AC 20-191 exceptional piloting skill, alertness, or strength. The applicant must ensure that sufficient information is available to determine that the aircraft can remain clear of obstacles.
5.2.9.13 Inoperative Engine Information.
The applicant should provide information for an operator to assure a successful go-around with an inoperative engine. The information may be in a form as requested by the operator, or as determined appropriate by the manufacturer. The information may or may not be provided to the operator as part of the AFM. Examples of acceptable information would include the following:
5.2.9.13.1 Information on height loss as a function of go -around initiation altitude . AC 25-7 provides one acceptable example
5.2.9.13.2 Performance information allowing the operator to determine that the operator can maintain safe obstacle clearance during a go-around with an engine failure
5.2.9.13.3 A method to assess and extend applicability of engine - inoperative takeoff performance obstacle clearance determinations for a balked landing or go -around event
5.2.10 Landing and Rollout System Integrity .
5.2.10.1 Landing System Integrity.
Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the applicant must evaluate the onboard components of the landing systems, considered separately, and in relation to other associated onboard systems.
In addition, the applicant must also include any specific safety related criteria identified in this chapter in the evaluation. The applicant can use the following criteria to show compliance with §§ 23.2500, 23.2510, 23.2605,
25.1309, 27.1309, or 29.1309 for the Landing Systems.
5.2.10.1.1 Probability of unsafe landing.
Any single malfunction or any combination of malfunctions of the landing system preventing a safe landing or go-around must be extremely improbable, unless it can be detected and annunciated, as a warning to allow pilot intervention to avoid catastrophic results and shown to be extremely remote.
5.2.10.1.2 Probability of Missed Detection.
Failure to detect and annunciate malfunctions preventing a safe landing or go-around must be extremely improbable.
5-11
AC 20-191
5.2.10.1.3 Exp osure Time.
The exposure time for assessing failure probabilities for fail passive landing systems is the average time required to descend from 100 feet HAT to touchdown. The exposure time for assessing failure probabilities for fail operational landing systems is the average time to descend from 200 feet HAT to touchdown. The applicant must address all latent faults that may exist prior to the start of the exposure time (at or before 100 ft HAT for fail passive and at or before 200 ft. HAT for fail operational).
5.2.10.1.4 Deviations Associated with Malfunction (Fail Passive).
For a fail passive automatic landing system, a single malfunction or any combination of malfunctions must not cause a significant deviation of the flight path or attitude following system disengagement. The aircraft must be safely trimmed when the system disengages to prevent these significant deviations.
5.2.10.1.5 Deviations Associated with Malfunction (Fail Operational).
A fail operational automatic landing system, following a single malfunction, must not lose the capability to perform lateral and vertical path tracking, alignment with runway heading (e.g., decrab), flare, and touchdown within the safe landing criteria listed in section 5.2.10.1.6.
5.2.10.1.6 Safe Landing Criteria.
For the purpose of analysis, a safe landing may be assumed when the following performance is achieved:
• Longitudinal touchdown no earlier than a point on the runway 200 ft. (60m) from the threshold,
• Longitudinal touchdown no further than 3000 ft. (1000m) from the threshold (not beyond the end of the touchdown zone lighting), and
• Lateral touchdown with the outboard landing gear within 70 ft. (21m) from runway centerline. (These values assume a 150 ft. (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.)
5.2.10.1.7 Environmental Conditions.
Malfunction cases may be considered under nominal environmental conditions.
5-12
AC 20-191
5.2.10.1.8 Tot al Autoland System Loss.
The applicant must demonstrate the PF can disconnect the autopilot at his/her discretion and maneuver the aircraft to a safe landing and rollout to a safe taxi speed, or perform a successful go-around to avoid catastrophic results.
5.2.10.2 Rollout System Integrity.
When engaged, the rollout system must provide automatic control, or guidance for manual control, to maintain the aircraft on the runway to a safe taxi speed on the runway.
5.2.10.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605 , 25.1309, 27.1309, or 29.1309, the applicant must design the onboard components of the rollout system, considering the components both separately, and in relation to other associated onboard systems. The applicant may use the following criteria for the application of §§ 23.2500, 23.2510, 23.2605, 25.1309,
27.1309, or 29.1309 to Rollout Systems:
5.2.10.2.2 A fail operational rollout system must meet the safe rollout performance provisions of this chapter, section 5.2.9.8 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any single malfunction, or after any combination of malfunctions not shown to be extremely remote. The applicant may consider malfunction cases under nominal environmental conditions.
5.2.10.2.3 For any rollout system, below 200 ft. HAT, the applicant must demonstrate unannunciated malfunctions preventing a safe rollout are extremely improbable.
5.2.10.2.4 For a fail passive rollout system, the loss of a fail passive automatic rollout function after touchdown must cause the automatic flight control system to disconnect. The loss of a fail passive rollout system after touchdown must be improbable.
Whenever a fail passive guidance system for manual rollout does not provide valid guidance, the system should provide a n alert consistent with the flight deck philosophy to each pilot.
5.2.10.2.5 The rollout system performance should not cause the aircraft wheels to exceed the lateral confines of the runway, from the point of touchdown to the point at which a safe taxi speed is reached, more often than once in ten million landings. This performance provision applies for malfunctions only affecting low speed directional control (speeds below effective rudder steering).
5-13
AC 20-191
• The applicant should demonstrate t he effect of any nosewheel steering malfunction can be handled by the rollout system or mitigated by pilot intervention using realistic simulated operational conditions.
• The applicant should include in the safety assessment the worst-case single failure conditions and failure combinations which are not extremely improbable. These conditions should include failures such as a jammed nose wheel steering or nose wheel castering. Where possible, the preferred method of demonstration is by flight test.
• The applicant’s evaluation of failure conditions should include consideration of nominal environmental conditions including visibility, crosswind, and runway surface conditions affecting braking (e.g., snow/ice, water saturated, wet with rubber contamination, etc.). The applicant must accomplish the evaluation of failure conditions with variations in environment unless the applicant can show that the combination of failure and environment is extremely improbable (See AC 25-7, Handling Qualities Rating Method).
• The applicant may use a simulator with a validated ground model to explore the full range of test conditions. These include the effect of simulated runway coefficients of friction, crosswinds, center of gravity, mass distribution (at various ground speeds), runway elevation, and visibility.
5.2.10.2.6 GLS signal anomalies could affect safe system performance in the flare and rollout p hases, so the applicant should describe and show how the GLS autoland and automatic rollout functions safely account for them.
5.2.11 Approach System Continuity Criteria .
The applicant should verify the continuity of navigation during normal aircraft maneuvering while in approach. For GLS, this includes verifying reception of VDB signal at all angles relative to the airframe as the GBAS facility could be located anywhere with respect to the approach path.
5.2.12 Landing and Rollout System Availability .
5.2.12.1 Landing System Availability.
On approach below 500 ft., the probability of a successful landing should be at least 95% for approach demonstrations conducted in the aircraft. This means no more than 5% of the approaches result in a go-around, due to the combination of failures in the landing system and the incidence of unsatisfactory performance. The applicant should meet this level of availability during flight test, with approximately 100 approaches.
5-14
AC 20-191
5.2.12.1.1 For an aircraft equipped with a fail passive landing system, the need to initiate a go-around on approach below 100 ft. HAT due to an aircraft system failure condition should be infrequent
(i.e., typically fewer than 1 per 1000 approaches).
5.2.12.1.2 For a fail operational sy stem, on approach below 200 ft. HAT, the probability of total loss of the landing system (even though appropriate annunciation of system loss is provided) must be extremely remote. The annunciation must enable the pilot to intervene in a timely manner to avoid a catastrophic result.
Total loss of the system without annunciation must be extremely improbable.
5.2.12.1.3 All single failures and combinations of failures not extremely improbable must be shown to permit completion of the landing and rollout to a safe taxi speed, or a successful go - around.
5.2.12.1.4 If a total loss of the autoland system occur s, the applicant must demonstrate the PF can disconnect the autopilot and maneuver the aircraft to a safe landing , and rollout to a safe taxi speed, or perform a successful go -around to avoid catastrophic results.
5.2.12.2 Rollout System Availability should meet the following criteria:
5.2.12.2.1 For a fail passive rollout system, from 200 ft. HAT through landing, and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%, considering loss or failure of the rollout system.
5.2.12.2.2 For a fail operational rollout s ystem, during the period in which the aircraft descends below 200 ft. HAT to a safe taxi speed, the probability of degradation from fail operational to fail passive should be infrequent (i.e., fewer than 1 degradation per 1000 approaches) . The probability of total loss of rollout capability should be extremely remote, considering loss or failure of the rollout system.
5.2.12.2.3 After touchdown, if a complete loss of the fail operational automatic rollout function occurs, or any other unsafe malfunction or condition, the automatic flight control system must disconnect. The loss of a fail operational rollout system after touchdown must be extremely remote.
5-15
AC 20-191
5.2.13 Go-Ar ound.
The aircraft must be capable of safely executing a go-around from any point on the approach to touchdown in all configurations. The maneuver may not require exceptional piloting skill, alertness, or strength.
5.2.13.1 A go-around from a low altitude may result in an inadvertent runway contact, therefore the applicant should establish the safety of the procedure giving consideration to at least the following:
5.2.13.1.1 The automatic control and guidance produced by the goaround mode, when such a mode is provided, should be retained and be shown to have safe and acceptable characteristics throughout the go -around maneuver.
5.2.13.1.2 Inadvertent selection of go -around mode after touchdown should have no adverse effect on the ability of the aircraft to safely roll out and stop.
5.2.13.2 The applicant should assess height loss to assure expeditious go-around from a range of altitudes during the approach and flare when under automatic control and when using the landing guidance system, as appropriate, and as follows:
5.2.13.2.1 Height loss may be assessed by flight testing (typically 10 goarounds) supported by simulation.
5.2.13.2.2 The simulation should evaluate the effects of variation in parameters such as weight, center of gravity, configuration , and wind. The simulation results should correlate with the flight test results.
5.2.13.2.3 Normal procedures for a go -around for the applicable configuration should be followed. If engine-inoperative capability is sought, and use of the go -around mode is applicable to those operations, an assessment of the engine - inoperative go- around is necessary.
5.2.14 Information, Annunciation, and Alerting.
5.2.14.1 Compliance.
The design of the Information, Annunciation, and Alerting must comply with §§ 23.2605, 25.1322, 27.1322, or 29.1322. Reference AC 23.1311-1, AC 25.1322, AC 27-1, or AC 29-2 for additional guidance.
5.2.14.2 Airworthiness Criteria for Basic Situation and Command Information.
5.2.14.2.1 The controls, indicators , and warnings must be designed to minimize flight crew errors that could create a hazard. Mode 5-16
AC 20-191 and system malfunction indications must be presented in a ma nner compatible with the procedures and assigned tasks of the flight crew. The indications must be grouped in a logical and consistent manner and be visible under all expected normal lighting conditions .
5.2.14.2.2 For manual control of approach, landing, and rollout flight path, the primary flight display(s), whether head down or head up, must provide sufficient information to enable a suitably trained pilot to:
• Maintain the approach path,
• Make the alignment with the runway, flare, and land the aircraft within the prescribed limits, and
• Go-around without excessive reference to other cockpit displays.
5.2.14.2.3 The information provided above along with any additional information necessary to the design of the system must be sufficient to allow the flightcrew to monitor the progress and safety of the landing and rollout operation.
5.2.14.2.4 Required in flight performance monitoring capability includes at least the following :
• Unambiguous identification of the intended path for the approach, landing, and rollout, (e.g., ILS /GLS approach identifier/frequency, and selected navigation source); and
• Indication of the position of the aircraft with respect to the intended path (e.g., situation information localizer and glide path, or equivalent).
5.2.14.3 Annunciation.
The system must provide a positive, continuous, and unambiguous indication for the modes actually in operation, as well as those that are armed for engagement. In addition, where mode engagement is automatic
(e.g., localizer and glide path acquisition), the system must provide a clear indication when the mode has been armed by either action of a member of the flight crew, or automatically by the system (e.g., a pre-land test – LAND 3).
5.2.14.4 Alerting.
Alerts are intended to address the need for warning, caution, and advisory information for the flight crew.
5-17
AC 20-191
5.2.14.4.1 Wa rnings.
The system must provide a warning indication for all conditions requiring the flight crew to take immediate corrective action.
The design should account for flight crew alerting cues, corrective action required, and the capability of detecting faults.
• Warnings must be given without delay, be distinct from all other cockpit warnings and provide unmistakable indication of the need for the flight crew to take immediate corrective action. Aural warnings must be audible to each pilot under typically assumed worst-case ambient noise conditions, but not so loud and intrusive as to interfere with the flight crew taking the required corrective action or readily accomplishing flight crew coordination. Visual warnings, such as lights or alphanumeric messages, must be distinct and conspicuously located in the primary field of view for each pilot.
• After beginning final approach (e.g., typically prior to reaching 1000' HAT), the system should annunciate the loss of a fail passive or fail operational system. Whenever a fail passive system, for manual control, does not provide valid guidance, the system must provide a warning indication to each pilot and remove the guidance. The removal of guidance alone is not adequate annunciation. The annunciation must be located to ensure rapid recognition, and must not distract the PF or significantly degrade the forward view.
5.2.14.4.2 Cautions.
The system must provide a caution for any condition requiring immediate flight crew awareness and timely subsequent action.
The system must provide a means to advise the flight crew of failed aircraft system elements that affect the decision to continue or discontinue the approach.
• After initiation of final approach, (which typically occurs at or above 1000' HAT) a fail passive landing system, or landing and rollout system, must alert the flight crew to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
• After initiation of final approach, a fail passive command guidance system (e.g., HUD guidance), must provide a clear, distinct, and unmistakable indication to alert each pilot to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
5-18
AC 20-191
• After initiation of final approach, but above the airworthiness demonstrated AH, a fail operational landing system or landing and rollout system (with either fail operational or fail passive rollout) must alert the flight crew to:
o Any malfunction or condition adversely affecting the ability of the system to safely operate or continue the approach or landing, and o Any malfunction degrading the landing system from a fail operational to a fail passive landing system.
• Below the airworthiness demonstrated AH and throughout rollout, a fail operational landing system must inhibit alerts for malfunctions degrading landing system capability from fail operational to fail passive status.
• Excessive-Deviation alerting. The FAA does not require excessive-deviation alerting, but will approve systems meeting appropriate criteria (e.g., EASA CS- AWO.B.CATII.115).
• For systems that meet EASA criteria, compliance with the following criteria, from CS-AWO.B.CATII.115, is an acceptable means of compliance, but is not a required means of compliance. For systems meeting the CS- AWO.B.CATII.115 criteria, excess-deviation alerts should:
o Operate when the deviation from the ILS or GLS glide path or localizer centerline exceeds a value from which a safe landing can be made from offset positions equivalent to the excess-deviation alert, without exceptional piloting skill and with the visual references assumed to be available in these conditions.
o Be set to operate with a delay of not more than one
(1) second from the time that the deviation thresholds are exceeded.
o Be active at least from 300 ft. (90m) HAT to 50 ft.
HAT, but the glide path deviation alert may be discontinued below 100 ft. (30m) HAT.
5.2.14.4.3 Advisories.
The system must provide a means to inform the flight crew when the aircraft has reached the AH or DH, as applicable.
5-19
AC 20-191
5.2.14.4.4 Sy stem Status.
The system should provide a means for the operator and flight crew to determine both prior to and after departure, the capability of the aircraft elements to accomplish the intended low visibility operations. While en route, the system should indicate to the flight crew as an advisory the failure of each aircraft component adversely affecting the capability to conduct the intended landing operation.
• The system should provide a means to advise the flight crew of failed aircraft system elements relating to landing system capability which otherwise could adversely affect a flight crew’s decision to use particular landing minima (e.g., adversely affect a decision to continue to a destination or divert to an alternate).
• If multiple landing system capability is installed (e.g., MMR), then during approach the system should provide an indication to the flight crew of a failure in each non-selected aircraft landing system element (e.g., a GLS receiver failure during conduct of an ILS approach) as an indication of system status. Such failures or non-availability, however, should not produce a caution or warning if they are not relevant to the system in use.
• The system should identify system status indications by names that are different than operational authorization categories (e.g., annunciations such as "LAND 3," or "DUAL" may be used). The system should not use system or configuration status annunciations which may change over time as operational criteria change. The system should not use system or configuration status that could be confusing or ambiguous. For example, system or configuration annunciations such as "CAT I", "CAT II", or "CAT III" should typically not be used for new designs. This is because the flight crew, operator, runway, or aircraft may not be eligible for a particular minima or operation.
5.2.15 Multiple Landing Systems .
This section identifies performance provisions for aircraft that are capable of conducting approach and landing operations using multiple landing systems (e.g., ILS or GLS).
5.2.15.1 General.
5.2.15.1.1 Where practical, the approach procedure, from the pilot’s perspective, should be the same irrespective of the navigation source being used. Call outs, such as “approaching minimums” 5-20
AC 20-191 and “decision height” should have the same meaning for each lan ding system.
5.2.15.1.2 The system must provide a means (e.g., the current ILS facility identification, GLS RPDS) to confirm that the intended approach aid(s) have been correctly selected.
5.2.15.1.3 Indications.
5.2.15.1.4 The following criteria apply to indications in the fli ght deck for the use of a m ulti-mode landing system:
5.2.15.1.5 The primary flight display must indicate deviation data for the selected landing system.
5.2.15.1.6 The MMR must indicate the loss of deviation data on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.
5.2.15.2 Annunciations.
The following criteria apply to annunciations when using a multi-mode landing system.
5.2.15.2.1 The MMR must positively indicate the navigation source (e.g., ILS, GLS, FMS) selected for the approach in the primary field of view at each pilot station.
5.2.15.2.2 The MMR must indicate the data designating the approach
(e.g., ILS frequency or GLS channel number) in a position readily accessible and visible to each pilot.
5.2.15.2.3 The MMR should use a common set of ARM and ACTIVE mode indications (e.g., LOC and GS) for ILS and GLS operations to ease flight crew training.
5.2.15.2.4 The aircraft must provide a means for the flight crew to determine a failure of the non -selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with navigation source.
5.2.15.3 Alerting.
Flight operations may require planning to alternate destination runways or alternate airports for takeoff, en route diversion, and landing. Various runways at these airports may have different landing systems. Thus, flight operations may be planned, released, and conducted based on one or more landing systems. Accordingly, the system should provide a means for the 5-21
AC 20-191 flight crew to det ermine the capability of each element of a multi-mode landing system to support flight planning. The MMR must:
5.2.15.3.1 Indicate to the flight crew failure of a non-selected landing mode (i.e., ILS or GLS) as an ad visory if the mode is not available or will not be available for use during the next approach and landin g.
5.2.15.3.2 Issue a warning, caution, or advi sory, as appropriate if there is a failure of the active element of a multi-mode landing system during an approach.
5.2.15.3.3 Provide an indication of a failure in each non-selected element of a multi-mode landing system to the flight crew as an advisory. This indication should not produce a caution or warning. Such advisories may be inhibited during takeoff, below AH, and at other times as determined necessary or appropriate for the alerting system and flight deck design philosophy for the aircraft type.
5.2.16 MMR.
In cases where MMRs are used for CAT III systems that are using more than one type of landing system, the means of compliance required for certification can be simplified provided the applicant provides appropriate justification. This section provides guidance for retrofit certifications, and for certification of ILS installations with either new or modified receivers.
5.2.16.1 Retrofit Considerations.
5.2.16.1.1 Typical receiver configurations for retrofit applications include:
• An ILS receiver from a new supplier.
• A modified ILS receiver from the same supplier (e.g., for purposes of providing improved FM Immunity).
• A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment).
• A stand-alone GLS receiver.
• A GLS partition in an MMR.
5.2.16.1.2 General certification considerations include:
• Certification Process. An “impact assessment” should address any new receiver functionality considering:
o Differences between the current basis of certification and that which is requested, if applicable.
5-22