AC 20-191
5.2.10.1.8 Tot al Autoland System Loss.
The applicant must demonstrate the PF can disconnect the autopilot at his/her discretion and maneuver the aircraft to a safe landing and rollout to a safe taxi speed, or perform a successful go-around to avoid catastrophic results.
5.2.10.2 Rollout System Integrity.
When engaged, the rollout system must provide automatic control, or guidance for manual control, to maintain the aircraft on the runway to a safe taxi speed on the runway.
5.2.10.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605 , 25.1309, 27.1309, or 29.1309, the applicant must design the onboard components of the rollout system, considering the components both separately, and in relation to other associated onboard systems. The applicant may use the following criteria for the application of §§ 23.2500, 23.2510, 23.2605, 25.1309,
27.1309, or 29.1309 to Rollout Systems:
5.2.10.2.2 A fail operational rollout system must meet the safe rollout performance provisions of this chapter, section 5.2.9.8 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any single malfunction, or after any combination of malfunctions not shown to be extremely remote. The applicant may consider malfunction cases under nominal environmental conditions.
5.2.10.2.3 For any rollout system, below 200 ft. HAT, the applicant must demonstrate unannunciated malfunctions preventing a safe rollout are extremely improbable.
5.2.10.2.4 For a fail passive rollout system, the loss of a fail passive automatic rollout function after touchdown must cause the automatic flight control system to disconnect. The loss of a fail passive rollout system after touchdown must be improbable.
Whenever a fail passive guidance system for manual rollout does not provide valid guidance, the system should provide a n alert consistent with the flight deck philosophy to each pilot.
5.2.10.2.5 The rollout system performance should not cause the aircraft wheels to exceed the lateral confines of the runway, from the point of touchdown to the point at which a safe taxi speed is reached, more often than once in ten million landings. This performance provision applies for malfunctions only affecting low speed directional control (speeds below effective rudder steering).
5-13
AC 20-191
• The applicant should demonstrate t he effect of any nosewheel steering malfunction can be handled by the rollout system or mitigated by pilot intervention using realistic simulated operational conditions.
• The applicant should include in the safety assessment the worst-case single failure conditions and failure combinations which are not extremely improbable. These conditions should include failures such as a jammed nose wheel steering or nose wheel castering. Where possible, the preferred method of demonstration is by flight test.
• The applicant’s evaluation of failure conditions should include consideration of nominal environmental conditions including visibility, crosswind, and runway surface conditions affecting braking (e.g., snow/ice, water saturated, wet with rubber contamination, etc.). The applicant must accomplish the evaluation of failure conditions with variations in environment unless the applicant can show that the combination of failure and environment is extremely improbable (See AC 25-7, Handling Qualities Rating Method).
• The applicant may use a simulator with a validated ground model to explore the full range of test conditions. These include the effect of simulated runway coefficients of friction, crosswinds, center of gravity, mass distribution (at various ground speeds), runway elevation, and visibility.
5.2.10.2.6 GLS signal anomalies could affect safe system performance in the flare and rollout p hases, so the applicant should describe and show how the GLS autoland and automatic rollout functions safely account for them.
5.2.11 Approach System Continuity Criteria .
The applicant should verify the continuity of navigation during normal aircraft maneuvering while in approach. For GLS, this includes verifying reception of VDB signal at all angles relative to the airframe as the GBAS facility could be located anywhere with respect to the approach path.
5.2.12 Landing and Rollout System Availability .
5.2.12.1 Landing System Availability.
On approach below 500 ft., the probability of a successful landing should be at least 95% for approach demonstrations conducted in the aircraft. This means no more than 5% of the approaches result in a go-around, due to the combination of failures in the landing system and the incidence of unsatisfactory performance. The applicant should meet this level of availability during flight test, with approximately 100 approaches.
5-14
AC 20-191
5.2.12.1.1 For an aircraft equipped with a fail passive landing system, the need to initiate a go-around on approach below 100 ft. HAT due to an aircraft system failure condition should be infrequent
(i.e., typically fewer than 1 per 1000 approaches).
5.2.12.1.2 For a fail operational sy stem, on approach below 200 ft. HAT, the probability of total loss of the landing system (even though appropriate annunciation of system loss is provided) must be extremely remote. The annunciation must enable the pilot to intervene in a timely manner to avoid a catastrophic result.
Total loss of the system without annunciation must be extremely improbable.
5.2.12.1.3 All single failures and combinations of failures not extremely improbable must be shown to permit completion of the landing and rollout to a safe taxi speed, or a successful go - around.
5.2.12.1.4 If a total loss of the autoland system occur s, the applicant must demonstrate the PF can disconnect the autopilot and maneuver the aircraft to a safe landing , and rollout to a safe taxi speed, or perform a successful go -around to avoid catastrophic results.
5.2.12.2 Rollout System Availability should meet the following criteria:
5.2.12.2.1 For a fail passive rollout system, from 200 ft. HAT through landing, and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%, considering loss or failure of the rollout system.
5.2.12.2.2 For a fail operational rollout s ystem, during the period in which the aircraft descends below 200 ft. HAT to a safe taxi speed, the probability of degradation from fail operational to fail passive should be infrequent (i.e., fewer than 1 degradation per 1000 approaches) . The probability of total loss of rollout capability should be extremely remote, considering loss or failure of the rollout system.
5.2.12.2.3 After touchdown, if a complete loss of the fail operational automatic rollout function occurs, or any other unsafe malfunction or condition, the automatic flight control system must disconnect. The loss of a fail operational rollout system after touchdown must be extremely remote.
5-15
AC 20-191
5.2.13 Go-Ar ound.
The aircraft must be capable of safely executing a go-around from any point on the approach to touchdown in all configurations. The maneuver may not require exceptional piloting skill, alertness, or strength.
5.2.13.1 A go-around from a low altitude may result in an inadvertent runway contact, therefore the applicant should establish the safety of the procedure giving consideration to at least the following:
5.2.13.1.1 The automatic control and guidance produced by the goaround mode, when such a mode is provided, should be retained and be shown to have safe and acceptable characteristics throughout the go -around maneuver.
5.2.13.1.2 Inadvertent selection of go -around mode after touchdown should have no adverse effect on the ability of the aircraft to safely roll out and stop.
5.2.13.2 The applicant should assess height loss to assure expeditious go-around from a range of altitudes during the approach and flare when under automatic control and when using the landing guidance system, as appropriate, and as follows:
5.2.13.2.1 Height loss may be assessed by flight testing (typically 10 goarounds) supported by simulation.
5.2.13.2.2 The simulation should evaluate the effects of variation in parameters such as weight, center of gravity, configuration , and wind. The simulation results should correlate with the flight test results.
5.2.13.2.3 Normal procedures for a go -around for the applicable configuration should be followed. If engine-inoperative capability is sought, and use of the go -around mode is applicable to those operations, an assessment of the engine - inoperative go- around is necessary.
5.2.14 Information, Annunciation, and Alerting.
5.2.14.1 Compliance.
The design of the Information, Annunciation, and Alerting must comply with §§ 23.2605, 25.1322, 27.1322, or 29.1322. Reference AC 23.1311-1, AC 25.1322, AC 27-1, or AC 29-2 for additional guidance.
5.2.14.2 Airworthiness Criteria for Basic Situation and Command Information.
5.2.14.2.1 The controls, indicators , and warnings must be designed to minimize flight crew errors that could create a hazard. Mode 5-16
AC 20-191 and system malfunction indications must be presented in a ma nner compatible with the procedures and assigned tasks of the flight crew. The indications must be grouped in a logical and consistent manner and be visible under all expected normal lighting conditions .
5.2.14.2.2 For manual control of approach, landing, and rollout flight path, the primary flight display(s), whether head down or head up, must provide sufficient information to enable a suitably trained pilot to:
• Maintain the approach path,
• Make the alignment with the runway, flare, and land the aircraft within the prescribed limits, and
• Go-around without excessive reference to other cockpit displays.
5.2.14.2.3 The information provided above along with any additional information necessary to the design of the system must be sufficient to allow the flightcrew to monitor the progress and safety of the landing and rollout operation.
5.2.14.2.4 Required in flight performance monitoring capability includes at least the following :
• Unambiguous identification of the intended path for the approach, landing, and rollout, (e.g., ILS /GLS approach identifier/frequency, and selected navigation source); and
• Indication of the position of the aircraft with respect to the intended path (e.g., situation information localizer and glide path, or equivalent).
5.2.14.3 Annunciation.
The system must provide a positive, continuous, and unambiguous indication for the modes actually in operation, as well as those that are armed for engagement. In addition, where mode engagement is automatic
(e.g., localizer and glide path acquisition), the system must provide a clear indication when the mode has been armed by either action of a member of the flight crew, or automatically by the system (e.g., a pre-land test – LAND 3).
5.2.14.4 Alerting.
Alerts are intended to address the need for warning, caution, and advisory information for the flight crew.
5-17
AC 20-191
5.2.14.4.1 Wa rnings.
The system must provide a warning indication for all conditions requiring the flight crew to take immediate corrective action.
The design should account for flight crew alerting cues, corrective action required, and the capability of detecting faults.
• Warnings must be given without delay, be distinct from all other cockpit warnings and provide unmistakable indication of the need for the flight crew to take immediate corrective action. Aural warnings must be audible to each pilot under typically assumed worst-case ambient noise conditions, but not so loud and intrusive as to interfere with the flight crew taking the required corrective action or readily accomplishing flight crew coordination. Visual warnings, such as lights or alphanumeric messages, must be distinct and conspicuously located in the primary field of view for each pilot.
• After beginning final approach (e.g., typically prior to reaching 1000' HAT), the system should annunciate the loss of a fail passive or fail operational system. Whenever a fail passive system, for manual control, does not provide valid guidance, the system must provide a warning indication to each pilot and remove the guidance. The removal of guidance alone is not adequate annunciation. The annunciation must be located to ensure rapid recognition, and must not distract the PF or significantly degrade the forward view.
5.2.14.4.2 Cautions.
The system must provide a caution for any condition requiring immediate flight crew awareness and timely subsequent action.
The system must provide a means to advise the flight crew of failed aircraft system elements that affect the decision to continue or discontinue the approach.
• After initiation of final approach, (which typically occurs at or above 1000' HAT) a fail passive landing system, or landing and rollout system, must alert the flight crew to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
• After initiation of final approach, a fail passive command guidance system (e.g., HUD guidance), must provide a clear, distinct, and unmistakable indication to alert each pilot to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
5-18
AC 20-191
• After initiation of final approach, but above the airworthiness demonstrated AH, a fail operational landing system or landing and rollout system (with either fail operational or fail passive rollout) must alert the flight crew to:
o Any malfunction or condition adversely affecting the ability of the system to safely operate or continue the approach or landing, and o Any malfunction degrading the landing system from a fail operational to a fail passive landing system.
• Below the airworthiness demonstrated AH and throughout rollout, a fail operational landing system must inhibit alerts for malfunctions degrading landing system capability from fail operational to fail passive status.
• Excessive-Deviation alerting. The FAA does not require excessive-deviation alerting, but will approve systems meeting appropriate criteria (e.g., EASA CS- AWO.B.CATII.115).
• For systems that meet EASA criteria, compliance with the following criteria, from CS-AWO.B.CATII.115, is an acceptable means of compliance, but is not a required means of compliance. For systems meeting the CS- AWO.B.CATII.115 criteria, excess-deviation alerts should:
o Operate when the deviation from the ILS or GLS glide path or localizer centerline exceeds a value from which a safe landing can be made from offset positions equivalent to the excess-deviation alert, without exceptional piloting skill and with the visual references assumed to be available in these conditions.
o Be set to operate with a delay of not more than one
(1) second from the time that the deviation thresholds are exceeded.
o Be active at least from 300 ft. (90m) HAT to 50 ft.
HAT, but the glide path deviation alert may be discontinued below 100 ft. (30m) HAT.
5.2.14.4.3 Advisories.
The system must provide a means to inform the flight crew when the aircraft has reached the AH or DH, as applicable.
5-19
AC 20-191
5.2.14.4.4 Sy stem Status.
The system should provide a means for the operator and flight crew to determine both prior to and after departure, the capability of the aircraft elements to accomplish the intended low visibility operations. While en route, the system should indicate to the flight crew as an advisory the failure of each aircraft component adversely affecting the capability to conduct the intended landing operation.
• The system should provide a means to advise the flight crew of failed aircraft system elements relating to landing system capability which otherwise could adversely affect a flight crew’s decision to use particular landing minima (e.g., adversely affect a decision to continue to a destination or divert to an alternate).
• If multiple landing system capability is installed (e.g., MMR), then during approach the system should provide an indication to the flight crew of a failure in each non-selected aircraft landing system element (e.g., a GLS receiver failure during conduct of an ILS approach) as an indication of system status. Such failures or non-availability, however, should not produce a caution or warning if they are not relevant to the system in use.
• The system should identify system status indications by names that are different than operational authorization categories (e.g., annunciations such as "LAND 3," or "DUAL" may be used). The system should not use system or configuration status annunciations which may change over time as operational criteria change. The system should not use system or configuration status that could be confusing or ambiguous. For example, system or configuration annunciations such as "CAT I", "CAT II", or "CAT III" should typically not be used for new designs. This is because the flight crew, operator, runway, or aircraft may not be eligible for a particular minima or operation.
5.2.15 Multiple Landing Systems .
This section identifies performance provisions for aircraft that are capable of conducting approach and landing operations using multiple landing systems (e.g., ILS or GLS).
5.2.15.1 General.
5.2.15.1.1 Where practical, the approach procedure, from the pilot’s perspective, should be the same irrespective of the navigation source being used. Call outs, such as “approaching minimums” 5-20
AC 20-191 and “decision height” should have the same meaning for each lan ding system.
5.2.15.1.2 The system must provide a means (e.g., the current ILS facility identification, GLS RPDS) to confirm that the intended approach aid(s) have been correctly selected.
5.2.15.1.3 Indications.
5.2.15.1.4 The following criteria apply to indications in the fli ght deck for the use of a m ulti-mode landing system:
5.2.15.1.5 The primary flight display must indicate deviation data for the selected landing system.
5.2.15.1.6 The MMR must indicate the loss of deviation data on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.
5.2.15.2 Annunciations.
The following criteria apply to annunciations when using a multi-mode landing system.
5.2.15.2.1 The MMR must positively indicate the navigation source (e.g., ILS, GLS, FMS) selected for the approach in the primary field of view at each pilot station.
5.2.15.2.2 The MMR must indicate the data designating the approach
(e.g., ILS frequency or GLS channel number) in a position readily accessible and visible to each pilot.
5.2.15.2.3 The MMR should use a common set of ARM and ACTIVE mode indications (e.g., LOC and GS) for ILS and GLS operations to ease flight crew training.
5.2.15.2.4 The aircraft must provide a means for the flight crew to determine a failure of the non -selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with navigation source.
5.2.15.3 Alerting.
Flight operations may require planning to alternate destination runways or alternate airports for takeoff, en route diversion, and landing. Various runways at these airports may have different landing systems. Thus, flight operations may be planned, released, and conducted based on one or more landing systems. Accordingly, the system should provide a means for the 5-21
AC 20-191 flight crew to det ermine the capability of each element of a multi-mode landing system to support flight planning. The MMR must:
5.2.15.3.1 Indicate to the flight crew failure of a non-selected landing mode (i.e., ILS or GLS) as an ad visory if the mode is not available or will not be available for use during the next approach and landin g.
5.2.15.3.2 Issue a warning, caution, or advi sory, as appropriate if there is a failure of the active element of a multi-mode landing system during an approach.
5.2.15.3.3 Provide an indication of a failure in each non-selected element of a multi-mode landing system to the flight crew as an advisory. This indication should not produce a caution or warning. Such advisories may be inhibited during takeoff, below AH, and at other times as determined necessary or appropriate for the alerting system and flight deck design philosophy for the aircraft type.
5.2.16 MMR.
In cases where MMRs are used for CAT III systems that are using more than one type of landing system, the means of compliance required for certification can be simplified provided the applicant provides appropriate justification. This section provides guidance for retrofit certifications, and for certification of ILS installations with either new or modified receivers.
5.2.16.1 Retrofit Considerations.
5.2.16.1.1 Typical receiver configurations for retrofit applications include:
• An ILS receiver from a new supplier.
• A modified ILS receiver from the same supplier (e.g., for purposes of providing improved FM Immunity).
• A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment).
• A stand-alone GLS receiver.
• A GLS partition in an MMR.
5.2.16.1.2 General certification considerations include:
• Certification Process. An “impact assessment” should address any new receiver functionality considering:
o Differences between the current basis of certification and that which is requested, if applicable.
5-22
AC 20-191 o The functionality being added.
o C redit that can be taken for the existing approval.
• Equipment Approval. The applicant should follow Part 21, Subpart O, to obtain TSO authorization, where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.
• Aircraft installation approval should consider the following:
o Impact on aircraft system safety assessments;
o Equipment approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna);
o EMI/EMC testing;
o Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays;
o Electrical loading;
o Flight data recorder requirements;
o Suitable AFM provisions; and o Certification means of compliance for the receiver installation (e.g., specification of ground or flight testing or both, as necessary).
5.2.16.2 Re-certification.
Re-certification of an ILS function following the Introduction of a New or Modified ILS Navigation Receiver Installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. The applicant may use an impact assessment to propose a certification basis. The assessment will typically address the following:
5.2.16.2.1 New or Modified ILS Impact Assessment.
• An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration:
o Hardware design;
o Software design;
o Signal processing and functional performance;
o Failure analysis;
o Receiver function, installation, and integration (e.g., with controls, indicators, and warnings).
5-23
AC 20-191
• The impact assessment should also identify any additional con siderations such as:
o Future functionality provisions that have no impact on system operation;
o Shared resources to support future functionality;
o Based upon the assumption that the applicant can show the ILS receiver, or receiver function, to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver (replacing the existing receiver) for installation on a given aircraft type.
5.2.16.2.2 New or Modified ILS Failure Analysis.
The failure characteristics of the new or modified installation should be reviewed, and shown to be equivalent to systems using ILS data. This ensures that the failure characteristics are compatible with and do not invalidate any original or previous safety assessments.
5.2.16.2.3 New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary).
5.2.16.2.4 The flight test program should include a minimum of 15 approaches terminating in a successful (automatic or HUD) landing and rollout (if applicable) using the flight control/guidance system . Applicants should use a minimum of two ILS facilities. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical I nstrument Approach Procedures (IAPs), and, if applicable, from below and above the GS. If unable to show equivalency, then the applicant should conduct a complete flight te st program per section 5.4.2.
5.2.16.2.5 Approach and Landing Performance.
The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) as appropriate is equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to support an equivalency demonstration.
5.2.16.2.6 New or Modified ILS Documentation.
The applicant should provide the following documentation for certification:
• An impact assessment including effects on system safety assessments;
5-24