AC 20-191 CHAPTER 5. CATEGORY (CAT) III
5.1 Introduction.
5.1.1 This chapter contains airworthiness approval criteria for equipment used to conduct an approach, landing, and rollout in CAT III weather minima using an ILS or GBAS.
Landing and rollout may combine various combinations of aircraft sensors and system architecture with various combinations of ground and space -based elements. This AC does not provide criteria for each potential combination of airborne and non- airborne elements.
5.1.2 This chapter addresses the approach , landing and rollout phase of flight, beginning at the FAF, through the CAT III DH, ending at the landing , and rollout phase.
5.1.3 ICAO Annex 10 i ncludes standards for ILS and GBAS systems intended to support CAT III operations. This chapter addresses operations using either ILS or GBAS for approaches, using ILS avionics produced in accordance with TSO-C34e, TSO-C36e authorizations, and GBAS avionics with TSO-C161b and TSO-C162b authorizations.
5.1.4 The standards for GBAS (RTCA DO- 253D Change 1 and ICAO Annex 10) define two general classes of GBAS service s, Approach Service , and the GBAS Positioning Service. The standards further differentiate GAST. A GAST is defined as the matched set of airborne and ground performance and functional requirements intended to be used in concert in order to provide approach guidance with quantifiable performance.
Applicants for CAT III airworthiness seek approval through GBAS GAST -D level of service.
5.2 Airworthiness Criteria.
5.2.1 The airworthiness criteria contained in this chapter for the CAT II I landing and rollout system satisfy the operational requirements described in AC 120-118. The basic airworthiness criteria are independent of the specific implementation in the aircraft or the type of approach landing system and rollout selected for the approach.
5.2.2 Performance provisions for touchdown performance, landing sink rates , and attitudes, etc. (see section 5.4.2.4, below) are the same for landing systems with automatic flight control, and systems for manual flight control with command information as guidance.
5.2.3 The applicant’s type certification proposal should include criterion such as the system’s intended function, accuracy, reliability, and fail- safe features. The proposal should also address the operational concepts contained in AC 1 20-118.
5.2.4 The low visibility landing system is intended to guide the aircraft to a touchdown in the prescribed touchdown zone, with an appropriate sink rate and attitude without exceeding prescribed load limits of the aircraft. The rollout system is intended to guide the aircraft to converge on and track the runway centerline, from the point of 5-1
AC 20-191 touchdown t o a safe taxi speed.
5.2.5 The overall assurance of performance and safety of an operation can only be assessed when all elements of the system are considered.
5.2.6 The low-visibility landing system must be shown to be satisfactory with and without the use of any outside visual references, except that outside visual references will not be considered when assessing lateral tracking performance. The airworthiness evaluation will also determine whether the c ombination of guidance and outside visual references would unacceptably degrade task performance or require exceptional workload and pilot compensation . The evaluation should include normal operations and non-normal operations with system and aircraft failure conditions.
5.2.7 General Airworthiness Criteria .
5.2.7.1 The applicant establishes the intended flight path. The path may be established in a number of ways, including the use of navigation aids (e.g., ILS or GLS). Other methods may be acceptable if the applicant can show feasibility through other means, for example:
• Sensing of the runway environment (e.g., surface, lighting or markings or both) with a vision enhancement system, or
• By a vision enhancement system.
5.2.7.2 On-board navigation systems may have various sensor elements by which to determine aircraft position. The sensor elements may include ILS, Inertial information, GLS, or other GNSS elements. Each of these sensor elements should comply with their performance provisions within appropriate limitations.
5.2.7.3 The system should provide an indication of the aircraft position with respect to the intended lateral path using:
• Deviation displays with reference to a navigation source (e.g., ILS receiver, GLS receiver, etc.), or
• On-board navigation system computations with corresponding displays of position and reference path.
5.2.8 Accuracy.
5.2.8.1 Acquisition Performance.
The acquisition should be accomplished in a manner compatible with instrument procedure requirements and flight crew requirements for the type of approach being conducted. The approach guidance system must not generate sustained oscillating command information (e.g., flight director, HUD, etc.) or require unusual effort by the pilot to control the flight path.
5-2
AC 20-191
5.2.8.2 La teral and Vertical Tracking Performance.
The applicant must show the system will meet the following performance parameters:
5.2.8.2.1 Stable lateral tracking performance from 1000 ft. Height Above Touchdown (HAT) to 300 ft. HAT should be stable without large deviations (i.e., within ±50 microamps deviation or equivalent) from the indicated course or path.
5.2.8.2.2 Stable lateral tracking performance from 300 ft. HAT to touchdown without large deviations (i.e., within ±25 microamps deviation) from the indicated course, for 95% of the time.
5.2.8.2.3 Stable vertical tracking from 700 ft. HAT to 300 ft. HAT should be stable without large deviations (i.e., within ±75 microamps deviation or equivalent) from the indicated course or path.
5.2.8.2.4 Stable vertical tracking performance from 300 ft. HAT to until commencing the flare maneuver (e.g., 100 ft. ) without large deviations (i.e., within ±35 microamps deviation) from the indicated path or ±12 ft., whichever is greater, for 95% of the time. Momentary excursions up to ±75 microamps during test demonstrations may be acceptable if the applicant shows satisfactory performance of the flight guidance system through touchdown and landing.
5.2.8.2.5 The FAA will accept use of the Continuous Method and the Pass/Fail Method, both found in EASA AMC AWO 231, in lieu of the 95% probability of success tracking requirement described in sections 5.2.8.2.1, 5.2.8.2.2, 5.2.8.2.3 and
5.2.8.2.4 using a minimum of 20 approaches .
5.2.9 Approach and Landing System Performance .
5.2.9.1 Stable Approach.
The applicant should conduct a stable approach (i.e., “normal maneuvering” without excessive attitudes, sink rates, path deviations, or speed deviations) to the point where a smooth transition is made to the landing.
5.2.9.1.1 If the landing system is designed to perform an alignment function prior to touchdown, to correct for crosswind effects, the system should operate in a manner consistent with the pilot's manual technique for crosswind landings . Typically, the pilot's manual technique includes the wing low , side slip procedure. Non-availability of the alignment mode, or failure of the alignment mode to perform its intended function must 5-3
AC 20-191 be easily detectable, or be suitably annunciated, so that the flig ht crew can take appropriate action.
5.2.9.1.2 The "landing flare to touchdown" maneuver should reduce the aircraft sink rate to a value not exceeding the sink rate for landing as listed in the AF M.
5.2.9.2 Speed Control Performance.
Airspeed must be controllable to within +/- five knots of the approach speed*, except for momentary gusts, up to the point where the throttles are retarded to idle for landing. For operations flown with manual control of approach speed, the flight crew must be able to control speed to within +/- five knots of the approach speed.
*This criterion is not specific to low visibility systems but must be met by low visibility systems.
5.2.9.3 Landing System Performance.
All types of low visibility landing systems, including automatic flight control, guidance for manual control, and hybrid systems, must meet the performance specified in section 5.2.9.4. The performance values may vary where justified by the characteristics of the aircraft. Additional performance provisions apply for GLS systems. See sections 5.2.9.5 through 5.2.9.7.
5.2.9.4 Nominal Performance (ILS, GLS).
The nominal performance provisions establish compatibility of the aircraft system performance with basic navigation system accuracy in fault-free conditions and nominal environmental conditions. Nominal conditions include both normal and rare normal conditions. The variables affecting performance that an applicant must include in the assessment are discussed in section 5.2.9.9. The nominal performance criteria and probabilities are as follows:
5.2.9.4.1 Probability of long itudinal touchdown earlier than a point on the runway 200 ft. (60m) from the threshold must not exceed
10-6.
5.2.9.4.2 Probability of longitudinal touchdown beyond 2700 ft.(823m) from threshold must not exceed 10-6.
5.2.9.4.3 Probability of lateral touchdown with the outboard landing gear more than 70 ft. (21.3 m) from runway centerline must not exceed 10-6 (assuming a 150 ft runway width) .
5.2.9.4.4 Probability of s ink rate at the structural limit load must not exceed 10-6. An acceptable means of establishing that the structural limit load is within its specified limit is to show separately and independently that:
5-4
AC 20-191
• The limit load that results from a sink rate at touchdown not greater than 10 fps or the limit rate of descent used for certification under 14 CFR Part 25 subpart C (see § 25.473), whichever is greater. For part 23, 27, and 29 aircraft, the limit load conditions specified in §§ 23.2220,
27.473, or 29.473 apply, respectively.
• The lateral side load does not exceed the limit value determined for the lateral drift landing condition defined in § 25.479(d)(2). For Part 23, 27, and 29 aircraft, the level landing conditions specified in §§ 23.2220, 27.479, or
29.479 apply, respectively.
5.2.9.4.5 Probability of bank angle resulting in hazard must not exceed
10-7. For example, a hazard to a fixed wing aircraft means a bank angle resulting in any part of the wing including the tip, high lift device, or engine nacelle touching the ground. For rotorcraft the hazard definition will be based on the rotorcraft’s unique capabilities. Reference AC 27 -1 or AC 29- 2 for additional information on helicopters.
5.2.9.5 GLS.
The applicant must assess the effect of nominal GLS errors on landing system performance via simulation using the GLS Noise Model provided in
5.5.8 Appendix C or an approved equivalent model), including the fault-free elements, as described in sections C.1.2 through C.1.6.
5.2.9.5.1 When using GBAS, the required flight path is uplinked to the aircraft after the approach is selected. This path is used for flight guidance or the autopilot or both when required to conduct an approach, landing, and rollout.
5.2.9.5.2 Corruption of the information contained in the received VDB to define the reference path is considered a hazardous condition. Failure resulting in undetected changes to the approach path definitions data must be extremely remote.
5.2.9.5.3 The flight crew must not be able to modify information that relates to the critical definition of required flight path.
5.2.9.6 Compatibility with Rare Undetected Non-Aircraft System Error Conditions (e.g., satellite faults, ionospheric anomalies).
For any value of GLS navigation system error resulting from faults, in conjunction with nominal conditions:
• The probability of longitudinal touchdown earlier than a point on the runway 200 ft. (60 m) from the threshold must not exceed 10-5.
5-5
AC 20-191
• The probability of longitudinal touchdown beyond a point on the r unway 3000 ft. (900 m) from the threshold must not exceed 10-5.
• The probability of lateral touchdown with the outboard landing gear more than 70 ft. (21 m) from the runway centerline must not exceed 10-5 (assuming a 150 ft runway width).
• The probability of sink rate at the structural limit load, must not exceed 10-5.
• The probability of bank angle where the wing tip touches the ground prior to the landing gear must not exceed 10-6.
• The probability of lateral velocity (or sideslip angle) at the structural limit load must not exceed 10-5.
Note: For HUD landing systems, where total wind strength has been shown to be the most critical parameter affecting performance, an alternative means of compliance may be used.
5.2.9.6.1 Evaluation of landing probability.
The applicant cannot take credit for the probability of faults when evaluating the required landing probabilities. However, the applicant may take credit for the ground subsystem’s probability of detection for satellite faults and the aircraft’s probability of detection for single reference receiver faults. The GLS errors may be considered bias-like for the duration of an approach and landing as this is the worst-case scenario.
5.2.9.6.2 Non-GLS variable.
When assessing the GLS performance, the applicant must account for other non-GLS variables affecting performance.
These non-GLS variables must vary according to their expected distributions.
Note 1: The criteria ensures that undetected faults in conjunction with nominal conditions in the non-aircraft GBAS system, when combined with all other variables affecting landing performance, do not result in an unacceptably high probability of landing outside the limits that define a safe landing. See section 5.2.10.1.6 for the conditions that define a safe landing. These faults include only satellite faults and single ground reference receiver faults.
Note 2: Appendix C - GLS Signal Model section C.1.9 provides an example demonstration method for the performance specified in this section. The appendix also contains a list of references used to derive the signal model. These references describe undetected non-aircraft system error conditions, nominal performance, and faults as well as the ICAO standardized ground system monitoring requirements. The aircraft 5-6
AC 20-191 performance provisions in this section are intended to address non-airc raft system errors that are below the ground monitoring thresholds. Such errors are not considered a malfunction of the non-aircraft system.
Note 3: It is assumed that operations will be approved with knowledge of the runway specific glide path and TCH values and the aircraft’s capability. Therefore, it is not necessary to set the glide path or TCH or both values to the limits allowed for the aircraft.
5.2.9.7 Compatibility with Worst Case Undetected Guidance Errors.
5.2.9.7.1 Undetected errors that are not extremely improbable must be shown to not prevent a safe landing or go -around or both when all other variables affecting performance are at their nominal values. The definition of a safe landing is specified in section
5.2.10.1.6. The definition of a safe approach is an approach that does not penetrate the Obstacle Limitation Surfaces for Precision Approach Category II or III as defined by ICAO SARPs Annex 14 section 4.2.15 & Table 4 -1.
5.2.9.7.2 The applicant must assess the effect of worst-case undetected errors on landing system performance via simulation using the GLS Noise Model provided in 5.5.8 Appendix C (or an approved equivalent model). The worst case undetected errors must be simulated by using the maximum range domain error given in Table C-5 and Table C-7 of Appendix C in conjunction with the appropriate geometry screening factors used by the aircraft. The certification plan should specify how the demonstration will be conducted, including the number of cases and variables with pass/fail criteria. The aircraft performance must be assessed in the presence of the full range of bias and ramp type failures produced by the Fault Mode Generator described in Appendix C. This demonstration must include the irregular terrain profile as defined in section
5.2.9.10.
Note: Rare ionosphere events and undetected satellite or ground station failures could result in significant vertical (and lateral) position errors. Under certain conditions, such errors may go undetected by the system and could result in erroneous guidance if unmitigated. The effect of such errors may not be observable by the flight crew.
5.2.9.8 Rollout System Performance.
The rollout system, if included, must control the aircraft, in the case of an automatic flight control system, or provide command information as guidance to the pilot, for manual control, from the point of landing to a safe 5-7
AC 20-191 taxi speed. Th e loss of rudder effectiveness, as the aircraft speed is reduced, could be a factor in the level of approval which is granted to a system. The applicant should describe the system concept for rollout control so that the absence of low-speed control, such as a nose wheel steering system, can be assessed.
5.2.9.8.1 The automatic flight control system should provide de -rotation for airplanes, consistent with a pilot’s manual technique.
Systems which provide rollout guidance for manually controlled rollout are not required to provide de -rotation.
Systems which provide de -rotation, automatically or with guidance for manual control, must avoid any objectionable oscillatory motion or nose wheel touchdowns, pitch up, or other adverse behavior as a result of ground spoiler deployment or reverse thrust operation .
5.2.9.8.2 Automatic control during the landing and rollout should not result in any aircraft maneuvers which would cause the flight crew to intervene unnecessarily.
5.2.9.8.3 Landing and rollout guidance should be consistent with a pilot’s manual technique, and not require excessive skill or flight crew workload to accomplish the operation.
5.2.9.8.4 Safe taxi speed is the speed at which the pilot can safely leave the runway or bring the aircraft to a safe stop. The safe taxi speed may vary with visibility conditions, aircraft characteristics, and means of lateral control. The performance criteria in this section assume a 150 ft. (45.7m) runway width.
The rollout performance limit may be appropriately increased if operation is restricted to wider runways .
5.2.9.8.5 Rollout systems typically reference the runway centerline via ILS localizer or another approved approach navigation system.
The intended path for the rollout system is to keep the aircraft on the runway, and usually on the runway centerline.
5.2.9.8.6 The applicant should demonstrate that the rollout system:
• Does not cause the outboard tire(s) to deviate from the runway centerline by more than 70 ft. (21.3m), starting from the point at which touchdown occurs and continuing to a point at which a safe taxi speed is reached, to a probability of 1 x 10-6.
Note 1: These values assume a 150 ft (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.
5-8
AC 20-191 Note 2: 70 ft. (21.3m) deviation from centerline is equiva lent to outboard tire(s) at 5 ft. (1.5m) within the edge of a 150 ft. (45.7m) wide runway.
• Captures the intended path or converges on the intended path (e.g., localizer centerline) in a smooth, timely, and predictable manner. While a critically damped response is desired, minor overshoots are acceptable. Sustained or divergent oscillations or unnecessarily aggressive responses are unsatisfactory.
• Promptly corrects any lateral movement away from the runway centerline in a positive manner.
• Following touchdown, if not already on a converging path, causes the aircraft to initially turn and track a path to intercept the runway centerline at a point far enough in front of the aircraft obvious to the flight crew that the rollout system is performing properly. Also, the rollout system should intercept the centerline sufficiently before the stop end of the runway, and before the point at which taxi speed is reached.
5.2.9.9 Variables Affecting Performance.
The performance assessment must take into account at least the following variables with the variables being applied based upon their expected distribution:
• Configurations of the aircraft (e.g., flap/slat settings)
• Center of gravity
• Landing gross weight
• Conditions of headwind, tailwind, crosswind, turbulence and wind shear (see Appendix B for acceptable wind models)
• Approach airspeed and variations in approach airspeed
• Airport conditions (elevation, runway slope, runway condition)
• Individual pilot performance, for systems with manual control
• Any other parameter which may affect system performance
• Characteristics of applicable navigation aids, including variations in flight path definitions (ILS or GLS, aircraft and space elements, etc.)
Note: 5.5.8 Appendix C provides one acceptable model for the assumed characteristics of GLS guidance errors. Applicants using an alternate model are responsible for documenting the alternate model, its basis (including a mapping to ICAO Annex 10 characteristics and any additional assumptions made), and its validity.
5-9
AC 20-191
5.2.9.10 Irregu lar Approach Terrain.
Approach terrain may affect the performance and pilot acceptance of the Approach and Landing system. ICAO Annex 14 contains the information on the nominal characteristics of an airport. Applicants can use this information to characterize the airport environment for nominal performance assessment. The applicant must evaluate the system’s performance characteristics in the presence of significant approach terrain variations. At a minimum, the following profiles should be examined.
• Sloping runway - slopes of 0.8%
• Hilltop runway - 12.5% slope up to a point 200 ft. (60m) prior to the threshold
• Sea-wall - 6m (20 ft.) step up to threshold elevation at a point 60m prior to the threshold Note 1: In addition to the profiles described above, the FAA recommends examination of the known airport profiles with significant irregular approach terrain, at which operations are intended.
Note 2: Special operational evaluations are appropriate for certain airports having difficult pre-threshold terrain conditions. These evaluations consider each particular aircraft type, the particular flight control system, and may include consideration of particular system elements such as the type of radar altimeters installed or other equipment. Reference AC 120-118 for details on irregular approach terrain operational evaluations.
5.2.9.11 Approach and Automatic Landing with an Inoperative Engine.
When demonstrating engine-inoperative capabilities, the applicant must show the landing system performs a safe landing and, where applicable, safe rollout in this non-normal aircraft condition taking account the factors described in this chapter and the following:
5.2.9.11.1 Failure of the critical engine, and for propeller driven aircraft, where applicable, accounting for feathering of the propeller following failure of the critical engine.
5.2.9.11.2 Appropriate landing flap configurations .
5.2.9.11.3 Loss of any system associated with the inoperative engine,
e.g., electrical and hydraulic power .
5.2.9.11.4 Crosswinds in each direction of at least 10 knots .
5.2.9.11.5 Weight of aircraft .
5.2.9.12 Go Around.
Whether or not the applicant seeks engine out landing approval, the goaround from any point on the approach to touchdown must not require 5-10
AC 20-191 exceptional piloting skill, alertness, or strength. The applicant must ensure that sufficient information is available to determine that the aircraft can remain clear of obstacles.
5.2.9.13 Inoperative Engine Information.
The applicant should provide information for an operator to assure a successful go-around with an inoperative engine. The information may be in a form as requested by the operator, or as determined appropriate by the manufacturer. The information may or may not be provided to the operator as part of the AFM. Examples of acceptable information would include the following:
5.2.9.13.1 Information on height loss as a function of go -around initiation altitude . AC 25-7 provides one acceptable example
5.2.9.13.2 Performance information allowing the operator to determine that the operator can maintain safe obstacle clearance during a go-around with an engine failure
5.2.9.13.3 A method to assess and extend applicability of engine - inoperative takeoff performance obstacle clearance determinations for a balked landing or go -around event
5.2.10 Landing and Rollout System Integrity .
5.2.10.1 Landing System Integrity.
Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the applicant must evaluate the onboard components of the landing systems, considered separately, and in relation to other associated onboard systems.
In addition, the applicant must also include any specific safety related criteria identified in this chapter in the evaluation. The applicant can use the following criteria to show compliance with §§ 23.2500, 23.2510, 23.2605,
25.1309, 27.1309, or 29.1309 for the Landing Systems.
5.2.10.1.1 Probability of unsafe landing.
Any single malfunction or any combination of malfunctions of the landing system preventing a safe landing or go-around must be extremely improbable, unless it can be detected and annunciated, as a warning to allow pilot intervention to avoid catastrophic results and shown to be extremely remote.
5.2.10.1.2 Probability of Missed Detection.
Failure to detect and annunciate malfunctions preventing a safe landing or go-around must be extremely improbable.
5-11
AC 20-191
5.2.10.1.3 Exp osure Time.
The exposure time for assessing failure probabilities for fail passive landing systems is the average time required to descend from 100 feet HAT to touchdown. The exposure time for assessing failure probabilities for fail operational landing systems is the average time to descend from 200 feet HAT to touchdown. The applicant must address all latent faults that may exist prior to the start of the exposure time (at or before 100 ft HAT for fail passive and at or before 200 ft. HAT for fail operational).
5.2.10.1.4 Deviations Associated with Malfunction (Fail Passive).
For a fail passive automatic landing system, a single malfunction or any combination of malfunctions must not cause a significant deviation of the flight path or attitude following system disengagement. The aircraft must be safely trimmed when the system disengages to prevent these significant deviations.
5.2.10.1.5 Deviations Associated with Malfunction (Fail Operational).
A fail operational automatic landing system, following a single malfunction, must not lose the capability to perform lateral and vertical path tracking, alignment with runway heading (e.g., decrab), flare, and touchdown within the safe landing criteria listed in section 5.2.10.1.6.
5.2.10.1.6 Safe Landing Criteria.
For the purpose of analysis, a safe landing may be assumed when the following performance is achieved:
• Longitudinal touchdown no earlier than a point on the runway 200 ft. (60m) from the threshold,
• Longitudinal touchdown no further than 3000 ft. (1000m) from the threshold (not beyond the end of the touchdown zone lighting), and
• Lateral touchdown with the outboard landing gear within 70 ft. (21m) from runway centerline. (These values assume a 150 ft. (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.)
5.2.10.1.7 Environmental Conditions.
Malfunction cases may be considered under nominal environmental conditions.
5-12