AC 20-191
• The probability of longitudinal touchdown beyond a point on the r unway 3000 ft. (900 m) from the threshold must not exceed 10-5.
• The probability of lateral touchdown with the outboard landing gear more than 70 ft. (21 m) from the runway centerline must not exceed 10-5 (assuming a 150 ft runway width).
• The probability of sink rate at the structural limit load, must not exceed 10-5.
• The probability of bank angle where the wing tip touches the ground prior to the landing gear must not exceed 10-6.
• The probability of lateral velocity (or sideslip angle) at the structural limit load must not exceed 10-5.
Note: For HUD landing systems, where total wind strength has been shown to be the most critical parameter affecting performance, an alternative means of compliance may be used.
5.2.9.6.1 Evaluation of landing probability.
The applicant cannot take credit for the probability of faults when evaluating the required landing probabilities. However, the applicant may take credit for the ground subsystem’s probability of detection for satellite faults and the aircraft’s probability of detection for single reference receiver faults. The GLS errors may be considered bias-like for the duration of an approach and landing as this is the worst-case scenario.
5.2.9.6.2 Non-GLS variable.
When assessing the GLS performance, the applicant must account for other non-GLS variables affecting performance.
These non-GLS variables must vary according to their expected distributions.
Note 1: The criteria ensures that undetected faults in conjunction with nominal conditions in the non-aircraft GBAS system, when combined with all other variables affecting landing performance, do not result in an unacceptably high probability of landing outside the limits that define a safe landing. See section 5.2.10.1.6 for the conditions that define a safe landing. These faults include only satellite faults and single ground reference receiver faults.
Note 2: Appendix C - GLS Signal Model section C.1.9 provides an example demonstration method for the performance specified in this section. The appendix also contains a list of references used to derive the signal model. These references describe undetected non-aircraft system error conditions, nominal performance, and faults as well as the ICAO standardized ground system monitoring requirements. The aircraft 5-6
AC 20-191 performance provisions in this section are intended to address non-airc raft system errors that are below the ground monitoring thresholds. Such errors are not considered a malfunction of the non-aircraft system.
Note 3: It is assumed that operations will be approved with knowledge of the runway specific glide path and TCH values and the aircraft’s capability. Therefore, it is not necessary to set the glide path or TCH or both values to the limits allowed for the aircraft.
5.2.9.7 Compatibility with Worst Case Undetected Guidance Errors.
5.2.9.7.1 Undetected errors that are not extremely improbable must be shown to not prevent a safe landing or go -around or both when all other variables affecting performance are at their nominal values. The definition of a safe landing is specified in section
5.2.10.1.6. The definition of a safe approach is an approach that does not penetrate the Obstacle Limitation Surfaces for Precision Approach Category II or III as defined by ICAO SARPs Annex 14 section 4.2.15 & Table 4 -1.
5.2.9.7.2 The applicant must assess the effect of worst-case undetected errors on landing system performance via simulation using the GLS Noise Model provided in 5.5.8 Appendix C (or an approved equivalent model). The worst case undetected errors must be simulated by using the maximum range domain error given in Table C-5 and Table C-7 of Appendix C in conjunction with the appropriate geometry screening factors used by the aircraft. The certification plan should specify how the demonstration will be conducted, including the number of cases and variables with pass/fail criteria. The aircraft performance must be assessed in the presence of the full range of bias and ramp type failures produced by the Fault Mode Generator described in Appendix C. This demonstration must include the irregular terrain profile as defined in section
5.2.9.10.
Note: Rare ionosphere events and undetected satellite or ground station failures could result in significant vertical (and lateral) position errors. Under certain conditions, such errors may go undetected by the system and could result in erroneous guidance if unmitigated. The effect of such errors may not be observable by the flight crew.
5.2.9.8 Rollout System Performance.
The rollout system, if included, must control the aircraft, in the case of an automatic flight control system, or provide command information as guidance to the pilot, for manual control, from the point of landing to a safe 5-7
AC 20-191 taxi speed. Th e loss of rudder effectiveness, as the aircraft speed is reduced, could be a factor in the level of approval which is granted to a system. The applicant should describe the system concept for rollout control so that the absence of low-speed control, such as a nose wheel steering system, can be assessed.
5.2.9.8.1 The automatic flight control system should provide de -rotation for airplanes, consistent with a pilot’s manual technique.
Systems which provide rollout guidance for manually controlled rollout are not required to provide de -rotation.
Systems which provide de -rotation, automatically or with guidance for manual control, must avoid any objectionable oscillatory motion or nose wheel touchdowns, pitch up, or other adverse behavior as a result of ground spoiler deployment or reverse thrust operation .
5.2.9.8.2 Automatic control during the landing and rollout should not result in any aircraft maneuvers which would cause the flight crew to intervene unnecessarily.
5.2.9.8.3 Landing and rollout guidance should be consistent with a pilot’s manual technique, and not require excessive skill or flight crew workload to accomplish the operation.
5.2.9.8.4 Safe taxi speed is the speed at which the pilot can safely leave the runway or bring the aircraft to a safe stop. The safe taxi speed may vary with visibility conditions, aircraft characteristics, and means of lateral control. The performance criteria in this section assume a 150 ft. (45.7m) runway width.
The rollout performance limit may be appropriately increased if operation is restricted to wider runways .
5.2.9.8.5 Rollout systems typically reference the runway centerline via ILS localizer or another approved approach navigation system.
The intended path for the rollout system is to keep the aircraft on the runway, and usually on the runway centerline.
5.2.9.8.6 The applicant should demonstrate that the rollout system:
• Does not cause the outboard tire(s) to deviate from the runway centerline by more than 70 ft. (21.3m), starting from the point at which touchdown occurs and continuing to a point at which a safe taxi speed is reached, to a probability of 1 x 10-6.
Note 1: These values assume a 150 ft (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.
5-8
AC 20-191 Note 2: 70 ft. (21.3m) deviation from centerline is equiva lent to outboard tire(s) at 5 ft. (1.5m) within the edge of a 150 ft. (45.7m) wide runway.
• Captures the intended path or converges on the intended path (e.g., localizer centerline) in a smooth, timely, and predictable manner. While a critically damped response is desired, minor overshoots are acceptable. Sustained or divergent oscillations or unnecessarily aggressive responses are unsatisfactory.
• Promptly corrects any lateral movement away from the runway centerline in a positive manner.
• Following touchdown, if not already on a converging path, causes the aircraft to initially turn and track a path to intercept the runway centerline at a point far enough in front of the aircraft obvious to the flight crew that the rollout system is performing properly. Also, the rollout system should intercept the centerline sufficiently before the stop end of the runway, and before the point at which taxi speed is reached.
5.2.9.9 Variables Affecting Performance.
The performance assessment must take into account at least the following variables with the variables being applied based upon their expected distribution:
• Configurations of the aircraft (e.g., flap/slat settings)
• Center of gravity
• Landing gross weight
• Conditions of headwind, tailwind, crosswind, turbulence and wind shear (see Appendix B for acceptable wind models)
• Approach airspeed and variations in approach airspeed
• Airport conditions (elevation, runway slope, runway condition)
• Individual pilot performance, for systems with manual control
• Any other parameter which may affect system performance
• Characteristics of applicable navigation aids, including variations in flight path definitions (ILS or GLS, aircraft and space elements, etc.)
Note: 5.5.8 Appendix C provides one acceptable model for the assumed characteristics of GLS guidance errors. Applicants using an alternate model are responsible for documenting the alternate model, its basis (including a mapping to ICAO Annex 10 characteristics and any additional assumptions made), and its validity.
5-9
AC 20-191
5.2.9.10 Irregu lar Approach Terrain.
Approach terrain may affect the performance and pilot acceptance of the Approach and Landing system. ICAO Annex 14 contains the information on the nominal characteristics of an airport. Applicants can use this information to characterize the airport environment for nominal performance assessment. The applicant must evaluate the system’s performance characteristics in the presence of significant approach terrain variations. At a minimum, the following profiles should be examined.
• Sloping runway - slopes of 0.8%
• Hilltop runway - 12.5% slope up to a point 200 ft. (60m) prior to the threshold
• Sea-wall - 6m (20 ft.) step up to threshold elevation at a point 60m prior to the threshold Note 1: In addition to the profiles described above, the FAA recommends examination of the known airport profiles with significant irregular approach terrain, at which operations are intended.
Note 2: Special operational evaluations are appropriate for certain airports having difficult pre-threshold terrain conditions. These evaluations consider each particular aircraft type, the particular flight control system, and may include consideration of particular system elements such as the type of radar altimeters installed or other equipment. Reference AC 120-118 for details on irregular approach terrain operational evaluations.
5.2.9.11 Approach and Automatic Landing with an Inoperative Engine.
When demonstrating engine-inoperative capabilities, the applicant must show the landing system performs a safe landing and, where applicable, safe rollout in this non-normal aircraft condition taking account the factors described in this chapter and the following:
5.2.9.11.1 Failure of the critical engine, and for propeller driven aircraft, where applicable, accounting for feathering of the propeller following failure of the critical engine.
5.2.9.11.2 Appropriate landing flap configurations .
5.2.9.11.3 Loss of any system associated with the inoperative engine,
e.g., electrical and hydraulic power .
5.2.9.11.4 Crosswinds in each direction of at least 10 knots .
5.2.9.11.5 Weight of aircraft .
5.2.9.12 Go Around.
Whether or not the applicant seeks engine out landing approval, the goaround from any point on the approach to touchdown must not require 5-10
AC 20-191 exceptional piloting skill, alertness, or strength. The applicant must ensure that sufficient information is available to determine that the aircraft can remain clear of obstacles.
5.2.9.13 Inoperative Engine Information.
The applicant should provide information for an operator to assure a successful go-around with an inoperative engine. The information may be in a form as requested by the operator, or as determined appropriate by the manufacturer. The information may or may not be provided to the operator as part of the AFM. Examples of acceptable information would include the following:
5.2.9.13.1 Information on height loss as a function of go -around initiation altitude . AC 25-7 provides one acceptable example
5.2.9.13.2 Performance information allowing the operator to determine that the operator can maintain safe obstacle clearance during a go-around with an engine failure
5.2.9.13.3 A method to assess and extend applicability of engine - inoperative takeoff performance obstacle clearance determinations for a balked landing or go -around event
5.2.10 Landing and Rollout System Integrity .
5.2.10.1 Landing System Integrity.
Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the applicant must evaluate the onboard components of the landing systems, considered separately, and in relation to other associated onboard systems.
In addition, the applicant must also include any specific safety related criteria identified in this chapter in the evaluation. The applicant can use the following criteria to show compliance with §§ 23.2500, 23.2510, 23.2605,
25.1309, 27.1309, or 29.1309 for the Landing Systems.
5.2.10.1.1 Probability of unsafe landing.
Any single malfunction or any combination of malfunctions of the landing system preventing a safe landing or go-around must be extremely improbable, unless it can be detected and annunciated, as a warning to allow pilot intervention to avoid catastrophic results and shown to be extremely remote.
5.2.10.1.2 Probability of Missed Detection.
Failure to detect and annunciate malfunctions preventing a safe landing or go-around must be extremely improbable.
5-11
AC 20-191
5.2.10.1.3 Exp osure Time.
The exposure time for assessing failure probabilities for fail passive landing systems is the average time required to descend from 100 feet HAT to touchdown. The exposure time for assessing failure probabilities for fail operational landing systems is the average time to descend from 200 feet HAT to touchdown. The applicant must address all latent faults that may exist prior to the start of the exposure time (at or before 100 ft HAT for fail passive and at or before 200 ft. HAT for fail operational).
5.2.10.1.4 Deviations Associated with Malfunction (Fail Passive).
For a fail passive automatic landing system, a single malfunction or any combination of malfunctions must not cause a significant deviation of the flight path or attitude following system disengagement. The aircraft must be safely trimmed when the system disengages to prevent these significant deviations.
5.2.10.1.5 Deviations Associated with Malfunction (Fail Operational).
A fail operational automatic landing system, following a single malfunction, must not lose the capability to perform lateral and vertical path tracking, alignment with runway heading (e.g., decrab), flare, and touchdown within the safe landing criteria listed in section 5.2.10.1.6.
5.2.10.1.6 Safe Landing Criteria.
For the purpose of analysis, a safe landing may be assumed when the following performance is achieved:
• Longitudinal touchdown no earlier than a point on the runway 200 ft. (60m) from the threshold,
• Longitudinal touchdown no further than 3000 ft. (1000m) from the threshold (not beyond the end of the touchdown zone lighting), and
• Lateral touchdown with the outboard landing gear within 70 ft. (21m) from runway centerline. (These values assume a 150 ft. (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.)
5.2.10.1.7 Environmental Conditions.
Malfunction cases may be considered under nominal environmental conditions.
5-12
AC 20-191
5.2.10.1.8 Tot al Autoland System Loss.
The applicant must demonstrate the PF can disconnect the autopilot at his/her discretion and maneuver the aircraft to a safe landing and rollout to a safe taxi speed, or perform a successful go-around to avoid catastrophic results.
5.2.10.2 Rollout System Integrity.
When engaged, the rollout system must provide automatic control, or guidance for manual control, to maintain the aircraft on the runway to a safe taxi speed on the runway.
5.2.10.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605 , 25.1309, 27.1309, or 29.1309, the applicant must design the onboard components of the rollout system, considering the components both separately, and in relation to other associated onboard systems. The applicant may use the following criteria for the application of §§ 23.2500, 23.2510, 23.2605, 25.1309,
27.1309, or 29.1309 to Rollout Systems:
5.2.10.2.2 A fail operational rollout system must meet the safe rollout performance provisions of this chapter, section 5.2.9.8 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any single malfunction, or after any combination of malfunctions not shown to be extremely remote. The applicant may consider malfunction cases under nominal environmental conditions.
5.2.10.2.3 For any rollout system, below 200 ft. HAT, the applicant must demonstrate unannunciated malfunctions preventing a safe rollout are extremely improbable.
5.2.10.2.4 For a fail passive rollout system, the loss of a fail passive automatic rollout function after touchdown must cause the automatic flight control system to disconnect. The loss of a fail passive rollout system after touchdown must be improbable.
Whenever a fail passive guidance system for manual rollout does not provide valid guidance, the system should provide a n alert consistent with the flight deck philosophy to each pilot.
5.2.10.2.5 The rollout system performance should not cause the aircraft wheels to exceed the lateral confines of the runway, from the point of touchdown to the point at which a safe taxi speed is reached, more often than once in ten million landings. This performance provision applies for malfunctions only affecting low speed directional control (speeds below effective rudder steering).
5-13
AC 20-191
• The applicant should demonstrate t he effect of any nosewheel steering malfunction can be handled by the rollout system or mitigated by pilot intervention using realistic simulated operational conditions.
• The applicant should include in the safety assessment the worst-case single failure conditions and failure combinations which are not extremely improbable. These conditions should include failures such as a jammed nose wheel steering or nose wheel castering. Where possible, the preferred method of demonstration is by flight test.
• The applicant’s evaluation of failure conditions should include consideration of nominal environmental conditions including visibility, crosswind, and runway surface conditions affecting braking (e.g., snow/ice, water saturated, wet with rubber contamination, etc.). The applicant must accomplish the evaluation of failure conditions with variations in environment unless the applicant can show that the combination of failure and environment is extremely improbable (See AC 25-7, Handling Qualities Rating Method).
• The applicant may use a simulator with a validated ground model to explore the full range of test conditions. These include the effect of simulated runway coefficients of friction, crosswinds, center of gravity, mass distribution (at various ground speeds), runway elevation, and visibility.
5.2.10.2.6 GLS signal anomalies could affect safe system performance in the flare and rollout p hases, so the applicant should describe and show how the GLS autoland and automatic rollout functions safely account for them.
5.2.11 Approach System Continuity Criteria .
The applicant should verify the continuity of navigation during normal aircraft maneuvering while in approach. For GLS, this includes verifying reception of VDB signal at all angles relative to the airframe as the GBAS facility could be located anywhere with respect to the approach path.
5.2.12 Landing and Rollout System Availability .
5.2.12.1 Landing System Availability.
On approach below 500 ft., the probability of a successful landing should be at least 95% for approach demonstrations conducted in the aircraft. This means no more than 5% of the approaches result in a go-around, due to the combination of failures in the landing system and the incidence of unsatisfactory performance. The applicant should meet this level of availability during flight test, with approximately 100 approaches.
5-14
AC 20-191
5.2.12.1.1 For an aircraft equipped with a fail passive landing system, the need to initiate a go-around on approach below 100 ft. HAT due to an aircraft system failure condition should be infrequent
(i.e., typically fewer than 1 per 1000 approaches).
5.2.12.1.2 For a fail operational sy stem, on approach below 200 ft. HAT, the probability of total loss of the landing system (even though appropriate annunciation of system loss is provided) must be extremely remote. The annunciation must enable the pilot to intervene in a timely manner to avoid a catastrophic result.
Total loss of the system without annunciation must be extremely improbable.
5.2.12.1.3 All single failures and combinations of failures not extremely improbable must be shown to permit completion of the landing and rollout to a safe taxi speed, or a successful go - around.
5.2.12.1.4 If a total loss of the autoland system occur s, the applicant must demonstrate the PF can disconnect the autopilot and maneuver the aircraft to a safe landing , and rollout to a safe taxi speed, or perform a successful go -around to avoid catastrophic results.
5.2.12.2 Rollout System Availability should meet the following criteria:
5.2.12.2.1 For a fail passive rollout system, from 200 ft. HAT through landing, and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%, considering loss or failure of the rollout system.
5.2.12.2.2 For a fail operational rollout s ystem, during the period in which the aircraft descends below 200 ft. HAT to a safe taxi speed, the probability of degradation from fail operational to fail passive should be infrequent (i.e., fewer than 1 degradation per 1000 approaches) . The probability of total loss of rollout capability should be extremely remote, considering loss or failure of the rollout system.
5.2.12.2.3 After touchdown, if a complete loss of the fail operational automatic rollout function occurs, or any other unsafe malfunction or condition, the automatic flight control system must disconnect. The loss of a fail operational rollout system after touchdown must be extremely remote.
5-15
AC 20-191
5.2.13 Go-Ar ound.
The aircraft must be capable of safely executing a go-around from any point on the approach to touchdown in all configurations. The maneuver may not require exceptional piloting skill, alertness, or strength.
5.2.13.1 A go-around from a low altitude may result in an inadvertent runway contact, therefore the applicant should establish the safety of the procedure giving consideration to at least the following:
5.2.13.1.1 The automatic control and guidance produced by the goaround mode, when such a mode is provided, should be retained and be shown to have safe and acceptable characteristics throughout the go -around maneuver.
5.2.13.1.2 Inadvertent selection of go -around mode after touchdown should have no adverse effect on the ability of the aircraft to safely roll out and stop.
5.2.13.2 The applicant should assess height loss to assure expeditious go-around from a range of altitudes during the approach and flare when under automatic control and when using the landing guidance system, as appropriate, and as follows:
5.2.13.2.1 Height loss may be assessed by flight testing (typically 10 goarounds) supported by simulation.
5.2.13.2.2 The simulation should evaluate the effects of variation in parameters such as weight, center of gravity, configuration , and wind. The simulation results should correlate with the flight test results.
5.2.13.2.3 Normal procedures for a go -around for the applicable configuration should be followed. If engine-inoperative capability is sought, and use of the go -around mode is applicable to those operations, an assessment of the engine - inoperative go- around is necessary.
5.2.14 Information, Annunciation, and Alerting.
5.2.14.1 Compliance.
The design of the Information, Annunciation, and Alerting must comply with §§ 23.2605, 25.1322, 27.1322, or 29.1322. Reference AC 23.1311-1, AC 25.1322, AC 27-1, or AC 29-2 for additional guidance.
5.2.14.2 Airworthiness Criteria for Basic Situation and Command Information.
5.2.14.2.1 The controls, indicators , and warnings must be designed to minimize flight crew errors that could create a hazard. Mode 5-16
AC 20-191 and system malfunction indications must be presented in a ma nner compatible with the procedures and assigned tasks of the flight crew. The indications must be grouped in a logical and consistent manner and be visible under all expected normal lighting conditions .
5.2.14.2.2 For manual control of approach, landing, and rollout flight path, the primary flight display(s), whether head down or head up, must provide sufficient information to enable a suitably trained pilot to:
• Maintain the approach path,
• Make the alignment with the runway, flare, and land the aircraft within the prescribed limits, and
• Go-around without excessive reference to other cockpit displays.
5.2.14.2.3 The information provided above along with any additional information necessary to the design of the system must be sufficient to allow the flightcrew to monitor the progress and safety of the landing and rollout operation.
5.2.14.2.4 Required in flight performance monitoring capability includes at least the following :
• Unambiguous identification of the intended path for the approach, landing, and rollout, (e.g., ILS /GLS approach identifier/frequency, and selected navigation source); and
• Indication of the position of the aircraft with respect to the intended path (e.g., situation information localizer and glide path, or equivalent).
5.2.14.3 Annunciation.
The system must provide a positive, continuous, and unambiguous indication for the modes actually in operation, as well as those that are armed for engagement. In addition, where mode engagement is automatic
(e.g., localizer and glide path acquisition), the system must provide a clear indication when the mode has been armed by either action of a member of the flight crew, or automatically by the system (e.g., a pre-land test – LAND 3).
5.2.14.4 Alerting.
Alerts are intended to address the need for warning, caution, and advisory information for the flight crew.
5-17