Appendix 3
c. System Status indications should be identified by names that are different than operational authorization categories (e.g., do not use names such as “CAT I,” “CAT II,” “CAT III”).
6.7. Multiple Landing Systems and Multi-mode Receivers (MMR) for Category II. International agreements have established a number of landing systems as an acceptable means to provide guidance to support the conduct of an instrument approach. This section identifies unique requirements which relate to airplane systems which provide the capability to conduct approach and landing operations using these multiple landing systems (e.g., ILS, MLS, GLS). Typically, these multiple landing systems are implemented through use of one or more multi-mode receivers (MMR), capable of providing navigation information for ILS, MLS, and GLS or any one or more combinations of these landing sensor systems.
a. ICAO has specified an ILS protection date of at least 2010 to support international approach and takeoff operations. In addition, MLS or GLS may be used on a regional basis, until GLS-based approach, landing, and departure system are in worldwide use. Accordingly, an operator may elect to use ILS, ILS/MLS, ILS/GLS, or ILS/MLS and GLS. If a Multi-mode Receiver (MMR) is used, MMR characteristics should be consistent with applicable related ARINC characteristics for MMR.
b. For systems which elect to use MLS, either FAA criteria or JAR-AWO as amended, (e.g., NPA AWO 9), may be used as a consideration in defining the airworthiness requirements for MLS certification.
6.7.1. General Requirements. Where practicable, the flight deck approach procedure should be the same regardless of the navigation source being used.
a. A means (for example, the current ILS audio idents) should be provided to confirm that the intended approach aid(s) has been correctly selected.
b. During the approach, an indication of a failure in each non-selected airplane system element must be provided to the flightcrew as an indication of system status; it should not produce a caution or warning.
6.7.2. Indications. The following criteria apply to indications in the flight deck for the use of a multi-mode landing system:
The loss of acceptable deviation data shall be indicated on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.
6.7.3. Annunciations. The following criteria applies to annunciations in the flight deck when using a multi-mode approach system:
a. The navigation source (e.g., ILS, MLS, GLS, FMS) selected for the approach shall be positively indicated in the primary field of view at each pilot station;
b. The data designating the approach (e.g., ILS frequency, MLS channel, GLS approach identifier) shall be unambiguously indicated in a position readily accessible and visible to each pilot;
c. A common set of mode ARM and ACTIVE indications (e.g., LOC and GS) is preferred for ILS, MLS, and GLS operations;
d. A means should be provided for the crew to determine a failure of the non-selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications should not mislead through incorrect association with the navigation source. For example, it would not be acceptable for the annunciation “ILS FAIL” to be displayed when the selected navigation source is MLS and the failure actually affects the MLS receiver.
Appendix 3
6.7.4. Alerting. Flight operations require alternate airports for takeoff, en route diversion, and landing. These alternate airports may have different landing systems. Flight operations may be planned, released, and conducted on the basis of using one or more landing systems.
a. The capability of each element of a multi-mode approach and landing system shall be available to the flightcrew to support dispatch of the airplane.
b. A failure of each element of a multi-mode approach and landing system must be indicated to the flightcrew without pilot action, as an advisory (i.e., not a warning or caution, does not demand immediate flightcrew attention), during en route operation.
c. A failure of the active element of a multi-mode approach and landing system during an approach shall be accompanied by a warning, caution, or advisory (i.e., not a warning or caution, annunciates without flightcrew action, but does not demand immediate flightcrew attention), as appropriate.
d. An indication of a failure in each non-selected element of a multi-mode approach and landing system during an approach may be made available to the flightcrew as an advisory (i.e., not a warning or caution, annunciates without flightcrew action, but does not demand immediate flightcrew attention), but should not produce a caution or warning.
6.7.5. Multi-mode Receivers (MMR). For MMRs used for systems for Category II, using more than one type of landing system, the means of compliance required for certification can be simplified, provided the applicant provides appropriate justification. This section provides guidance for retrofit certifications, for “ILS Look alike” applications, and for certification of ILS installations with either new or modified receivers. Equivalent provisions as to those described in Appendix 2, paragraph 6.7.5, except as applicable to criteria for Category II, may be applied.
Typical receiver configurations for retrofit applications include:
a. An ILS receiver from a new supplier;
b. A modified ILS receiver from the same supplier (e.g., for purposes of providing improved FM Immunity);
c. A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment);
d. A stand-alone MLS receiver (“ILS look alike”);
e. An MLS partition in an MMR (“ILS look alike”);
f. A stand-alone GLS receiver (“ILS look alike”); or
g. A GLS partition in an MMR (“ILS look alike”).
6.7.5.1 “ILS Look alike” Definition applicable to MMR. “ILS Look alike” is defined as the ability of a non-ILS based navigation receiver function to provide operational characteristics and interface functionality to the rest of the aircraft equivalent to that provided by an ILS-based receiver function. Specifically in the case of an MLS or GNSS (GLS) based receiver function, the output should be in DDM/microamps, with a sensitivity equivalent to an ILS receiver taking account of the effects of runway length.
6.7.5.2. General Certification Considerations.
6.7.5.2.1. Certification Process. An “impact assessment” should address any new receiver functionality considering:
Appendix 3
a. Differences between the current basis of certification and that requested (if applicable).
b. The functionality being added.
c. Credit that can be taken for the existing approval.
6.7.5.2.2. Equipment Approval. TSO/MOPS compliance should be demonstrated where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.
6.7.5.2.3. Aircraft Installation Approval (14 CFR Part 25). The following should be considered:
a. Impact on airplane system safety assessments.
b. Radio approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna).
c. EMI/EMC testing.
d. Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays.
e. Electrical loading
f. Flight data recorder requirements
g. Suitable Aircraft Flight Manual (AFM) provisions.
h. Certification means of compliance for the receiver installation (e.g., specification of ground and/or flight testing, as necessary).
6.7.5.2.4. Alternative Means of Compliance using JAR-AWO. JAR-AWO may be considered as an acceptable means of compliance for ILS or MLS if the applicant establishes that the proposed new or modified navigation receiver configuration can be considered to have “ILS Look alike” characteristics. The following interpretative material to existing ACJ may be considered for that part of the certification affected by the revised installation:
ACJ AWO 131 Performance Demonstration. 2.1 Flight Demonstrations - Program of Landings for Certification.
ACJ AWO 161(b) Failure Conditions.
ACJ AWO 231 Flight Demonstration. 1.1 Continuous Method (Analysis of Maximum Value).
ACJ AWO 431 Performance (Interpretative Material).
6.7.5.2.5. Recertification of an ILS function following the Introduction of a New or Modified ILS Navigation Receiver Installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. An “impact assessment” may be used to establish a basis for certification.
6.7.5.2.5.1. New or Modified ILS Impact Assessment.
a. An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration:
(1) hardware design;
Appendix 3
(2) software design;
(3) signal processing and functional performance;
(4) failure analysis;
(5) receiver function, installation and integration (e.g., with controls, indicators, and warnings).
b. The impact assessment should also identify any additional considerations such as:
(1) Future functionality provisions which have no impact on system operation;
(2) Shared resources to support future functionality.
Based upon the assumption that the ILS receiver, or receiver function, can be shown to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver for installation on a given airplane type.
6.7.5.2.5.2. New or Modified ILS Failure Analysis. The failure characteristics of the new or modified installation should be reviewed, equivalent to systems using ILS data, to ensure that the failure characteristics are compatible with and do not invalidate any original or previous safety assessments.
6.7.5.2.5.3. New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary).
For systems intended to provide Autoland or HUD guidance landing function using a new ILS, MLS, GLS, or combined MMR receiver, a flight test program of typically a minimum of eight approaches terminating in a successful (automatic or HUD) landing and rollout (if applicable) using the flight control/guidance system, including a minimum of two ILS facilities should be completed. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical instrument approach procedures, and, if applicable, from below and above the glideslope.
The approach and landing performance (flight path deviation, touchdown data etc.) as appropriate, should be shown to be equivalent to that achieved in the original ILS certification. Recorded flight test data may be required to support equivalency demonstration.
A demonstration of take off guidance performance should be included where applicable.
6.7.5.2.5.4. New or Modified ILS Documentation. The following documentation should be provided for certification:
a. An Impact Assessment including effects on System Safety Assessments.
b. A Flight test report, if applicable.
c. Revisions to the Flight Manual where appropriate.
6.7.5.2.6. Recertification following the Introduction of an MLS or GLS Navigation Receiver Installation.
6.7.5.2.6.1. MLS or GLS Introduction Impact Assessment. An MLS or GLS receiver or receiver function can be certificated with an “impact assessment” similar to that required for the re-certification of a new or modified ILS receiver, provided that the unit(s) has been shown to have satisfactory “ILS Look alike” characteristics. The “impact assessment” should assess equivalent aspects of the MLS or GLS receiver or receiver function to those for the existing ILS receiver configuration.
Appendix 3 Based upon the assumption that the MLS or GLS receiver or receiver function, can be shown to have “ILS look alike” characteristics, the applicant may propose that the new installation be treated as a new ILS receiver for approval on a particular airplane type.
6.7.5.2.6.2. MLS or GLS Failure Analysis. The failure characteristics of the new or modified installation should be reviewed, equivalent to systems using ILS data, to ensure that the failure characteristics are compatible with and do not invalidate any original or previous safety assessments.
6.7.5.2.6.3. MLS or GLS Statistical Performance Assessment. If the flight control/guidance system control algorithms are unchanged or effects of any changes are fully accounted for (e.g., navigation reference point), the statistical performance assessment of a currently certificated automatic landing system or Head Up Display landing or takeoff system should typically not have to be re-assessed for the addition of MLS or GLS functionality. This equivalence is based on the assumption that the MLS or GLS receiver, or the MLS or GLS partition of an MMR, can be shown to have satisfactory “ILS Look alike” characteristics.
6.7.5.2.6.4. MLS or GLS Antenna or Navigation Reference Point Location. The implication of differences in position of the MLS or GLS and ILS aircraft antennas or Navigation Reference Point should be assessed considering:
a. Wheel-to-threshold crossing height;
b. Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).
6.7.5.2.6.5. MLS or GLS Introduction Flight Testing (as necessary). For an installation of MLS or GLS which can be treated as a new ILS receiver, a flight test program of typically a minimum of 10 to15 approaches terminating in a landing and rollout (if applicable) using the flight control/guidance system, including a minimum of two MLS or GLS facilities for each system to be authorized should be completed. The approaches should include captures from both sides of the final approach course using representative angles and distances, should include captures from below and above the glideslope if applicable, and should include representative wind conditions where antenna or navigation reference point positions may impact performance.
The approach and landing performance (flight path deviation, touchdown data, etc.) as appropriate, should be shown to be equivalent to that achieved in the original ILS certification. Recorded flight test data may be required to support equivalency.
A demonstration of take off guidance performance should be included where applicable.
6.7.5.2.6.6. MLS or GLS Introduction Documentation. The following documentation should be provided for certification of MLS or GLS:
a. An Impact Assessment including effects on System Safety Assessments.
b. A Flight test report, if applicable.
c. Revisions to the Flight Manual where appropriate.
7. APPROACH SYSTEM EVALUATION. An evaluation should be conducted to verify that the pertinent systems as installed in the airplane meet the airworthiness requirements of paragraph 6 of this appendix. The evaluation should include verification of approach system performance requirements and a safety assessment for verification of the integrity and availability requirements. Engine failure cases and simulator and/or flight tests should demonstrate other selected failure conditions identified by the safety assessment.
An applicant shall provide a certification plan(s) that describes:
Appendix 3
a. The means proposed to show compliance with the requirements of paragraph 6 of this appendix, with particular attention to methods that differ significantly from those described in this appendix.
b. How any non-airplane elements of the Approach System relate to the airplane system from a performance, integrity, and availability perspective (e.g., appropriate reference to ICAO Annex or U.S. Standard).
c. The assumptions on how the performance, integrity, and availability requirements of the non-airplane elements of non-Standard Landing Aids will be assured.
d. The system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and requirements in excess of that contained in this appendix are necessary.
Early agreement between the applicant and the FAA should be reached on the proposed certification plan. Upon completion of an FAA engineering design review and supporting simulation studies, a type inspection authorization (TIA) should be issued to determine if the complete installation of the equipment associated with Category II operations meets the criteria of this appendix.
7.1. Performance Evaluation. Performance for an airborne system intended to meet provisions of this Appendix should be demonstrated by flight test.
The airborne system should be demonstrated in at least the following conditions taking into account manual/coupled autopilot, autothrottle configurations for Category II approaches:
a. Wind Conditions:
20 kts - Head wind component 10 kts - Crosswind component 10 kts - Tailwind component ATS reported surface winds, or equivalent, may be used.
b. Performance shall be demonstrated by flight test, or analysis validated by flight test, using at least three different representative facilities for a minimum of 20 total approaches, with a representative range of environmental and system variables which have an effect on overall performance. If more than one approach in the series of approaches attempted is unsuccessful, an additional number of successful approaches may be required, as agreed by the applicant and FAA. When applied to path vertical tracking in conjunction with Category III, momentary excursions up to ±75 microamps during test demonstrations may be acceptable if flight guidance system touchdown and landing performance is otherwise shown to be satisfactory.
FAA will accept use of the Continuous Method and the Pass/Fail Method, found in JAR ACJ AWO 231, in lieu of the 95% of the time per approach described in sub-paragraphs of 6.2, and the minimum number of 20 approaches stated above.
7.2. Safety Assessment. Except as required by any specific safety related criteria identified in this appendix, or by the operating rules, a safety assessment of the approach system, considered separately and in conjunction with other systems, shall be conducted to show compliance with section 25.1309.
8. AIRBORNE SYSTEM REQUIREMENTS. This section identifies criteria applicable to specific aircraft system architecture selected to conduct the operation. This criteria is developed from operational considerations, approach system considerations, airplane system considerations, and the general operational philosophy contained in the body of this AC.
Appendix 3
8.1. General. Various airplane systems are expected to comply with the basic performance, integrity, and availability requirements as identified in Paragraph 6 of this Appendix.
8.2. Autopilot. The following criteria is applicable to Autopilot systems:
The suitability of pertinent autopilot modes or features applicable to conducting or monitoring an approach, landing, rollout, or go around, as applicable, should be considered in showing compliance with section 25.1523.
The autopilot must not have normal features or performance, or performance in typical adverse environmental conditions which would cause undue crew concern and lead to disconnect (e.g., inappropriate response to ILS beam disturbances or turbulence, unnecessarily abrupt flare or go-around attitude changes, unusual or inappropriate pitch or bank attitudes, or sideslip response).
Control of Approach Flight Path. The autopilot must:
a. maintain the approach path;
b. if applicable, make the alignment with the runway, flare and land the airplane within the prescribed limits; or
c. promptly go-around, with minimum practical loss of altitude.
Autopilot performance must be compatible with either manual speed control, or, if applicable, autothrottle speed control.
Mode definition and logic should be consistent with appropriate industry practice for mode identification and use
(e.g., naming, mode arming, and engagement). Definition of new modes or features, not otherwise in common use, should be consistent with their intended function, and consider potential for setting appropriate or adverse precedent.
The autopilot system performance and alerting should be consistent with the intended operational use for duties and procedures of the pilot flying (PF) and pilot not flying (PNF). See paragraphs 5.6 and 5.8 of the main body of this AC.
If the autopilot is used to control the flight path of the airplane to intercept and establish the approach path, the pilot should be able to transition from automatic to manual flight at any time without undue effort, attention, or control forces, and with a minimum of disturbance of flight path.
If an HUD is installed, any transition from autopilot to HUD guidance or vice versa, must not require exceptional piloting skill, alertness, strength, or excessive workload.
A flight director system, or alternative form of guidance, if used, must be compatible with the autopilot and vice versa.
A fault must cause an autopilot advisory, caution, or warning, as necessary. If a warning is necessary, the pilot must be able to detect the warning with a normal level of attention and alertness expected during an approach or goaround.
8.3. Head Down Guidance. The following criteria is applicable to Head Down Guidance systems:
A flight director system, or alternative form of guidance, must be designed so that the probability of display of incorrect guidance commands is remote.
Wherever practical, a fault must cause guidance information to be immediately removed from view. If a warning is given instead, it must be such that the pilot will observe the warning while using the information.
Appendix 3
8.4. Head Up Guidance. The following criteria is applicable to Head Up Guidance systems:
a. The workload associated with use of the HUD should be considered in showing compliance with section 25.1523.
b. The HUD display medium must not significantly obscure the pilot’s view through the cockpit window.
c. Control of Approach Flight Path - the HUD must provide sufficient guidance information, without excessive reference to other cockpit displays, to enable a suitably trained pilot to:
• maintain the approach path
• go-around
d. The pilot should be able to align with the runway without the HUD adversely affecting the pilot task. If command information is provided for the flare and landing, it must not be misleading and should be consistent with the characteristics of normal manual maneuvers.
e. If only one HUD is installed, it should be installed at the pilot-in-command crew station.
f. The HUD guidance must not require exceptional piloting skill to achieve the required performance.
g. The HUD system performance and alerting should be consistent with the intended operational use for duties and procedures of the pilot flying (PF) and pilot not flying (PNF) (see paragraphs 5.6 and 5.8 of the main body of this AC).
h. If the autopilot is used to control the flight path of the airplane to intercept and establish the approach path, the point during the approach at which the transition from automatic to manual flight takes place shall be identified and used for the performance demonstration.
i. Any transition from autopilot to HUD guidance must not require exceptional piloting skill, alertness, strength, or excessive workload.
j. A flight director system, or alternative form of guidance, must be designed so that the probability of display of incorrect guidance commands is remote.
k. Wherever practical, a fault must cause guidance information to be immediately removed from view. If a warning is given instead, it must be such that the pilot will observe the warning while using the information.
8.5. Hybrid HUD/Autoland Systems [PoC]. The following criteria is applicable to Hybrid systems:
a. If an HUD is used to monitor an autoflight system, it should be shown to be compatible with the autoflight system and permit a pilot to detect unsuitable autopilot performance.
b. Other hybrid systems (e.g., including EVS) require a proof of concept [PoC] evaluation to establish suitable criteria.
8.6. Satellite-based Approach System. The following criteria is applicable to Satellite-based Approach systems:
a. Satellite-based systems should be shown to provide equivalent or better capability than navigation systems based on VHF Omni-directional Radio Range (VOR), Distance Measuring Equipment (DME), or ILS for comparable operations, or meet provisions applicable to RNP.
Appendix 3
b. Satellite-based systems should not exhibit undue sensitivity to masking of satellite vehicles, or interference from onboard or external sources.
c. Satellite-based systems should not exhibit adverse characteristics during acquisition or loss of satellites.
8.7. Reserved.
8.8. Autothrottle. For Category II, an autothrottle should meet the provisions of paragraph 8.8 of Appendix 2, and in addition:
a. Hold speed within ± 5 knots of the intended speed, except for momentary gusts, in typical environmental conditions expected for use;
b. Provide appropriate status, advisory, caution, and warning information for failures;
c. Provide timely application of “Go-around thrust” if a go-around mode is available; and
d. Not require undue crew attention or skill to recognize and respond to an engine failure during approach or go-around.
8.9. Data Link [PoC]. A data link may be used to provide data to the airplane to provide the accuracy necessary to support the approach.
a. The integrity of the data link should be commensurate with the integrity required for the approach.
b. The role of the data link in the approach system must be addressed as part of the aircraft system certification process until such time as an acceptable national or international standard for the ground system is established.
9. AIRPLANE FLIGHT MANUAL (AFM). The AFM should contain the following information:
a. Any conditions or constraints on approach performance with regard to airport conditions (e.g., elevation, ambient temperature, approach path slope, runway slope, and ground profile under the approach path).
b. The criteria used for the demonstration of the system, acceptable normal and non-normal procedures, the demonstrated configurations, and types of facilities used, and any constraints or limitations necessary for safe operation.
c. The type of navigation facilities used as a basis for certification. This should not be taken as a limitation on the use of other facilities. The AFM may contain a statement regarding the type of facilities or condition known to be unacceptable for use.
d. Information should be provided to the flightcrew regarding atmospheric conditions under which the system was demonstrated (e.g., headwind, crosswind, tailwind). The AFM should contain a statement that “Credit may not be predicated on the use of <type of system> if conditions exceed … (those for which the system received airworthiness approval).”
Note 1: The AFM limitation section should not specify DA(H) or Runway Visual Range (RVR) limitations.
Note 2: AC 25.1581-1, Airplane Flight Manual, Section 2, discusses AFM contents. The approval status referenced in 2 b (9) (vii) for Category I, II, or III of that AC should be noted in the Normal Procedures Section of the AFM, in accordance with the above provisions.
Appendix 3
e. For a system meeting provisions of Appendix 3, the Normal Procedures, Normal Operations, or equivalent section, of the AFM should also contain the following statements:
“The airborne system has been demonstrated to meet the airworthiness requirements of AC 120-29A Appendix 3 for <specify the pertinent approach capability section(s) criteria met> when the following equipment is installed and operative:
<list pertinent equipment>” “This AFM provision does not constitute operational approval or credit for Category III use of this system.”
Appendix 4 Page 1 (and 2) APPENDIX 4.
WIND MODEL FOR APPROACH SIMULATION Wind models need not be applied to obtain approval of systems related to Appendix 2 or Appendix 3. However, if the applicant elects to use simulation with a wind model to support approval, it is recommended that the model specified in Advisory Circular 120-28D, Criteria for Approval of Category III Landing Weather Minima for Takeoff, Landing, and Rollout, is used.