AC 20-191 be easily detectable, or be suitably annunciated, so that the flig ht crew can take appropriate action.
5.2.9.1.2 The "landing flare to touchdown" maneuver should reduce the aircraft sink rate to a value not exceeding the sink rate for landing as listed in the AF M.
5.2.9.2 Speed Control Performance.
Airspeed must be controllable to within +/- five knots of the approach speed*, except for momentary gusts, up to the point where the throttles are retarded to idle for landing. For operations flown with manual control of approach speed, the flight crew must be able to control speed to within +/- five knots of the approach speed.
*This criterion is not specific to low visibility systems but must be met by low visibility systems.
5.2.9.3 Landing System Performance.
All types of low visibility landing systems, including automatic flight control, guidance for manual control, and hybrid systems, must meet the performance specified in section 5.2.9.4. The performance values may vary where justified by the characteristics of the aircraft. Additional performance provisions apply for GLS systems. See sections 5.2.9.5 through 5.2.9.7.
5.2.9.4 Nominal Performance (ILS, GLS).
The nominal performance provisions establish compatibility of the aircraft system performance with basic navigation system accuracy in fault-free conditions and nominal environmental conditions. Nominal conditions include both normal and rare normal conditions. The variables affecting performance that an applicant must include in the assessment are discussed in section 5.2.9.9. The nominal performance criteria and probabilities are as follows:
5.2.9.4.1 Probability of long itudinal touchdown earlier than a point on the runway 200 ft. (60m) from the threshold must not exceed
10-6.
5.2.9.4.2 Probability of longitudinal touchdown beyond 2700 ft.(823m) from threshold must not exceed 10-6.
5.2.9.4.3 Probability of lateral touchdown with the outboard landing gear more than 70 ft. (21.3 m) from runway centerline must not exceed 10-6 (assuming a 150 ft runway width) .
5.2.9.4.4 Probability of s ink rate at the structural limit load must not exceed 10-6. An acceptable means of establishing that the structural limit load is within its specified limit is to show separately and independently that:
5-4
AC 20-191
• The limit load that results from a sink rate at touchdown not greater than 10 fps or the limit rate of descent used for certification under 14 CFR Part 25 subpart C (see § 25.473), whichever is greater. For part 23, 27, and 29 aircraft, the limit load conditions specified in §§ 23.2220,
27.473, or 29.473 apply, respectively.
• The lateral side load does not exceed the limit value determined for the lateral drift landing condition defined in § 25.479(d)(2). For Part 23, 27, and 29 aircraft, the level landing conditions specified in §§ 23.2220, 27.479, or
29.479 apply, respectively.
5.2.9.4.5 Probability of bank angle resulting in hazard must not exceed
10-7. For example, a hazard to a fixed wing aircraft means a bank angle resulting in any part of the wing including the tip, high lift device, or engine nacelle touching the ground. For rotorcraft the hazard definition will be based on the rotorcraft’s unique capabilities. Reference AC 27 -1 or AC 29- 2 for additional information on helicopters.
5.2.9.5 GLS.
The applicant must assess the effect of nominal GLS errors on landing system performance via simulation using the GLS Noise Model provided in
5.5.8 Appendix C or an approved equivalent model), including the fault-free elements, as described in sections C.1.2 through C.1.6.
5.2.9.5.1 When using GBAS, the required flight path is uplinked to the aircraft after the approach is selected. This path is used for flight guidance or the autopilot or both when required to conduct an approach, landing, and rollout.
5.2.9.5.2 Corruption of the information contained in the received VDB to define the reference path is considered a hazardous condition. Failure resulting in undetected changes to the approach path definitions data must be extremely remote.
5.2.9.5.3 The flight crew must not be able to modify information that relates to the critical definition of required flight path.
5.2.9.6 Compatibility with Rare Undetected Non-Aircraft System Error Conditions (e.g., satellite faults, ionospheric anomalies).
For any value of GLS navigation system error resulting from faults, in conjunction with nominal conditions:
• The probability of longitudinal touchdown earlier than a point on the runway 200 ft. (60 m) from the threshold must not exceed 10-5.
5-5
AC 20-191
• The probability of longitudinal touchdown beyond a point on the r unway 3000 ft. (900 m) from the threshold must not exceed 10-5.
• The probability of lateral touchdown with the outboard landing gear more than 70 ft. (21 m) from the runway centerline must not exceed 10-5 (assuming a 150 ft runway width).
• The probability of sink rate at the structural limit load, must not exceed 10-5.
• The probability of bank angle where the wing tip touches the ground prior to the landing gear must not exceed 10-6.
• The probability of lateral velocity (or sideslip angle) at the structural limit load must not exceed 10-5.
Note: For HUD landing systems, where total wind strength has been shown to be the most critical parameter affecting performance, an alternative means of compliance may be used.
5.2.9.6.1 Evaluation of landing probability.
The applicant cannot take credit for the probability of faults when evaluating the required landing probabilities. However, the applicant may take credit for the ground subsystem’s probability of detection for satellite faults and the aircraft’s probability of detection for single reference receiver faults. The GLS errors may be considered bias-like for the duration of an approach and landing as this is the worst-case scenario.
5.2.9.6.2 Non-GLS variable.
When assessing the GLS performance, the applicant must account for other non-GLS variables affecting performance.
These non-GLS variables must vary according to their expected distributions.
Note 1: The criteria ensures that undetected faults in conjunction with nominal conditions in the non-aircraft GBAS system, when combined with all other variables affecting landing performance, do not result in an unacceptably high probability of landing outside the limits that define a safe landing. See section 5.2.10.1.6 for the conditions that define a safe landing. These faults include only satellite faults and single ground reference receiver faults.
Note 2: Appendix C - GLS Signal Model section C.1.9 provides an example demonstration method for the performance specified in this section. The appendix also contains a list of references used to derive the signal model. These references describe undetected non-aircraft system error conditions, nominal performance, and faults as well as the ICAO standardized ground system monitoring requirements. The aircraft 5-6
AC 20-191 performance provisions in this section are intended to address non-airc raft system errors that are below the ground monitoring thresholds. Such errors are not considered a malfunction of the non-aircraft system.
Note 3: It is assumed that operations will be approved with knowledge of the runway specific glide path and TCH values and the aircraft’s capability. Therefore, it is not necessary to set the glide path or TCH or both values to the limits allowed for the aircraft.
5.2.9.7 Compatibility with Worst Case Undetected Guidance Errors.
5.2.9.7.1 Undetected errors that are not extremely improbable must be shown to not prevent a safe landing or go -around or both when all other variables affecting performance are at their nominal values. The definition of a safe landing is specified in section
5.2.10.1.6. The definition of a safe approach is an approach that does not penetrate the Obstacle Limitation Surfaces for Precision Approach Category II or III as defined by ICAO SARPs Annex 14 section 4.2.15 & Table 4 -1.
5.2.9.7.2 The applicant must assess the effect of worst-case undetected errors on landing system performance via simulation using the GLS Noise Model provided in 5.5.8 Appendix C (or an approved equivalent model). The worst case undetected errors must be simulated by using the maximum range domain error given in Table C-5 and Table C-7 of Appendix C in conjunction with the appropriate geometry screening factors used by the aircraft. The certification plan should specify how the demonstration will be conducted, including the number of cases and variables with pass/fail criteria. The aircraft performance must be assessed in the presence of the full range of bias and ramp type failures produced by the Fault Mode Generator described in Appendix C. This demonstration must include the irregular terrain profile as defined in section
5.2.9.10.
Note: Rare ionosphere events and undetected satellite or ground station failures could result in significant vertical (and lateral) position errors. Under certain conditions, such errors may go undetected by the system and could result in erroneous guidance if unmitigated. The effect of such errors may not be observable by the flight crew.
5.2.9.8 Rollout System Performance.
The rollout system, if included, must control the aircraft, in the case of an automatic flight control system, or provide command information as guidance to the pilot, for manual control, from the point of landing to a safe 5-7
AC 20-191 taxi speed. Th e loss of rudder effectiveness, as the aircraft speed is reduced, could be a factor in the level of approval which is granted to a system. The applicant should describe the system concept for rollout control so that the absence of low-speed control, such as a nose wheel steering system, can be assessed.
5.2.9.8.1 The automatic flight control system should provide de -rotation for airplanes, consistent with a pilot’s manual technique.
Systems which provide rollout guidance for manually controlled rollout are not required to provide de -rotation.
Systems which provide de -rotation, automatically or with guidance for manual control, must avoid any objectionable oscillatory motion or nose wheel touchdowns, pitch up, or other adverse behavior as a result of ground spoiler deployment or reverse thrust operation .
5.2.9.8.2 Automatic control during the landing and rollout should not result in any aircraft maneuvers which would cause the flight crew to intervene unnecessarily.
5.2.9.8.3 Landing and rollout guidance should be consistent with a pilot’s manual technique, and not require excessive skill or flight crew workload to accomplish the operation.
5.2.9.8.4 Safe taxi speed is the speed at which the pilot can safely leave the runway or bring the aircraft to a safe stop. The safe taxi speed may vary with visibility conditions, aircraft characteristics, and means of lateral control. The performance criteria in this section assume a 150 ft. (45.7m) runway width.
The rollout performance limit may be appropriately increased if operation is restricted to wider runways .
5.2.9.8.5 Rollout systems typically reference the runway centerline via ILS localizer or another approved approach navigation system.
The intended path for the rollout system is to keep the aircraft on the runway, and usually on the runway centerline.
5.2.9.8.6 The applicant should demonstrate that the rollout system:
• Does not cause the outboard tire(s) to deviate from the runway centerline by more than 70 ft. (21.3m), starting from the point at which touchdown occurs and continuing to a point at which a safe taxi speed is reached, to a probability of 1 x 10-6.
Note 1: These values assume a 150 ft (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.
5-8
AC 20-191 Note 2: 70 ft. (21.3m) deviation from centerline is equiva lent to outboard tire(s) at 5 ft. (1.5m) within the edge of a 150 ft. (45.7m) wide runway.
• Captures the intended path or converges on the intended path (e.g., localizer centerline) in a smooth, timely, and predictable manner. While a critically damped response is desired, minor overshoots are acceptable. Sustained or divergent oscillations or unnecessarily aggressive responses are unsatisfactory.
• Promptly corrects any lateral movement away from the runway centerline in a positive manner.
• Following touchdown, if not already on a converging path, causes the aircraft to initially turn and track a path to intercept the runway centerline at a point far enough in front of the aircraft obvious to the flight crew that the rollout system is performing properly. Also, the rollout system should intercept the centerline sufficiently before the stop end of the runway, and before the point at which taxi speed is reached.
5.2.9.9 Variables Affecting Performance.
The performance assessment must take into account at least the following variables with the variables being applied based upon their expected distribution:
• Configurations of the aircraft (e.g., flap/slat settings)
• Center of gravity
• Landing gross weight
• Conditions of headwind, tailwind, crosswind, turbulence and wind shear (see Appendix B for acceptable wind models)
• Approach airspeed and variations in approach airspeed
• Airport conditions (elevation, runway slope, runway condition)
• Individual pilot performance, for systems with manual control
• Any other parameter which may affect system performance
• Characteristics of applicable navigation aids, including variations in flight path definitions (ILS or GLS, aircraft and space elements, etc.)
Note: 5.5.8 Appendix C provides one acceptable model for the assumed characteristics of GLS guidance errors. Applicants using an alternate model are responsible for documenting the alternate model, its basis (including a mapping to ICAO Annex 10 characteristics and any additional assumptions made), and its validity.
5-9
AC 20-191
5.2.9.10 Irregu lar Approach Terrain.
Approach terrain may affect the performance and pilot acceptance of the Approach and Landing system. ICAO Annex 14 contains the information on the nominal characteristics of an airport. Applicants can use this information to characterize the airport environment for nominal performance assessment. The applicant must evaluate the system’s performance characteristics in the presence of significant approach terrain variations. At a minimum, the following profiles should be examined.
• Sloping runway - slopes of 0.8%
• Hilltop runway - 12.5% slope up to a point 200 ft. (60m) prior to the threshold
• Sea-wall - 6m (20 ft.) step up to threshold elevation at a point 60m prior to the threshold Note 1: In addition to the profiles described above, the FAA recommends examination of the known airport profiles with significant irregular approach terrain, at which operations are intended.
Note 2: Special operational evaluations are appropriate for certain airports having difficult pre-threshold terrain conditions. These evaluations consider each particular aircraft type, the particular flight control system, and may include consideration of particular system elements such as the type of radar altimeters installed or other equipment. Reference AC 120-118 for details on irregular approach terrain operational evaluations.
5.2.9.11 Approach and Automatic Landing with an Inoperative Engine.
When demonstrating engine-inoperative capabilities, the applicant must show the landing system performs a safe landing and, where applicable, safe rollout in this non-normal aircraft condition taking account the factors described in this chapter and the following:
5.2.9.11.1 Failure of the critical engine, and for propeller driven aircraft, where applicable, accounting for feathering of the propeller following failure of the critical engine.
5.2.9.11.2 Appropriate landing flap configurations .
5.2.9.11.3 Loss of any system associated with the inoperative engine,
e.g., electrical and hydraulic power .
5.2.9.11.4 Crosswinds in each direction of at least 10 knots .
5.2.9.11.5 Weight of aircraft .
5.2.9.12 Go Around.
Whether or not the applicant seeks engine out landing approval, the goaround from any point on the approach to touchdown must not require 5-10
AC 20-191 exceptional piloting skill, alertness, or strength. The applicant must ensure that sufficient information is available to determine that the aircraft can remain clear of obstacles.
5.2.9.13 Inoperative Engine Information.
The applicant should provide information for an operator to assure a successful go-around with an inoperative engine. The information may be in a form as requested by the operator, or as determined appropriate by the manufacturer. The information may or may not be provided to the operator as part of the AFM. Examples of acceptable information would include the following:
5.2.9.13.1 Information on height loss as a function of go -around initiation altitude . AC 25-7 provides one acceptable example
5.2.9.13.2 Performance information allowing the operator to determine that the operator can maintain safe obstacle clearance during a go-around with an engine failure
5.2.9.13.3 A method to assess and extend applicability of engine - inoperative takeoff performance obstacle clearance determinations for a balked landing or go -around event
5.2.10 Landing and Rollout System Integrity .
5.2.10.1 Landing System Integrity.
Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the applicant must evaluate the onboard components of the landing systems, considered separately, and in relation to other associated onboard systems.
In addition, the applicant must also include any specific safety related criteria identified in this chapter in the evaluation. The applicant can use the following criteria to show compliance with §§ 23.2500, 23.2510, 23.2605,
25.1309, 27.1309, or 29.1309 for the Landing Systems.
5.2.10.1.1 Probability of unsafe landing.
Any single malfunction or any combination of malfunctions of the landing system preventing a safe landing or go-around must be extremely improbable, unless it can be detected and annunciated, as a warning to allow pilot intervention to avoid catastrophic results and shown to be extremely remote.
5.2.10.1.2 Probability of Missed Detection.
Failure to detect and annunciate malfunctions preventing a safe landing or go-around must be extremely improbable.
5-11
AC 20-191
5.2.10.1.3 Exp osure Time.
The exposure time for assessing failure probabilities for fail passive landing systems is the average time required to descend from 100 feet HAT to touchdown. The exposure time for assessing failure probabilities for fail operational landing systems is the average time to descend from 200 feet HAT to touchdown. The applicant must address all latent faults that may exist prior to the start of the exposure time (at or before 100 ft HAT for fail passive and at or before 200 ft. HAT for fail operational).
5.2.10.1.4 Deviations Associated with Malfunction (Fail Passive).
For a fail passive automatic landing system, a single malfunction or any combination of malfunctions must not cause a significant deviation of the flight path or attitude following system disengagement. The aircraft must be safely trimmed when the system disengages to prevent these significant deviations.
5.2.10.1.5 Deviations Associated with Malfunction (Fail Operational).
A fail operational automatic landing system, following a single malfunction, must not lose the capability to perform lateral and vertical path tracking, alignment with runway heading (e.g., decrab), flare, and touchdown within the safe landing criteria listed in section 5.2.10.1.6.
5.2.10.1.6 Safe Landing Criteria.
For the purpose of analysis, a safe landing may be assumed when the following performance is achieved:
• Longitudinal touchdown no earlier than a point on the runway 200 ft. (60m) from the threshold,
• Longitudinal touchdown no further than 3000 ft. (1000m) from the threshold (not beyond the end of the touchdown zone lighting), and
• Lateral touchdown with the outboard landing gear within 70 ft. (21m) from runway centerline. (These values assume a 150 ft. (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.)
5.2.10.1.7 Environmental Conditions.
Malfunction cases may be considered under nominal environmental conditions.
5-12
AC 20-191
5.2.10.1.8 Tot al Autoland System Loss.
The applicant must demonstrate the PF can disconnect the autopilot at his/her discretion and maneuver the aircraft to a safe landing and rollout to a safe taxi speed, or perform a successful go-around to avoid catastrophic results.
5.2.10.2 Rollout System Integrity.
When engaged, the rollout system must provide automatic control, or guidance for manual control, to maintain the aircraft on the runway to a safe taxi speed on the runway.
5.2.10.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605 , 25.1309, 27.1309, or 29.1309, the applicant must design the onboard components of the rollout system, considering the components both separately, and in relation to other associated onboard systems. The applicant may use the following criteria for the application of §§ 23.2500, 23.2510, 23.2605, 25.1309,
27.1309, or 29.1309 to Rollout Systems:
5.2.10.2.2 A fail operational rollout system must meet the safe rollout performance provisions of this chapter, section 5.2.9.8 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any single malfunction, or after any combination of malfunctions not shown to be extremely remote. The applicant may consider malfunction cases under nominal environmental conditions.
5.2.10.2.3 For any rollout system, below 200 ft. HAT, the applicant must demonstrate unannunciated malfunctions preventing a safe rollout are extremely improbable.
5.2.10.2.4 For a fail passive rollout system, the loss of a fail passive automatic rollout function after touchdown must cause the automatic flight control system to disconnect. The loss of a fail passive rollout system after touchdown must be improbable.
Whenever a fail passive guidance system for manual rollout does not provide valid guidance, the system should provide a n alert consistent with the flight deck philosophy to each pilot.
5.2.10.2.5 The rollout system performance should not cause the aircraft wheels to exceed the lateral confines of the runway, from the point of touchdown to the point at which a safe taxi speed is reached, more often than once in ten million landings. This performance provision applies for malfunctions only affecting low speed directional control (speeds below effective rudder steering).
5-13
AC 20-191
• The applicant should demonstrate t he effect of any nosewheel steering malfunction can be handled by the rollout system or mitigated by pilot intervention using realistic simulated operational conditions.
• The applicant should include in the safety assessment the worst-case single failure conditions and failure combinations which are not extremely improbable. These conditions should include failures such as a jammed nose wheel steering or nose wheel castering. Where possible, the preferred method of demonstration is by flight test.
• The applicant’s evaluation of failure conditions should include consideration of nominal environmental conditions including visibility, crosswind, and runway surface conditions affecting braking (e.g., snow/ice, water saturated, wet with rubber contamination, etc.). The applicant must accomplish the evaluation of failure conditions with variations in environment unless the applicant can show that the combination of failure and environment is extremely improbable (See AC 25-7, Handling Qualities Rating Method).
• The applicant may use a simulator with a validated ground model to explore the full range of test conditions. These include the effect of simulated runway coefficients of friction, crosswinds, center of gravity, mass distribution (at various ground speeds), runway elevation, and visibility.
5.2.10.2.6 GLS signal anomalies could affect safe system performance in the flare and rollout p hases, so the applicant should describe and show how the GLS autoland and automatic rollout functions safely account for them.
5.2.11 Approach System Continuity Criteria .
The applicant should verify the continuity of navigation during normal aircraft maneuvering while in approach. For GLS, this includes verifying reception of VDB signal at all angles relative to the airframe as the GBAS facility could be located anywhere with respect to the approach path.
5.2.12 Landing and Rollout System Availability .
5.2.12.1 Landing System Availability.
On approach below 500 ft., the probability of a successful landing should be at least 95% for approach demonstrations conducted in the aircraft. This means no more than 5% of the approaches result in a go-around, due to the combination of failures in the landing system and the incidence of unsatisfactory performance. The applicant should meet this level of availability during flight test, with approximately 100 approaches.
5-14
AC 20-191
5.2.12.1.1 For an aircraft equipped with a fail passive landing system, the need to initiate a go-around on approach below 100 ft. HAT due to an aircraft system failure condition should be infrequent
(i.e., typically fewer than 1 per 1000 approaches).
5.2.12.1.2 For a fail operational sy stem, on approach below 200 ft. HAT, the probability of total loss of the landing system (even though appropriate annunciation of system loss is provided) must be extremely remote. The annunciation must enable the pilot to intervene in a timely manner to avoid a catastrophic result.
Total loss of the system without annunciation must be extremely improbable.
5.2.12.1.3 All single failures and combinations of failures not extremely improbable must be shown to permit completion of the landing and rollout to a safe taxi speed, or a successful go - around.
5.2.12.1.4 If a total loss of the autoland system occur s, the applicant must demonstrate the PF can disconnect the autopilot and maneuver the aircraft to a safe landing , and rollout to a safe taxi speed, or perform a successful go -around to avoid catastrophic results.
5.2.12.2 Rollout System Availability should meet the following criteria:
5.2.12.2.1 For a fail passive rollout system, from 200 ft. HAT through landing, and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%, considering loss or failure of the rollout system.
5.2.12.2.2 For a fail operational rollout s ystem, during the period in which the aircraft descends below 200 ft. HAT to a safe taxi speed, the probability of degradation from fail operational to fail passive should be infrequent (i.e., fewer than 1 degradation per 1000 approaches) . The probability of total loss of rollout capability should be extremely remote, considering loss or failure of the rollout system.
5.2.12.2.3 After touchdown, if a complete loss of the fail operational automatic rollout function occurs, or any other unsafe malfunction or condition, the automatic flight control system must disconnect. The loss of a fail operational rollout system after touchdown must be extremely remote.
5-15