3/9/84 AC 120-28C Appendix 1
(11) Availability of Function - the average time required to go from 1,500 feet AGL on approach until clear of the runway.
d. The availability of function for Category III should be at least 99 percent.
7. INDIVIDUAL SYSTEM CRITERIA. Individual Category III airborne systems should comply with the pertinent sections of this appendix and the following performance criteria:
a. Localizer. The localizer system installation should comply with the following:
(1) The localizer equipment should meet or exceed the appropriate minimum performance standards set forth in FAA Technical Standard Orders (TSO) C36, C36а, C36b, C36C, or RTCA Paper DO-131A, dated November 2, 1978, "Minimum Performance Standards - ILS Localizer Receiving Equipment," and be compatible for integration into the overall aircraft system used to perform Category III operations.
(2) The localizer system installation should meet or exceed the appropriate minimum performance standards set forth in RTCA Paper 69-60/DO-102, dated April 12, 1960, "Minimum In-Flight Performance Standards - ILS Localizer Receiving iquipment.
(3) Display to the pilot positive visual indication to show degradation of localizer system performance under the following conditions:
(i) The absence of a radio frequency signal.
(11) The absence of either or both modulation signals.
(111) The reduction of either modulation signal to one-half the normal 20 percent.
(iv) When a difference of depth of modulation equal to 0.093 †
0.002 produces an output of less than one-half normal response to this standard localizer deviation signal.
(4) The localizer receiver centering criteria outlined in RTCA Paper DO-131A for Class E equipment are applicable for Category III installation approval.
(5) The localizer receiving equipment should be adjusted in accordance with RICA Paper 23-63/DO-117, dated March 14, 1963, "Standard Adjustment Criteria for Airborne Localizer and Glide Slope Receivers."
b. Glide Slope. The glide slope system installation should comply with the following:
(1) The glide slope equipment should meet or exceed the appropriate minimum performance standards set forth in FAA ISO C34, C34a, C34b, C34C, or RICA Paper DO-132A, dated November 2, 1978, "Minimum Performance Standards - ILS Glide Par 6
Appendix 1
(2) The glide slope system installation should meet or exceed the appropriate minimum performance standards set forth in RICA Paper 233-59/ DO-101, dated December 9, 1959, "Minimum In-Flight Performance Standards - ILS Glide Slope Receiving Equipment," and be compatible for integration into the overall aircraft system used to perform Category III operations.
(3) Display to the pilot positive visual indication to show degradation of glide slope system performance under the following conditions:
(1) The absence of a radio frequency signal.
(ii) The absence of either or both modulation signals.
(iii) The reduction of either modulation signal to one-half of its normal 40 percent.
(iv) When a difference of depth of modulation equal to 0.091 + .002 produces an output of less than one-half normal response to this standard glide slope deviation signal.
(4) Centering Error. The glide slope centering requirements outlined in RTCA Paper DO-132A for Class D equipment are applicable for Category III installation approval.
(5) The glide slope receiving equipment should be adjusted in accordance with RICA Paper 23-63/DO-117, dated March 14, 1963, "Standard Adjustment Criteria for Airborne Localizer and Glide Slope Receivers."
Flight Control Systems.
(1) For operations conducted without a DH, a fail-operational flight control system, as described in paragraph 7c of this AC, is required. For operations conducted with a 50-foot DH, a fail-passive flight control system, as described in paragraph 7b of this AC, may be used. Both fail-passive and fail-operational systems should be shown to provide the capability to safely touchdown within the touchdown zone and not preclude a safe go-around from any point on the approach to touchdown. A safe touchdown should consider airplane structural limit loads, vertical and cross track velocity at touchdown, the airplane attitude and the airplane's track, with respect to the runway centerline, which occurs immediately before and after touchdown.
(2) Automatic Flight Control Systems. Systems which provide automatic landing capability used as part of a Category III installation should, in addition to complying with applicable FAR and AC 20-57A (Automatic Landing Systems), provide the following:
Airplane Speed. The performance specified by AC 20-57A considering maximum and minimum design approach speeds.
Wind Limitations. The maximum headwind, tailwind, and crosswind conditions in which the automatic system will provide safe landing performance and result in touchdown within the area defined by paragraph 5b(4) of AC 20-57A should be determined and published in the airplane flight manual.
4 Par 7
Appendix 1 Type li iLS. The performance specified by AC 20-57A when operating on Type II ILS ground facilities, if Category III operations are to be conducted using this type of ILS facility.
(iv) Warning• (A) Fail-passive and fail-operational systems should provide an aural and visual warning to the flightcrew for failures or failure combinations not shown to be extremely improbable which could result in an unsafe landing.
(B) Automatic systems should provide an immediate aural and visual warning of system disconnect.
Tracking. The systems should be free of significant offsets or sustained oscillations about the extended runway centerline.
(3) Manually Flown Flight Guidance Systems. A system which provides guidance signals to the flightcrew for a manually flown approach and landing as one of the required redundant systems for Category III approach and landing should provide the following:
Touchdown Performance. The flight guidance system should provide sufficient information so that a pilot of average skill can provide the same degree of repeatable touchdown performance (dispersions), without outside visual reference, as specified by AC 20-57A for automatic landing systems. The demonstration should include the ability to take control from the automatic system (or from the other pilot, if applicable) from any point in the approach to touchdown.
(ií) Airplane Speed. The performance specified by AC 20-57A considering maximum and minimum design approach speeds.
(iii) Wind Limitations. The maximum headwind, tailwind, and crosswind conditions in which the flight guidance system will provide safe landing performance and result in a touchdown within the area defined by paragraph 5b(4) of AC 20-57A should be determined and published in the airplane flight manual.
(iv) Type II ILS. The performance specified in AC 20-57A when operating on Type II ILS ground facilities, if Category Ill operations are to be conducted using this type of ILS facility.
(v) Warning• flightcrew for failures of the primary flight control systems (automatic or manual) not shown to be extremely improbable which requires reversion to the secondary flight guidance system in order to prevent unsafe landings.
(B) Probable failures of the flight guidance system should be annunciated to the flightcrew.
Par 7
Appendix 1 Tracking. The flight guidance system should be free of significant offsets or sustained oscillations about the extended runway centerline.
d. Automatic Throttle System (if installed).
(1) An automatic throttle system should provide safe operation under conditions which may be expected in normal service, including wind shear, gusts, and sideslips. The system should:
Automatically adjust throttles to maintain airplane speed to within + 5 knots of stabilized programmed airspeed, but not less than computed threshold airspeed under all intended flight conditions. Proper operating point, such as reference speed or angle-of-attack, may be set manually or automatically.
Rapid airspeed fluctuations associated with turbulence may be disregarded.
(ії) Provide throttle application at a rate consistent with the recommendations of the appropriate engine and airframe manufacturers.
(2) Malfunction of any part of the system should not restrict either pilot from maintaining safe control of the airplane or engines.
Disconnect switch(es) readily accessible to both pilot and copilot should be provided in a location which may be actuated without moving his/her hands from the control wheel or throttle.
The throttle drive mechanism should be designed to permit manual overriding without application of excessive throttle forces.
(iii) Appropriate indication of system engagement and disengagement should be provided.
Radio Altimeter. Each radio altimeter system should have an authorization in accordance with TSO C87 or should provide the performance specified below under the test conditions stated. Radio altimeters with TSO C87 authorization should also comply with the criteria of subparagraph e(2)(iv) of this appendix.
(1) Display to the flightcrew clearly and positively the altitude information in flight which indicates the airplane main landing gear wheel height above terrain.
(2) Under the measurement conditions described, the altimeters used to present flightcrew information should:
(1) Display altitude to an accuracy of † 5 feet or † 5 percent of altitude, whichever is greater, under the following conditions:
(A) Pitch angle + 5° about the mean approach attitude.
(B) Roll angle zero to + 20°.
Par 7
3/9/84 AC 120-28C Appendix 1 (C) Forward velocity from minimum approach speed up to 200 knots, in appropriate configurations.
(D) At altitudes from 0 to 200 feet with sink rates of 0 to 15 feet/second, in landing, approach, and go-around configurations.
(ỉi) Over level ground, the altimeter should track the actual altitude of the airplane without significant lag or oscillation.
(iii) With the airplane at an altitude of 200 feet or less, any abrupt change in terrain representing no more than 10 percent of the airplane's altitude should not cause the altimeter to unlock, and indicator response to such changes should not exceed 0.1 seconds. If the system unlocks, it should reacquire the signal in less than 1 second.
(iv) Systems which contain a push-to-test feature should test the entire system (with or without antenna) at a simulated altitude of less than 500 feet.
The system should provide to the flightcrew a positive failure warning display any time there is a loss of power or failure of the altimeter to following pre Computer lue oath other fla system:
(1) Signals to the flight control system to achieve landing touchdown dispersions within criteria of AC 20-57A.
NOTE: The above reference to AC 20-57A is considered to mean AC 20-57 for those aircraft and flight control systems which were previously approved under the provisions of AC 20-57.
(2) A display to the flightcrew with a clear indication that the flare has (or alternatively has not) been initiated at the minimum normal flare engage height.
g. Failure Detection and Warning Capability.
(1) Failure detection and warning capability should be provided in accordance with criteria listed in paragraphs 6 and 7a through f of this appendix.
(2) Notwithstanding subparagraph g(1), for fail-operational systems, failure warning may be inhibited for certain noncritical failures below 100 feet AGL or the AH, if:
(1) The failure does not preclude continuation of a successful approach and landing.
Par 7
Appendix 1
(ii) The failure requires no specific action of the flightcrew.
8. CERTIFICATION DOCUMENTATION. The following documents shall be submitted to the appropriate FAA Aircraft Certification Division with sufficient lead time to allow evaluation prior to TIA.
a. System Description Document - A description of the system: Operation (flightcrew viewpoint), function description (control laws), and hardware (LRU interface).
b. For Non-TSO'd Items - Environmental test results showing compliance with RICA Document DO-160A, Environment Conditions and Test Procedures and Airborne Electronics, Electrical Equipment and Instruments, or later FAA accepted standard.
c. Compatibility Test Report - Noninterference with other systems.
d. Failure Modes and Effects Analysis.
Safety Analysis - Analysis showing that the system meets the probability of unsafe landing requirements of FAR Section 25.1309.
For Digital Systems:
f. Software Description Document.
g. Software Verification and Validation Document.
h. Software Control Procedures.
i. Preliminary Landing Performance Analysis (Simulator Results).
Post TIA and prior to type certificate the final performance analysis will be submitted. This document includes statistical analysis of final simulator results showing compliance with AC 20-57A and correlation between flight test and simulator approach and landing performance.
9. APPROVED AIRPLANE FLIGHT MANUAL. Upon satisfactory completion of an engineering inspection and test program, the FAA-approved airplane flight manual or supplement, and markings or placards, if appropriate, should reflect the following:
a. Appropriate limitations if necessary, including the maximum wind condition in which use of the flight control system will result in a safe landing.
b. Revision to the performance section, if appropriate.
c. The airborne equipment, installation, and flightcrew procedures related to the Category III system.
d. A statement to the effect that, "the airborne systems associated with approach and landing of the airplane to touchdown, or touchdown and rollout, if applicable, have been found to meet the airworthiness and performance criteria Par 7
3/9/84 AC 120-28C Appendix 1 required by AC 120-28C, Appendices 1 and 2, or Appendix 3, if applicable (or previous editions as appropriate)." "Compliance with the performance standards referenced above, does not constitute approval to conduct Category III operations."
Par 9 9
Appendix 2 APPENDIX 2. CATEGORY III FAIL-PASSIVE ROLLOUT CONTROL SYSTEMS
1. PURPOSE. This appendix contains criteria for the approval of fail-passive rollout control airborne equipment and installation.
GENERAL CRITERIA. The type certification approval for the equipment, system installation, and test methods should be based on a consideration of factors such as the intended function of the installed system, its accuracy, reliability, and failure features, as well as the operational concepts in paragraph 7 of this AC.
In addition, approval should be based on demonstrated compatibility with ground facilities designated as U.S. Type II or U.S. Type III. The guidelines and procedures contained herein are considered acceptable methods of determining transport category airplane airworthiness for use of fail-passive rollout control After touchdown and until the point where safe manual control of the aircraft by the crew using visual references is assured, aircraft system failures (when considered separately or with other system failures that are not shown to be extremely improbable) cannot preclude the joint pilot/rollout control system from controlling the aircraft and maintaining the aircraft on the runway and stopping the aircraft within the runway length available.
3. EQUIPMENT APPROVAL CRITERIA. As in Appendix 1.
SYSTEM PERFORMANCE CRITERIA AFTER TOUCHDOWN FOR LATERAL STEERING CONTROL. The performance of the rollout control system should be consistent with the performance of the flight guidance and control system required for Category III approach and landing. In addition, it should be shown by a combination of demonstration and analysis, for wet and dry runway surface conditions, that the performance of the rollout control system is satisfactory. Demonstrations in simulated or actual reduced visibility, representative of expected conditions in which the system is to be used, should also be conducted.
a • The following environmental conditions are to be considered in meeting the criteria of this appendix:
(1) The full range of environmental conditions and airplane configurations used in meeting the airworthiness requirements for a Category III system should be considered, including headwinds of at least 25 knots, tailwinds of at least 10 knots, and crosswinds of at least 15 knots. These environmental conditions and airplane configurations should be compatible with the conditions and configurations demonstrated during airworthiness approval of the Category III airborne systems as specified in Appendix 1 of this AC.
(2) The range of certificated runway conditions (dry and wet) should be considered.
subparagraph a, the rollout control system meets the following accuracy criteria: b. It should be demonstrated that, considering the conditions prescribed in landing gear, to the runway centerline should not exceed 27 feet during the (1) The maximum distance from the aircraft centerline, at the main 1 Par 1
Appendix 2 rollout, when evaluated on a two-sigma basis. Compliance with this requirement should be used when computing the two-sigma deviation. Methods equivalent to the two-sigma basis may be used for nonstandard distributions.
(2) A suitable analysis should show that, with normal operation of the aircraft and the rollout control system, no more than 1 landing in one million will result in the outboard landing gear being closer than 5 feet to the lateral limits of a 150-foot wide runway during rollout.
c. It should be shown by analysis and confirmed by tests, under both dry and wet runway conditions, that the rollout control system provides sufficient damping localizer centerline during normal system operations. to prevent unacceptable overshoot of, or excessive oscillation about, the
d. Probable flight crewmember actions should not significantly affect the normal tracking performance of the rollout control system.
5. PROTECTION FROM DISENGAGEMENT AND INDICATION OF SYSTEM STATUS.
a. The rollout control system should be protected from inadvertent disengagement when operating in the ground rollout mode and the indication of any system malfunction should be conspicuous and unmistakable.
b. There should be a positive indication to the flightcrew that:
available, before the airplane descends to the AH. (1) The rollout control system is available or alternatively, is not touchdown. (2) The ground rollout has, or alternatively has not, been initiated at SYSTEM FAILURE PROTECTION CRITERIA. It should be demonstrated by flight test, or a combination of analysis and flight test, that the rollout control system meets the performance criteria of paragraph 4 of this appendix under normal conditions and meets the following additional criteria when failures occur in these systems. Additionally, the most adverse runway and visibility conditions expected in service with fail-passive rollout control systems should be considered. In making these determinations, normal flight crewmember actions associated with the visual cues that are available should be included in the consideration of the failure condition.
a. Single failures of the rollout control system and its associated components, should not:
rollout path. (1) Cause any significant displacement of the aircraft from its normal easily controlled by the pilot. (2) Upon system disconnection, involve any out of trim condition not 2 Par 4
Appendix 2
(3) Cause any action of the flight control system that is not readily apparent to the pilot, either by control movement or advisory display.
b. An aural and visual warning should be provided for rollout control systems failure conditions not shown to be extremely improbable, which would result in the aircraft wheels leaving the lateral confines of a 150-foot wide runway.
Aircraft system failures should not preclude the joint pilot/rollout control systems from controlling the aircraft, maintaining the aircraft on the runway, and stopping within the runway available under the most adverse runway and visibility conditions expected in service.
7. APPROVED AIRPLANE FLIGHT MANUAL. Upon satisfactory completion of an engineering inspection and test program, the FAA-approved airplane flight manual or supplement, and markings or placards, if appropriate, should reflect the following:
a. Appropriate limitations, if necessary;
b. Revision to the performance section, if appropriate;
The airborne equipment, installation, and flightcrew procedures related to the rollout control system;
approach and landing of the airplane to touchdown and through rollout have been d. A statement to the effect that, "the airborne system associated with found to meet the airworthiness and performance criteria required by AC 120-28C, Appendices 1 and 2." Compliance with the performance standards referenced above, does not constitute approval to conduct Category III operations."
3 Par 6