serve as "back-up for the checklist, particularly in unusual situations, e.g., where the checklist is interrupted or the take-off delayed." Conditions for which warnings are required include wing flaps or leading edge devices not within the approved range of take-off positions, and wing spoilers (except lateral control spoilers meeting the requirements of CS 25.671), speed brakes, parking brakes, or longitudinal trim devices in a position that would not allow a safe take-off. Consideration should also be given to adding rudder trim and aileron (roll) trim if these devices can be placed in a position that would not allow a safe take-off.

(2)     Prior to JAR-25 Amendment 5 and FAR Part-25 Amendment 25-42, there was no requirement for a take-off configuration warning system to be installed in large aeroplanes. Since this amendment is not retroactive, some large aeroplane models in service today may not have take-off configuration warning systems; however, all large turbojet transports currently in service, even those with a certification basis established prior to 1978, include a take-off configuration warning system in the basic design. These include the majority of large aeroplanes.

(3)     Other general rules such as CS 25.1301, 25.1309, 25.1322, 25.1357 and 25.1431 for electronic system installations also apply to take-off configuration warning systems.

b.       System Criticality.

(1)     It has been Aviation Authorities policy to categorise systems designed to alert the flight crew of potentially hazardous operating conditions as being at a level of criticality associated with a probable failure condition. (For a definition of this terminology together with discussions and guidelines on the classification of failure conditions and the probability of failures, see AMC 25.1309). This is because failures of these systems, in themselves, are not considered to create an unsafe condition, reduce the capability of the aeroplane, or reduce the ability of the crew to cope with adverse operating conditions. Other systems which fall into this category include stall warning systems, overspeed warning systems, ground proximity warning systems, and windshear warning systems.

(2)     Even though AMC 25.1309 does not define an upper probability limit for probable failure conditions, generally, it can be shown by analysis that such systems have a probability of failure (of the ability to adequately give a warning) which is approximately 1.0 x 10E-3 or less per flight hour. This probability does not take into account the likelihood that a warning will be needed. Systems which are designed to meet this requirement are usually single channel systems with limited built-in monitoring. Maintenance or pre-flight checks are relied on to limit the exposure time to undetected failures which would prevent the system from operating adequately.

(3)     Applying the practice given in sub-paragraphs b(1) and b(2) above to take-off configuration warning systems is not considered to result in an adequate level of safety when the consequence of the combination of failure of the system and a potentially unsafe take-off configuration could result in a major/catastrophic failure condition. Therefore, these systems should be shown to meet the criteria of AMC 25.1309 pertaining to a major failure condition, including design criteria and in-service maintenance at specified intervals. This will ensure that the risk of the take-off configuration warning system being unavailable when required to give a warning, if a particular unsafe configuration occurs, will be minimised.

(4)     If such systems use digital electronic technology, a software Development Assurance Level (DAL) should be used, in accordance with AMC 20-115, which is compatible with the system integrity determined by the AMC 25.1309 analysis.

(5)     Since a false warning during the take-off run at speeds near V1 may result in an unnecessary rejected take-off (RTO), which could lead to a mishap, the occurrence of a false warning during the take-off should be remote in accordance with AMC 25.1309.

(6)     If the take-off configuration warning system is integrated with other systems that provide crew alerting functions, the level of criticality of common elements should be commensurate with that of the take-off configuration warning system unless a higher level is dictated by one or more of the other systems.

c.       Design Considerations.

(1)     A review of existing take-off configuration warning systems has shown a trend towards increased sophistication of design, partly due to the transition towards digital electronic technology which is amenable to self-monitoring and simple testing. The net result has been an improvement in reliability, fewer unwanted warnings and enhanced safety.

(2)     With the objective of continuing this trend, new systems should be designed using the objectives and criteria of AMC 25.1309. Analysis should include all the remote sensors, transducers and the elements they depend on, as well as any take-off configuration warning system line replaceable unit (LRU) and the actual visual and aural warning output devices.

(3)     Unwanted warnings may be reduced by inhibiting the take-off configuration warning system where it is safer to do so, e.g., between V1 and VR, so that a hazardous rejected take-off is not attempted. Inhibition of the take-off configuration warning system at high speeds will also avoid any confusion from the occurrence of a warning during a touch-and-go landing. This is because the basic message of an alert is to stop because it is unsafe to take off. It may or may not tell the flight crew which surface or system is wrong. A warning may be more hazardous than reliance on the flight crew's skill and training to cope with the situation.

(4)     Even though CS 25.703 specifies those inputs common to most large aeroplanes that must be included in the design, each aeroplane model should be carefully reviewed to ascertain that any configuration or trim setting that could jeopardise a safe take-off has an input to the take-off warning system unless a separate and adequate warning is already provided by another system. There may be aeroplane configurations or electronically positioned lateral or longitudinal trim unique to a particular model that constitute this hazard. In the event that it is necessary to inhibit the warning from a particular system during the entire take-off roll, an equivalent level of safety finding would be required.

(5)     Automatic volume adjustment should be provided to maintain the aural warning volume at an appropriate level relative to cockpit ambient sound. According to Report No. DOT/FAA/RD-81/38, II entitled "Aircraft Alerting Systems Standardisation Study, Volume II - Aircraft Alerting System Design Guidelines," aural signals should exceed masked threshold by 8 ± 3 dB.

(6)     Of particular importance in the design of take-off configuration warning systems is the elimination of nuisance warnings. These are warnings generated by a system which is functioning as designed but which are inappropriate or unnecessary for the particular phase of operation. Attempting to eliminate nuisance warnings cannot be overemphasised because any indication which could cause the flight crew to perform a high speed rejected take-off, or which distracts or adversely affects the flight crew's performance of the take-off manoeuvre, creates a hazard which could lead to an accident. In addition, any time there are nuisance warnings generated, there is a possibility that the flight crew will be tempted to eliminate them through system deactivation, and by continually doing this, the flight crew may be conditioned to ignore a valid warning.

(7)     There are a number of operations that could produce nuisance warnings. Specifically, single engine taxi for twin engine aeroplanes, or in the case of 3 and 4 engine aeroplanes, taxi with fewer than all engines operating is a procedure used by some operators for the purpose of saving fuel. Nuisance warnings have also been caused by trim changes and speed brake handle adjustments.

(8)     The means for silencing the aural warning should not be located such that it can be operated instinctively, inadvertently, or by habitual reflexive action. Silencing is defined as the interruption of the aural warning. When silenced, it is preferred that the system will be capable of rearming itself automatically prior to take-off. However, if there is a clear and unmistakable annunciation that the system is silenced, manual re-arming is acceptable.

(9)     Each aeroplane model has a different means of arming the take-off configuration warning system, therefore the potential for nuisance warnings varies accordingly. Some existing systems use only a single throttle position, some use position from multiple throttles, some use EPR or N1, and some use a combination of these. When logic from a single operating engine was used, nuisance warnings were common during less than all engine taxi operations because of the higher power settings required to move the aeroplane. These systems were not designed for that type of operation. Because this procedure is used, inputs that arm the system should be judiciously selected taking into account any likely combination of operating and shut-down engines so that nuisance warnings will not occur if the aeroplane is not in take-off configuration.

(10)   CS 25.703 requires only an aural alert for the take-off warning system. CS 25.1322 currently specify requirements for visual alerts while related reading material reference 3a(2), 3a(4) and 3b(1) provide guidance for integrated visual and aural annunciations for warnings, cautions and advisory alerting conditions. It has been common industry practice to incorporate the above mentioned references in their aeroplane designs. FAR/CS 25.1322 are planned for revision to incorporate the guidance of these references to reflect current industry practices. Manufacturers may wish to incorporate these alerting concepts to the take-off warning system. If such is the case, the following guidance is offered:

a)      A master warning (red) attention getting alert may be provided in the pilot's primary field of view simultaneously with the aural attention getting alert.

b)      In addition to or instead of the aural attention getting alert (tone), voice may be used to specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).

c)       The visual alert may also specify the general problem (Configuration), or the exact problem (slats, flaps, trim, parking brake, etc…).

d)      A visual cautionary alert associated with the failure of the Take-off warning system may be provided e.g. "T/O WARN FAIL".

(11)    The EASA Agency approved Master Minimum Equipment List (MMEL) includes those items of equipment related to airworthiness and operating regulations and other items of equipment which the Agency finds may be inoperative and yet maintain an acceptable level of safety by appropriate conditions and limitations. No MMEL relief is provided for an inoperative take-off configuration warning. Therefore, design of these systems should include proper system monitoring including immediate annunciation to the flight crew should a failure be identified or if power to the system is interrupted.

d.       System Tests and Test Intervals.

(1)     When manual tests or checks are required to show compliance with CS 25.1309, by detecting the presence of and limiting the exposure time to a latent failure that would render the warning inoperative, they should be adequate, simple and straight forward in function and interval to allow a quick and proper check by the flight crew and maintenance personnel. Flight crew checks may be specified in the approved Aeroplane Flight Manual (AFM) and, depending on the complexity of the take-off configuration warning system and the aeroplane, maintenance tasks may be conventional Maintenance Review Board (MRB) designed tasks or listed as Certification Check Requirements (CCR) where appropriate, as defined in AMC 25.1309, and determined as part of the approval process between the manufacturer and the certification office.

(2)     The specified tests/checks established in accordance with sub-paragraph 5d(1) above should be demonstrated as part of the approval process and should show that each input sensor as well as the control and logic system and its emitters, including the indication system, are individually verified as required to meet sub-paragraph 5b(3). It should also be demonstrated that the warning self cancels when required to do so, for example by retarding the throttles or correcting the wrong configuration.

e.       Test Considerations.

(1)     During flight testing it should be shown that the take-off configuration warning system does not issue nuisance alerts or interfere with other systems. Specific testing should be conducted to ensure that the take-off configuration warning system works satisfactorily for all sensor inputs to the system. Flight testing should include reconfiguration of the aeroplane during touch and go manoeuvres.

(2)     It should be shown by test or analysis that for all requested power settings, feasible weights, taxiway slopes, temperatures and altitudes, there will be no nuisance warnings, nor failure to give a warning when necessary (e.g., cold conditions, derated take-off), for any reasonable configuration of engines operating or shut down. This is to test or simulate all expected operational configurations. Reasonable pilot technique for applying power should be presumed.

(3)     The means for silencing the aural warning by the flight crew will be evaluated to assure that the device is not accessible instinctively and it is properly protected from inadvertent activation. Automatic or manual re-arming of the warning system will be evaluated.

[Amdt 25/2]

[Amdt 25/8]

[Amdt 25/12]