AC 20-191
4.2.12.4.4 Th e MMR must provide a means for the flight crew to determine a failure of the non -selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with the navigation source. For example, it would not be acceptable for the annunciation “ILS FAIL” to be displayed when the selected navigation source is GLS, and the failure actually affects the GLS receiver .
4.2.12.4.5 Outside the approach phase, the MMR should have the capability to indicate a failure of each element of a multi - mode approach and landing system as an advisory to the flight crew without pilot action.
4.2.12.4.6 During an approach, a failure of the active element of a multi-mode approach and landing system must be accompanied by a warning, caution, or advisory.
4.2.13 Multi-Mode Receivers This section provides guidance for MMRs used for CAT II for retrofit certifications, and for certification of ILS installations with either new or modified receivers.
4.2.13.1 Retrofit Considerations.
4.2.13.1.1 Typical receiver configurations for retrofit applications include:
• An ILS receiver from a new supplier
• A modified ILS receiver from the same supplier (e.g., for purposes of providing improved Frequency Modulation (FM) Immunity)
• A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment)
• A stand-alone GLS receiver
• A GLS partition in an MMR
4.2.13.1.2 General certification considerations include:
• Certification Process. An “impact assessment” should address all new receiver functionality considering:
o Differences between the current certification basis and that which is requested, if applicable.
o The functionality being added 4-8
AC 20-191 o Credit that can be taken for the existing approval
• Equi pment Approval. The applicant must follow 14 CFR Part 21, subpart O, to obtain a TSO authorization where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.
• Aircraft installation approval should consider the following:
o Impact on aircraft system safety assessments o Equipment approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna) o Electromagnetic Interference (EMI)/Electromagnetic Compatibility (EMC) testing o Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays o Electrical loading o Flight data recorder requirements o Suitable AFM provisions o Certification means of compliance for the receiver installation (e.g., specification of ground or flight testing or both, as necessary)
4.2.13.2 Re-certification.
Re-certification of an ILS function following the Introduction of a new or modified ILS navigation receiver installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. The applicant may use an impact assessment to establish a certification basis. The assessment will typically address the following:
4.2.13.2.1 New or Modified ILS Impact Assessment.
An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration:
• Hardware design
• Software design
• Signal processing and functional performance
• Failure analysis
• Receiver function, installation, and integration (e.g., with controls, indicators, and warnings) 4-9
AC 20-191 The impact assessment should also identify any additional con siderations such as:
• Future functionality provisions that have no impact on system operation
• Shared resources to support future functionality
• Based upon the assumption that the applicant can show the ILS receiver, or receiver function, to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver (replacing the existing receiver) for installation on a given aircraft type
4.2.13.2.2 New or Modified ILS Failure Analysis .The failure characteristics of the new or modified installation should be shown to be equivalent to systems using ILS data. This ensures the failure characteristics are compatible and do not invalidate any original or previous safety assessments.
4.2.13.2.3 New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary) .
For systems using a new ILS, or combined MMR receiver, complete a minimum of eight (8) approaches terminating in a successful (automatic or HUD) landing, and rollout (if applicable) using the flight control/guidance system, including a minimum of two (2) ILS facilities. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical Instrument Approach Procedures (IAPs), and, if applicable, from below and above the GS.
4.2.13.2.4 Approach and Landing Performance.
The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) is equivalent to that achieved in the original ILS certification.
The FAA may require recorded flight test data to support equivalency demonstration.
4.2.13.2.5 New or Modified ILS Documentation.
The applicant should provide the following documentation for certification:
• An impact assessment including effects on system safety assessments.
• A flight test report, if applicable.
• Revisions to the flight manual where appropriate.
4-10
AC 20-191
4.2.13.3 Re-certi fication Following the Introduction of a GLS Navigation Receiver Installation.
4.2.13.3.1 GLS Introduction Impact Assessment.
The impact assessment, if applicable, should assess equivalent aspects of the GLS receiver or receiver function to those for the existing ILS receiver configuration.
4.2.13.3.2 GLS Aircraft Integration/Installation Failure Mode and Effects Analysis.
The applicant should review the failure characteristics of the new or modified installation to ensure that the failure characteristics do not invalidate any original or previous safety assessments.
4.2.13.3.3 GLS Statistical Performance Assessment.
If the flight control/guidance system control algorithms are unchanged, or the applicant has already accounted for the effects of any changes (e.g., navigation reference point), the applicant may not have to re-assess the statistical performance of a currently certificated automatic landing system, HUD landing/takeoff system for the addition of GLS functionality.
4.2.13.3.4 GLS Antenna or Navigation Reference Point Location.
The applicant should assess the implication of differences in position of the GLS and ILS aircraft antennas or Navigation Reference Point considering:
• Wheel-to-threshold crossing height.
• Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).
4.2.13.3.5 GLS Introduction Flight Testing.
When installing a new GLS system to support CAT II operation, the applicant must accomplish a flight test program including a minimum of 10 approaches.
• The approaches must terminate in a landing (and rollout, if applicable) using the flight control/guidance system, and the approaches must include a minimum of two GLS facilities for each system.
• The approaches should include captures from both sides of the final approach course using representative angles and distances. Approaches should include captures from below 4-11
AC 20-191 and above the glidepath i f applicable, and representative wind conditions where antenna or navigation reference point positions may impact performance.
4.2.13.3.6 Approach and Landing Performance.
The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) is equivalent to the original ILS certification. The FAA may require recorded flight test data to confirm equivalency.
4.2.13.3.7 New or Modified ILS Documentation.
The applicant should provide the following documentation for GLS:
• An impact assessment including effects on system safety assessments
• A flight test report, if applicable; and
• Revisions to the flight manual where appropriate.
4.3 Airborne Systems for CAT II Operations.
This section identifies criteria applicable to specific aircraft system architecture selected to conduct CAT II.
4.3.1 General.
Applicable aircraft systems should comply with the basic performance, integrity, and availability criteria as identified in section 4.2 of this Chapter.
4.3.2 Autopilot.
The following criteria apply to autopilot systems:
4.3.2.1 The suitability of pertinent autopilot modes or features applicable to conducting or monitoring an approach, landing, rollout, or go around, as applicable, should follow the principles/guidance contained in ACs 23-8, 23-17, 25.1329-1, 27-1 and 29-2 as applicable.
4.3.2.2 The autopilot must not cause undue flight crew concern and lead to disconnect (e.g., inappropriate response to ILS beam disturbances or turbulence, inappropriate response to temporary loss of VDB signals, unnecessarily abrupt flare or go-around attitude changes, unusual or inappropriate pitch or bank attitudes, or sideslip response).
4.3.2.3 Regarding control of approach flight path, the autopilot must:
• Maintain the approach path
• If applicable, make the alignment with the runway, flare, and land the 4-12
AC 20-191 aircr aft within the prescribed limits
• If applicable, promptly go-around, with minimum practical altitude loss
4.3.2.4 Autopilot performance must be compatible with either manual speed control, or, if applicable, autothrottle/autothrust speed control.
4.3.2.5 Mode definition and logic should be consistent with appropriate industry practice for mode identification and use (e.g., naming, mode arming, and engagement). Definition of new modes or features, not otherwise commonly used, should be consistent with their intended function, and the applicant should consider their potential for setting inappropriate or adverse precedent.
4.3.2.6 If the autopilot is used to control the flight path of the aircraft to intercept and establish the approach path, the pilot should be able to transition from automatic to manual flight at any time without undue effort, attention, or control forces, and with a minimum of disturbance of flight path.
4.3.2.7 A flight director system, or alternative form of guidance, if used, must be compatible with the autopilot.
4.3.2.8 The FAA recommends at least one autopilot and dual flight director systems with an independent display for each pilot. Dual guidance systems providing the same information to both pilots may be acceptable only if suitable comparison monitoring between the systems is available, and timely transfer to the standby system can be completed, and suitable annunciation to the flight crew is provided.
4.3.2.9 A fault must cause an autopilot advisory, caution, or warning, as necessary.
If a warning is necessary, the pilot must be able to detect the warning with a normal level of attention and alertness expected during an approach or goaround.
4-13
AC 20-191
4.3.3 He ad Down Guidance . The following criteria applies to Head Down Guidance systems:
4.3.3.1 A flight director system, or alternative form of guidance, must be designed so that the probability of display of incorrect guidance commands is remote.
4.3.3.2 Wherever practical, a fault must cause guidance information to be immediately removed from view. If a warning is given instead, it must be such that the pilot will observe the warning while using the guidance information.
4.3.4 Head Up Guidance.
If the system includes a HUD, the following criteria are applicable to Head Up Guidance systems:
4.3.4.1 The workload associated with use of the HUD must comply with 14 CFR §§
23.2610, 25.1523, 27.1523, or 29.1523. Reference AC 23.1523, AC
25.1523-1 and AC 25-11, AC 27-1, or AC 29-2 as applicable for additional guidance.
4.3.4.2 The HUD installation and display presentation must meet 14 CFR §§
23.2600(a), 25.773, 27.773, or 29.773, as applicable. Reference AC
23.1311-1, AC 25.773 and AC 25-11, appendix F; or AC 27-1 or AC 29-2 for additional guidance.
4.3.4.3 If the autopilot is used to control the flight path of the aircraft to intercept and establish the approach path, the point during the approach at which the transition from automatic to manual flight takes place must be identified and used for the performance demonstration.
4.3.4.4 A flight director system, or alternative form of guidance, must be designed so that the probability of display of incorrect guidance commands is remote.
4.3.5 HUD use to monitor autoflight systems.
The HUD must be compatible with the autoflight system and permit the pilot to detect unsuitable autopilot performance.
4.3.6 Autothrottle/Autothrust.
4.3.6.1 If autothrottle/autothrust capability is installed, the applicant should identify any necessary modes, conditions, procedures, or constraints that apply to its use.
4.3.6.2 Use of the autothrottle/autothrust should not cause unacceptable performance of any autopilot modes intended for use. And any autopilot 4-14
AC 20-191 mode intended for use with autothrottle/autothrust should not cause unac ceptable autothrottle/autothrust performance.
4.3.6.3 The autothrottle/autothrust should expeditiously capture any commanded speed adjustments and maintain speed. The autothrottle/autothrust should not cause any hazardous conditions with normal use or in any probable failure modes, considering pilot intervention using normal piloting skills.
4.3.6.4 The autothrottle/autothrust should hold speed within -5 to +10 knots of the intended speed except for momentary gusts, in typical environmental conditions expected for use.
4.3.6.5 The autothrottle/autothrust should provide appropriate status, advisory, caution, and warning information for failures.
4.3.6.6 The autothrottle/autothrust should provide timely application of go-around thrust if a go-around mode is available.
4.3.6.7 The autothrottle/autothrust should not require undue flight crew attention or skill to recognize and respond to an engine failure during approach or goaround.
4.4 Approach System Evaluation.
The applicant should conduct an evaluation to verify that the pertinent systems as installed in the aircraft meet the airworthiness criteria of section 4.2 of this AC. The evaluation should include verification of approach system performance and a safety assessment for verification of the integrity and availability provisions. The applicant should demonstrate engine failure cases and other selected failure conditions identified by the safety assessment by simulator or flight test.
4.4.1 Certification Plan.
An applicant should provide a certification plan(s) describing:
4.4.1.1 The means proposed to show compliance with the criteria of section 4.2 of this AC, with particular attention to methods that differ significantly from those described in this chapter.
4.4.1.2 How non-aircraft elements of the approach system relate to the aircraft system from a performance, integrity, and availability perspective (e.g., appropriate reference to ICAO Annex or U.S. Standard).
4.4.1.3 The assumptions on how the performance, integrity, and availability requirements of the non-aircraft elements of standard landing aids will be assured, if applicable.
4.4.1.4 The effect of the aircraft navigation reference point on the aircraft flight path and wheel-to-threshold crossing height.
4-15
AC 20-191
4.4.1.5 The system concepts and operational philosophy to allow the FAA to determine whether criteria and guidance in excess of that contained in this chapter are necessary.
4.4.1.6 The applicant should reach an early agreement with the FAA on his/her proposed certification plan.
4.4.2 Performance Evaluation.
The applicant should demonstrate the airborne system performance meets provisions of this chapter using simulations and flight tests.
4.4.3 Airborne Performance System.
The airborne system performance demonstration should include at least the following conditions taking into account manual/coupled autopilot, autothrottle/autothrust configurations for CAT II approaches:
4.4.3.1 Wind Conditions:
• 20 kts - Head wind component
• 10 kts - Crosswind component
• 10 kts - Tailwind component Note: The FAA may accept lower limits if the applicant appropriately documents in the AFM and the certification plan.
4.4.3.2 The applicant must demonstrate performance by flight test, or analysis validated by flight test, using at least three different representative facilities for a minimum of 20 total approaches, with a representative range of environmental and system variables affecting overall performance. The applicant must achieve a minimum of 95% success in the number of attempted approaches.
4.4.3.3 The performance assessment must take into account at least the following variables with the variables being applied based upon their expected distribution:
• Configurations of the aircraft (e.g., flap settings),
• Center of gravity,
• Landing weight,
• Conditions of wind, turbulence, and wind shear,
• Characteristics of ground- and space-based systems and aids (i.e., ILS or GLS), and
• Any other parameter which may affect system performance (e.g., airport altitude, approach path slope, variations in approach speed).
4-16
AC 20-191
4.4.3.4 The FAA will accept use of the Continuous Method and the Pass/Fail Method, both found in EASA AMC AWO 231, in lieu of the 95% probability of success tracking requirement described in section 4.2.6.2, and the minimum number of 20 approaches stated in section 4.4.3.2.
4.4.3.5 The FAA recommends wind model analysis to obtain approval of systems related to CAT II. If an applicant elects to use simulation with a wind model to support approval, the applicant should use the model specified in Appendix B.
4.4.3.6 For GLS, the applicant should assess fault free performance of GLS using simulations such as Monte-Carlo with the input variables distributed according to their performance characteristics and a model of the GLS guidance including fault free error characteristics defined by the GLS signal model as specified in 5.5.8 Appendix C.
Note: Applicants with approved airworthiness criteria for GAST D level of service meet all the airworthiness criteria of this chapter.
4.4.4 Safety Assessment.
In addition to any specific safety related criteria identified in this chapter, the applicant must conduct a safety assessment of the approach and landing system, considered separately and in conjunction with other systems, to show compliance with §§ 23.2500,
23.2510, 23.2605, 25.1309, 27.1309, or 29.1309. The applicant can use the guidance contained in AC 23.1309-1, AC 25.1309-1, AC 27-1, or AC 29-2, as applicable.
4.4.4.1 The applicant must consider the responses to failures of navigation facilities, taking into account ICAO and other pertinent state criteria for navigation facilities.
4.4.4.2 Documented safety analysis conclusions must include:
4.4.4.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, an FHA conducted in accordance with the guidance provided by AC 23.1309-1 , AC 25.1309-1, AC 27-1 or AC 29-2, respectively, as applicable; a summary of results from the fault tree analysis, demonstrated compliance, and probability determinations for significant functional hazards.
4.4.4.2.2 Information regarding "alleviating flightcrew actions" that were considered in the safety analysis. This information should list appropriate alleviating actions, if any, and should be consistent with the validation conducted during testing. If alleviating actions are identified, the applicant should describe those actions in a form suitable to aid in developing, as applicable:
• Pertinent provisions of the AFM procedures section(s) 4-17
AC 20-191
• Fl i ght Crew Operating Manual (FCOM) provisions, or equivalent
• Pilot qualification criteria (e.g., training requirements, FSB provisions)
• Any other reference material necessary for an operator or flight crew to safely use the system
4.4.4.2.3 Information to support preparation of any necessary maintenance and preventive maintenance such as:
• Certification maintenance requirements (CMR)
• Periodic checks
• Other checks, as necessary (e.g., return to service)
4.4.4.2.4 Information applicable to lim itations, as necessary.
4.4.4.2.5 Identification of applicable syste ms, modes, or equipment necessary for use of the landing syste m. This information may be used, to aid in development of flight planning , dispatch criteria, or procedures or checklists for pilot selection of modes or assessment of system status, prior to initiation of approach or during approach.
4.4.4.2.6 Information necessary for development of non-normal procedures.
4.4.5 Continued Airworthiness.
4.4.5.1 Pursuant to 14 CFR §§ 23.1529, 25.1529, 27.1529, or 29.1529, an applicant must prepare an Instructions for Continued Airworthiness (ICA) for use by operators. The applicant must submit to the FAA a program showing how the applicant distributes changes made to the ICAs by the applicant or by the manufacturers of the ILS or GBAS avionics installed in the aircraft.
ICAs established during the approval process form the basis for an operator’s maintenance program.
4.4.5.2 Pursuant to 14 CFR §§ 21.3, the applicant must report any failure, malfunction, or defect whose occurrences could impact the safety of the flight crew or the structural integrity of the aircraft itself.
4.5 AFM.
Pursuant to 14 CFR §§ 23.2620, 25.1581, 27.1581, or 29.1581, as applicable, an applicant must furnish an AFM with each aircraft. The AFM should contain the following information:
4.5.1 Relevant conditions or constraints applicable to the approach and landing system use 4-18
AC 20-191 regardi ng the airport or runway conditions. For example:
• Runway elevation
• Ambient temperature
• Approach path slope
• Runway slope
• Ground profile under the approach path
4.5.2 The criteria and configurations used for the demonstration of the system .
4.5.3 Any constraints or limitations necessary for safe operation.
4.5.4 Acceptable normal and non-normal procedures.
4.5.5 The type of navigation facilities used as a basis for certification. This should not be taken as a limitation on the use of other facilities. The AFM may contain a statement regarding the type of facilities or condition known to be unacceptable for use (e.g., ILS or GLS). The AFM should indicate the operation is predicated upon the use of an ILS (or GLS) facility with performance and integrity equivalent to, or exceeding, a United States Type II or Type III ILS, GBAS GAST D, or equivalent ICAO Annex 10 Facility Performance CAT II facility.
4.5.6 Applicable atmospheric conditions under which the system was demonstrated (e.g., headwind, crosswind, tailwind).
4.5.7 Any necessary performance, procedure, or configuration data to permit an operator to determine climb gradient and transition distances for safe obstacle clearance during a missed approach, balked landing, or rejected landing. T his information need not be specifically included in the AFM if it is available to the operator using some other method acceptable to the operator and manufacturer (e.g., FCOM, supplementary performance information, separate AFM appendix).
4.5.8 For an approach and landing system meeting the provisions of this chapter, the Normal Procedures, Normal Operations, or equivalent section s, of the AFM should also contain the following statements:
“The airborne system has been demonstrated to meet the airworthiness provisions of AC 20-191 (Chapter 4) for [specify the pertinent approach capability section(s) criteria met] when the following equipment is installed and operative:
“[list pertinent equipment]” “This AFM provision does not constitute operational approval for CAT II use of the system.”
4-19