AC 120-28D Appendix 3 07/13/99
5.3.3. Datalink. A data link may be used to provide data to the airplane to provide the accuracy necessary to support certain operations (e.g., navigation way points, differential corrections for GNSS).
The integrity of the data link should be commensurate with the integrity required for the operation.
The role of the data link in the landing system will have to be addressed as part of the airplane system certification process until such time as an acceptable U.S., or international standards for data link ground systems are established.
6. AIRWORTHINESS. This section identifies airworthiness requirements including those for performance, integrity, and availability which apply to all types of airplane systems, independent of the type of landing/navigation system used. The definitions of Performance, Integrity and Availability are found in Appendix 1.
The basic airworthiness criteria are intended to be independent of the specific implementation in the airplane or the type of Landing and Rollout system being used. Requirements for touch down performance, landing sink rates and attitudes, etc. (see section 6.3.1. below) are the same for landing systems with automatic flight control, and systems for manual flight control with command information (i.e., flight director) as guidance.
Criteria may be expanded further in later sections of this appendix as it applies to a particular airplane system or architecture.
The types of landing or landing and rollout systems which may be approved are listed in Appendix 3 section 4.
6.1. General. An applicant shall provide a certification plan which describes how any non-aircraft elements of the Landing and Rollout System relate to the aircraft system from a performance, integrity and availability perspective.
The plan for certification shall describe the system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and requirements other than those contained in this appendix are necessary.
The applicant shall apply criteria contained in AC 120-29, as amended, an equivalent foreign standard acceptable to the Administrator, or any other criteria acceptable to the Administrator for the system during approach to at least 100 ft. HAT.
The safety level for automatic landing and rollout, or manual landing and rollout using command information as guidance, may not be less than that achieved by a conventional unguided manual landing using visual reference. In showing compliance with the performance and failure requirements, the probabilities of performance or failure effects may not be factored by the proportion of landings made with the landing and rollout system.
The landing and rollout system performance should be established considering the environmental and deterministic effects which may reasonably be experienced for the type of operation for which certification and operational approval will be sought.
Command information provided as guidance during the landing and rollout should be consistent with a pilot’s manual technique and not require excessive skill or crew workload to accomplish the operation.
AC 120-28D 07/13/99 Appendix 3 For those segments of the flight path where credit is taken for non-automatic systems, acceptable performance of those systems for landing and rollout shall be shown by reference to instruments alone without requiring the use of external visual reference. This requirement is appropriate because the landing rollout may begin off centerline and at higher speed.
Where reliance is placed on the pilot to detect a failure of engagement of a mode when it is selected, and the pilot cannot reliably detect this failure by other means, an appropriate indication or warning must be given.
The transition from automatic control to manual control may not require exceptional piloting skill, alertness or strength.
In the absence of failure or extreme conditions, the behavior of the landing system, and the resulting airplane flight path, shall not be so unusual as to cause a pilot to inappropriately intervene and assume control.
The effect of the failures of the navigation facilities must be considered taking into account ICAO and other pertinent State criteria.
6.2. Approach Systems. The applicant shall establish acceptable approach performance to the criteria contained in AC 120-29, as amended, an equivalent foreign standard acceptable to the Administrator, or any other criteria acceptable to the Administrator.
6.3. Landing and Rollout System Performance. The stable approach (i.e., “normal maneuvering” without excessive attitudes, sink rates, path deviations or speed deviations) should be conducted to the point where a smooth transition is made to the landing.
If the landing system is designed to perform an alignment function prior to touch down, to correct for crosswind effects, it should operate in a manner consistent with a pilot's manual technique for crosswind landings for the aircraft type, typically using the wing low side slip procedure. Non-availability of the alignment mode, or failure of the alignment mode to perform its intended function must be easily detectable, or be suitably annunciated, so that the flightcrew can take appropriate action.
The landing system "landing flare to touch down" maneuver should reduce the airplane sink rate to a value and in a manner that is compatible with a normal flightcrew landing maneuver.
The automatic flight control system should provide de-rotation, consistent with a pilot’s manual technique.
Systems which provide rollout guidance for manually controlled rollout are not required to provide derotation. Systems which provide de-rotation, automatically or with guidance for manual control, must avoid any objectionable oscillatory motion or nose wheel touch downs, pitch up or other adverse behavior as a result of ground spoiler deployment or reverse thrust operation.
Automatic control during the landing and rollout should not result in any airplane maneuvers which would cause the flightcrew to intervene unnecessarily.
Guidance provided during the landing and rollout should be consistent with a pilot’s manual technique, and not require excessive skill or crew workload to accomplish the operation.
6.3.1. Landing System Performance. All types of low visibility landings systems, including automatic flight control, guidance for manual control, and hybrid, shall be demonstrated to achieve the performance
AC 120-28D Appendix 3 07/13/99 accuracy with the probabilities prescribed in this section. The performance values may vary where justified by the characteristics of the airplane.
The performance criteria and probabilities are as follows:
(a) Longitudinal touch down earlier than a point on the runway 200 ft. (60m) from the threshold to a probability of 1 x 10-6;
(b) Longitudinal touch down beyond 2700 ft.(823m) from threshold to a probability of 1 x 10-6;
(c) Lateral touch down with the outboard landing gear more than 70 ft. (21.3m) from runway centerline to a probability of 1 x 10-6.
(d) Structural limit load, to a probability of 1 x 10-6. An acceptable means of establishing that the structural limit load is not exceeded is to show separately and independently that:
(i) The limit load that results from a sink rate at touch down not greater than 10 f.p.s. or the limit rate of descent used for certification under 14 CFR part 25 subpart C (see section 25.473), whichever is the greater.
(ii) The lateral side load does not exceed the limit value determined for the lateral drift landing condition defined in part 25, section 25.479(d)(2).
(e) Bank angle resulting in hazard to the airplane to a probability of 1 x 10-7. A hazard to the airplane is interpreted to mean a bank angle resulting in any part of the wing, high lift device, or engine nacelle touching the ground.
6.3.2. Speed Control Performance. Airspeed must be controllable to within +/- five knots of the approach speed*, except for momentary gusts, up to the point where the throttles are retarded to idle for landing. For operations flown with manual control of approach speed, the flightcrew must be able to control speed to within +/- five knots of the approach speed.
*NOTE: This criteria is not specific to low visibility systems, but must be met by low visibility systems.
6.3.3. Rollout System Performance.
The rollout system, if included, should control the airplane, in the case of an automatic flight control system, or provide command information as guidance to the pilot, for manual control, from the point of landing to a safe taxi speed. The loss of rudder effectiveness, as the airplane speed is reduced, could be a factor in the level of approval which is granted to a system. The applicant should describe the system concept for rollout control so that the absence of low speed control, such as a nose wheel steering system, can be assessed.
Safe Taxi Speed is the speed at which the pilot can safely leave the runway or bring the airplane to a safe stop. The safe taxi speed may vary with visibility conditions, airplane characteristics, and means of lateral control. The performance criteria in this section assume a 150 ft. (45.7m) runway width. The rollout performance limit may be appropriately increased if operation is limited to wider runways.
AC 120-28D 07/13/99 Appendix 3 The rollout system performance is referenced to the centerline of the runway. The intended path for the rollout system is usually defined by an ILS localizer, or other approved approach navigation system, which normally coincides with the runway centerline.
The rollout system should be demonstrated to:
(a) Not cause the outboard tire(s) to deviate from the runway centerline by more than 70 ft. (21.3m)*, starting from the point at which touch down occurs and continuing to a point at which a safe taxi speed is reached, to a probability of 1 x 10-6.
(b) Capture the intended path or converge on the intended path (e.g., localizer centerline) in a smooth, timely and predictable manner. While a critically damped response is desired, minor overshoots are considered acceptable. Sustained or divergent oscillations or unnecessarily aggressive responses are unsatisfactory.
(c) Promptly correct any lateral movement away from the runway centerline in a positive manner.
(d) Following touchdown, if not already on a converging path, cause the airplane to initially turn and track a path to intercept the runway centerline at a point far enough in front of the airplane that it is obvious to the flightcrew that the rollout system is performing properly. Also, the rollout system should intercept the centerline sufficiently before the stop end of the runway, and before the point at which taxi speed is reached.
*NOTE: 70 ft.(21.3m) deviation from centerline is equivalent to outboard tire(s) at 5 ft. (1.5m) within the edge of a 150 ft. (45.7m) wide runway.
6.3.4. Variables Affecting Performance. This section identifies the variables to be considered when establishing landing and rollout performance.
The performance assessment shall take into account at least the following variables with the variables being applied based upon their expected distribution:
(a) Configurations of the airplane (e.g., flap/slat settings);
(b) Center of gravity;
(c) Landing gross weight;
(d) Conditions of headwind, tailwind, crosswind, turbulence and wind shear (see Appendix 4 for acceptable wind models);
(e) Characteristics of applicable navigation systems and aid, variations in flight path definitions (ILS, MLS, GLS - ground, airplane and space elements etc.)
(f) Approach airspeed and variations in approach airspeed.
(g) Airport conditions (elevation, runway slope, runway condition).
(h) Individual pilot performance, for systems with manual control.
(i) Any other parameter which may affect system performance.
AC 120-28D Appendix 3 07/13/99
6.3.5. Irregular Approach Terrain. Approach terrain may affect the performance and pilot acceptance of the Approach and Landing system.
The information on the nominal characteristics of an airport is contained in ICAO Annex 14. This information can be used to characterize the airport environment for nominal performance assessment.
However, the system shall be evaluated to determine the performance characteristics in the presence of significant approach terrain variations. At a minimum the following profiles should be examined:
a. Sloping runway - slopes of 0.8%.
b. Hilltop runway - 12.5% slope up to a point 60m prior to the threshold; or
c. Sea-wall - 6m (20 ft.) step up to threshold elevation at a point 60m prior to the threshold.
NOTE: In addition to the profiles described above, examination of the profiles of known airports with significant irregular approach terrain, at which operations are intended, is recommended (see section 5.18 of the AC).
6.3.6. Approach and Automatic Landing with an Inoperative Engine. For demonstration of engine inoperative capabilities, where the approach is initiated, and the landing made, with an inoperative engine, the landing system must be shown to perform a safe landing and, where applicable, safe rollout in this non-normal aircraft condition taking account the factors described in 5.17 and the following:
a. Failure of the critical engine, and for propeller, where applicable, accounting for feathering of the propeller following failure of the critical engine;
b. Appropriate landing flap configurations;
c. Loss of any systems associated with the inoperative engine, e.g., electrical and hydraulic power;
d. Crosswinds in each direction of at least 10 knots;
e. Weight of aircraft.
Whether or not engine out landing approval is sought, the go-around from any point on the approach to touch down must not require exceptional piloting skill, alertness or strength and must ensure that sufficient information is available to determine that the airplane can remain clear of obstacles (see section 6.3.7 below).
6.3.7. Inoperative Engine Information. Information for an operator to assure a successful go-around with an inoperative engine should be provided. The information may be in a form as requested by the operator, or as determined appropriate by the manufacturer. The information may or may not be provided to the operator as part of the AFM. Examples of acceptable information would include the following:
a. Information on height loss as a function of go-around initiation altitude, and
b. Performance information allowing the operator to determine that safe obstacle clearance can be maintained during a go around with an engine failure, or
c. A method to assess and extend applicability of engine inoperative takeoff performance obstacle clearance determinations for a balked landing or go-around event.
AC 120-28D 07/13/99 Appendix 3
6.4. Landing and Rollout System Integrity. The applicant shall provide the certification authority with an overall operational safety assessment plan for the use of systems other than ILS or MLS for "path in space" guidance. This plan shall identify the assumptions and considerations for the non-aircraft elements of the system and how these assumptions and considerations relate to the airplane system certification plan.
The effect of the navigation reference point on the airplane on flight path and wheel to threshold crossing height shall be assessed.
6.4.1. Landing System Integrity. The onboard components of the landing system, considered separately and in relation to other associated onboard systems, should be designed to meet the requirements of section 25.1309, in addition to any specific safety related criteria identified in this appendix.
The following criteria is provided for the application of FAR § 25.1309 to Landing Systems:
Any single malfunction or any combination of malfunctions of the landing system that could prevent a safe landing or go around must be Extremely Improbable, unless it can be detected and annunciated, as a warning to allow pilot intervention to avoid catastrophic results, and shown to be Extremely Remote.
Failure to detect and annunciate malfunctions that could prevent a safe landing or go around must be Extremely Improbable.
The exposure time for assessing failure probabilities for Fail Passive landing systems is the average time required to descend from 100 feet HAT or higher to touchdown, and for Fail Operational landing systems the average time to descend from 200 feet HAT or higher to touchdown.
For a Fail Passive automatic landing system, a single malfunction or any combination of malfunctions must not cause a significant deviation of the flight path or attitude (e.g., hardover) following a system disengagement. The airplane must be safely trimmed, when the system disengages, to prevent these significant deviations.
A Fail Operational automatic landing system, following a single malfunction, must not lose the capability to perform lateral and vertical path tracking, alignment with runway heading (e.g., decrab), flare and touchdown within the safe landing requirements listed below.
Malfunction cases may be considered under nominal environmental conditions.
For the purpose of analysis, a safe landing may be assumed if the following requirements are achieved:
(a) Longitudinal touch down no earlier than a point on the runway 200 ft. (60m) from the threshold,
(b) Longitudinal touch down no further than 3000 ft. (1000m) from the threshold e.g., not beyond the end of the touch down zone lighting,
(c) Lateral touch down with the outboard landing gear within 70 ft. (21m) from runway centerline.
(These values assume a 150 ft. (45m) runway. The lateral touch down performance limit may be appropriately increased if operation is limited to wider runways),
(d) Structural limit load. An acceptable means of establishing that the structural limit load is not exceeded is to show separately and independently that:
AC 120-28D Appendix 3 07/13/99
(i) The limit load that results from a sink rate at touch down not greater than 10 f.p.s. or the limit rate of descent used for certification under part 25 Subpart C (see section 25.473), whichever is the greater.
(ii) The lateral side load does not exceed the limit value determined for the lateral drift landing condition defined in section 25.479(d)(2).
(e) Bank angle resulting in hazard to the airplane such that any part of the wing or engine nacelle touches the ground.
6.4.2. Rollout System Integrity. The rollout system, if provided shall provide automatic control, or guidance for manual control, to maintain the airplane on the runway to a safe taxi speed on the runway.
The onboard components of the rollout system, considered separately and in relation to other associated onboard systems, should be designed to meet the requirements of section 25.1309, in addition to any specific safety related criteria identified in this appendix.
The following criteria is provided for the application of FAR section 25.1309 to Rollout Systems:
a. A Fail Operational rollout system must meet the safe rollout performance requirements of Appendix 3 section 6.3.3 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any single malfunction, or after any combination of malfunctions not shown to be Extremely Remote.
Malfunction cases may be considered under nominal environmental conditions.
b. For any rollout system, below 200 ft. HAT, unannunciated malfunctions that would prevent a safe rollout must be shown to be Extremely Improbable.
c. For a fail passive rollout system, the loss of a fail passive automatic rollout function after touchdown shall cause the automatic flight control system to disconnect. The loss of a Fail Passive rollout system after touchdown shall be Improbable. Whenever a fail passive guidance system for manual rollout does not provide valid guidance, an annunciation should be provided to both pilots, and the guidance removed. The removal of guidance, alone, is not adequate annunciation, unless independent information available within the pilot’s primary field of view positively indicates the failure. The annunciation must be located to ensure rapid recognition, and must not distract the pilot flying or significantly degrade the forward view.
d. For any rollout system, for malfunctions that only affect low speed directional control (speeds below which rudder is ineffective for steering), rollout system performance should not cause the airplane wheels to exceed the lateral confines of the runway, from the point of touch down to the point at which a safe taxi speed is reached, more often than once in ten million landings. A safe taxi speed is considered to be a speed at which the pilot can resume manual control to safely exit the runway or expeditiously bring the airplane to a safe stop. A safe taxi speed may vary with airplane characteristics and available means of lateral control.
6.4.3. On Board Database Integrity [PoC]. The definition, resolution and maintenance of the waypoints which define the required flight path and flight segments is key to the integrity of this type of landing and rollout operation.
When the required flight path is defined by an on-board database, a mechanism should be established to ensure the continued integrity of the flight path designators.
AC 120-28D 07/13/99 Appendix 3 The integrity of any on board data base used to define flight critical path waypoints for an Landing and Rollout System should be addressed as part of the certification process.
6.5. Landing and Rollout System Availability.
6.5.1. Landing System Availability. Below 500 ft. on approach, the probability of a successful landing should be at least 95% for approach demonstrations conducted in the airplane (i.e., no more than 5% of the approaches result in a go-around, due to the combination of failures in the landing system and the incidence of unsatisfactory performance). Compliance with this requirement typically should be established during flight test, with approximately 100 approaches.
For an airplane equipped with a Fail Passive landing system, the need to initiate a go-around below 100 ft.
HAT on approach due to an airplane failure condition should be infrequent (i.e., typically fewer than 1 per 1000 approaches).
For a Fail Operational system, below 200 ft. HAT on approach, the probability of total loss of the landing system (even though appropriate annunciation of system loss is provided) must be Extremely Remote. For any annunciation that is provided, that annunciation must enable a pilot to intervene in a timely manner to avoid a catastrophic result. Total loss of the system without annunciation shall be Extremely Improbable.
6.5.2. Rollout System Availability. For a Fail Passive rollout system, from 200 ft. HAT through landing and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%, considering loss or failure of the rollout system.
For a Fail Operational rollout system, during the period in which the aircraft descends below 200 ft. HAT to a safe taxi speed, the probability of degradation from Fail Operational to Fail Passive should be infrequent (i.e., fewer than 1 degradation per 1000 approaches), and the probability of total loss of rollout capability should be Extremely Remote, considering loss or failure of the rollout system.
After touch down, complete loss of the Fail Operational automatic rollout function, or any other unsafe malfunction or condition, shall cause the automatic flight control system to disconnect. The loss of a Fail Operational rollout system after touch down shall be Extremely Remote.
6.6. Go-Around. The aircraft must be capable of safely executing a go-around from any point on the approach to touch down in all configurations to be certificated. The maneuver may not require exceptional piloting skill, alertness or strength.
a. A go-around from a low altitude may result in inadvertent runway contact, therefore the safety of the procedure should be established giving consideration to at least the following:
1) The automatic control and guidance produced by the go-around mode, if such a mode is provided, should be retained and be shown to have safe and acceptable characteristics throughout the maneuver,
2) Other systems (e.g., automatic throttle, brakes, spoilers and reverse thrust) should not operate in a way that would adversely affect the safety of the go-around maneuver.
b. Inadvertent selection of go-around mode after touch down should have no adverse effect on the ability of the aircraft to safely roll out and stop.
AC 120-28D Appendix 3 07/13/99
c. Height loss should be assessed to assure expeditious go-around from a range of altitudes during the approach and flare when under automatic control and when using the landing guidance system, as appropriate, and as follows:
1) Height loss may be assessed by flight testing (typically 10 go-arounds) supported by simulation.
2) The simulation should evaluate the effects of variation in parameters, such as weight, center of gravity, configuration and wind, and show correlation with the flight test results.
3) Normal procedures for a go-around for the applicable configuration should be followed. If engine-inoperative capability is sought, and use of the go-around mode is applicable to those operations, an assessment of the engine-inoperative go-around is necessary.
6.7. Automatic Braking System. If automatic braking is used for credit under section 5.16 of this AC, then the following apply:
a. The automatic braking system should allow anti-skid protection and have manual reversion capability. An automatic braking system should provide smooth and continuous deceleration from touch down until the airplane comes to a complete stop on the runway and provide:
1) Disconnect of the autobrake system must not create unacceptable additional crew workload or crew distraction from normal rollout braking.
2) Normal operation of the automatic braking system should not interfere with the rollout control system. Manual override of the automatic braking system must be possible without excessive brake pedal forces or interference with the rollout control system. The system should not be susceptible to inadvertent disconnect.
3) A positive indication of system disengagement and a conspicuous indication of system failure should be provided.
4) No malfunction of the automatic braking system should interfere with either pilots use of the manual braking system.
b. The demonstrated wet and dry runway braking distances, for each mode of the automatic braking system, should be determined in a manner consistent with part 121, section 121.195 (d) of 14 CFR and presented in the airplane flight manual as performance information.
6.8. Flight Deck Information, Annunciation and Alerting. This section identifies information, annunciations and alerting requirements for the flight deck.
The controls, indicators and warnings must be designed to minimize crew errors which could create a hazard. Mode and system malfunction indications must be presented in a manner compatible with the procedures and assigned tasks of the flightcrew. The indications must be grouped in a logical and consistent manner and be visible under all expected normal lighting conditions.
6.8.1. Flight Deck Information. This section identifies requirements for basic situation and command information.
AC 120-28D 07/13/99 Appendix 3 For manual control of approach, landing and rollout flight path, the primary flight display(s), whether head down or head up, must provide sufficient information to enable a suitably trained pilot to maintain the approach path, to make the alignment with the runway, flare and land the airplane within the prescribed limits or to make a go-around without excessive reference to other cockpit displays.
Sufficient information should be provided in the flight deck to allow the pilots to monitor the progress and safety of the landing and rollout operation, using the information identified above and any additional information necessary to the design of the system.
Required in flight performance monitoring capability includes at least the following:
1) Unambiguous identification of the intended path for the approach, landing and rollout,
(e.g., ILS/MLS/GLS approach identifier/frequency, and selected navigation source)
2) Indication of the position of the aircraft with respect to the intended path (e.g., situation information localizer and glide path, or equivalent).
6.8.2. Annunciation. A positive, continuous and unambiguous indication must be provided of the modes actually in operation, as well as those which are armed for engagement. In addition, where engagement of a mode is automatic (e.g., localizer and glide path acquisition), clear indication must be given when the mode has been armed by either action of a member of the flightcrew, or automatically by the system (e.g., a pre-land test - LAND 3).
6.8.3. Alerting. Alerting requirements are intended to address the need for warning, caution and advisory information for the flightcrew.
6.8.3.1. Warnings. FAR/JAR 25.1309 requires that information must be provided to alert the crew to unsafe system operating conditions to enable the crew to take appropriate corrective action. A warning indication must be provided if immediate corrective action is required. An analysis should be performed to consider crew alerting cues, corrective action required, and the capability of detecting faults.
Warnings must be given without delay, be distinct from all other cockpit warnings and provide unmistakable indication of the need for the flightcrew to take immediate corrective action. Aural warnings must be audible to both pilots under typically assumed worst case ambient noise conditions, but not so loud and intrusive as to interfere with the crew taking the required corrective action or readily accomplishing crew coordination. Visual warnings, such as lights or alphanumeric messages, must be distinct and conspicuously located in the primary field of view for both pilots.
After beginning final approach (e.g., typically prior to reaching 1000' HAT), the loss of a Fail Passive or Fail Operational system, shall be annunciated. Whenever a Fail Passive system, for manual control, does not provide valid guidance, it shall be indicated by a positive and unmistakable warning to both pilots, and the guidance removed. The removal of guidance, alone, is not adequate annunciation. The annunciation must be located to ensure rapid recognition, and must not distract the pilot flying or significantly degrade the forward view.
6.8.3.2. Cautions. A caution is required whenever immediate crew awareness is required and timely subsequent crew action may be required. A means shall be provided to advise the flightcrew of failed airplane system elements that affect the decision to continue or discontinue the approach.
AC 120-28D Appendix 3 07/13/99
a. After initiation of final approach (which typically occurs at or above 1000' HAT), a Fail Passive landing system, or landing and rollout system, shall alert the flightcrew to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
b. After initiation of final approach (which typically occurs at or above 1000' HAT), a Fail Passive command guidance system (e.g., head-up- display (HUD) guidance), shall provide a clear, distinct and unmistakable indication to alert each pilot to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
c. After initiation of final approach (which typically occurs at or above 1000' HAT), but above the airworthiness demonstrated Alert Height, a Fail Operational landing system or landing and rollout system (with either Fail Operational or Fail Passive rollout) shall alert the flightcrew to:
1) Any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing, and
2) Any malfunction that degrades the landing system from a Fail Operational to a Fail Passive landing system.
d. Below the airworthiness demonstrated Alert Height and throughout rollout, a Fail Operational landing systems shall inhibit alerts for malfunctions that degrade landing system capability from Fail Operational to Fail Passive status.
e. Deviation alerting - The FAA expects the flightcrew to monitor flight path deviations as indicated on the primary flight instruments, and does not require automatic alerting of excessive deviation.
Nonetheless, FAA may approve systems which meet alternate appropriate criteria for deviation alerting
(e.g., JAR/AWO). If a method is provided to detect excessive deviation of the airplane, laterally and vertically during approach to touch down and laterally after touch down, then it should not require excessive workload or undue attention. This provision does not require a specified deviation alerting method or annunciation, but may be addressed by parameters displayed on the ADI, EADI, HUD, or PFD.
When a dedicated deviation alerting method is provided, its use must not cause excessive nuisance alerts.
f. For systems demonstrated to meet JAA criteria, compliance with the following criteria, from JAR- AWO 236, is an acceptable means of compliance, but is not a required means of compliance:
1) For systems meeting the JAR-AWO 236 criteria, excess-deviation alerts should operate when the deviation from the ILS, MLS, or GLS glide path or localizer centerline exceeds a value from which a safe landing can be made from offset positions equivalent to the excess-deviation alert, without exceptional piloting skill and with the visual references assumed to be available in these conditions.
2) For systems meeting the JAR-AWO 236 criteria, excess-deviation alerts should be set to operate with a delay of not more than one (1) second from the time that the deviation thresholds are exceeded.
3) For systems meeting the JAR-AWO 236 criteria, excess-deviation alerts should typically be active at least from 300 ft. (90m) HAT to 50 ft. HAT, but the glide path deviation alert may be discontinued below 100 ft. (30m) HAT.
6.8.3.3. Advisories. A means shall be provided to inform the flightcrew when the airplane has reached the operational Alert Height or Decision Height, as applicable.
AC 120-28D 07/13/99 Appendix 3
6.8.3.4. System Status. A means should be provided for the operator and flightcrew to determine prior to departure and the flightcrew to determine after departure, the capability of the airplane elements to accomplish the intended low visibility operations. While en route, the failure of each airplane component adversely affecting the capability to conduct the intended landing operation should be indicated to the flightcrew as an advisory.
A means should be provided to advise the flightcrew of failed airplane system elements relating to landing system capability which otherwise could adversely affect a flightcrew's decision to use particular landing minima (e.g., adversely affect a decision to continue to a destination or divert to an alternate).
If multiple landing system capability is installed (e.g., MMR), then during approach, an indication of a failure in each non-selected airplane landing system element (e.g., an MLS or GLS receiver failure during conduct of an ILS approach) should be made available to the flightcrew as an indication of system status. Such failures or non-availability, however, should not produce a caution or warning if they are not relevant to the system in use.
System Status indications should be typically identified by names that are different than operational authorization categories (e.g., annunciations such as "LAND 3," or "DUAL" may be used). System or configuration status annunciations which may change over time as operational criteria change, or could be confusing or ambiguous if the flightcrew, operator, operation, runway or aircraft are otherwise constrained or found eligible for a particular minima or operation, should typically not be used (e.g., system or configuration annunciations such as "CAT I", "CAT II", or "CAT III" should typically not be used for new designs).
6.9. Multiple Landing Systems. International agreements have established a number of landing systems as being acceptable means to conduct instrument approach and landing. This section identifies requirements which relate to airplane systems which provide the capability to conduct approach and landing operations using these multiple landing systems (e.g., ILS, MLS, GLS).
6.9.1. General. Where practicable, the flight deck approach procedure should be the same irrespective of the navigation source being used.
A means (for example the current ILS facility identification) should be provided to confirm that the intended approach aid(s) has been correctly selected;
6.9.2. Indications. The following criteria apply to indications in the flight deck for the use of a multimode landing system:
The primary flight display shall indicate deviation data for the selected landing system.
The loss of deviation data shall be indicated on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.
6.9.3. Annunciations. The following criteria applies to annunciations in the flight deck when using a multi-mode landing system.
The navigation source (e.g., ILS, MLS, GLS, FMS) selected for the approach shall be positively indicated in the primary field of view at each pilot station;
The data designating the approach (e.g., ILS frequency, MLS channel, GLS 'channel') shall be unambiguously indicated in a position readily accessible and visible to each pilot;