AC 20-191
5.2.14.4.1 Wa rnings.
The system must provide a warning indication for all conditions requiring the flight crew to take immediate corrective action.
The design should account for flight crew alerting cues, corrective action required, and the capability of detecting faults.
• Warnings must be given without delay, be distinct from all other cockpit warnings and provide unmistakable indication of the need for the flight crew to take immediate corrective action. Aural warnings must be audible to each pilot under typically assumed worst-case ambient noise conditions, but not so loud and intrusive as to interfere with the flight crew taking the required corrective action or readily accomplishing flight crew coordination. Visual warnings, such as lights or alphanumeric messages, must be distinct and conspicuously located in the primary field of view for each pilot.
• After beginning final approach (e.g., typically prior to reaching 1000' HAT), the system should annunciate the loss of a fail passive or fail operational system. Whenever a fail passive system, for manual control, does not provide valid guidance, the system must provide a warning indication to each pilot and remove the guidance. The removal of guidance alone is not adequate annunciation. The annunciation must be located to ensure rapid recognition, and must not distract the PF or significantly degrade the forward view.
5.2.14.4.2 Cautions.
The system must provide a caution for any condition requiring immediate flight crew awareness and timely subsequent action.
The system must provide a means to advise the flight crew of failed aircraft system elements that affect the decision to continue or discontinue the approach.
• After initiation of final approach, (which typically occurs at or above 1000' HAT) a fail passive landing system, or landing and rollout system, must alert the flight crew to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
• After initiation of final approach, a fail passive command guidance system (e.g., HUD guidance), must provide a clear, distinct, and unmistakable indication to alert each pilot to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.
5-18
AC 20-191
• After initiation of final approach, but above the airworthiness demonstrated AH, a fail operational landing system or landing and rollout system (with either fail operational or fail passive rollout) must alert the flight crew to:
o Any malfunction or condition adversely affecting the ability of the system to safely operate or continue the approach or landing, and o Any malfunction degrading the landing system from a fail operational to a fail passive landing system.
• Below the airworthiness demonstrated AH and throughout rollout, a fail operational landing system must inhibit alerts for malfunctions degrading landing system capability from fail operational to fail passive status.
• Excessive-Deviation alerting. The FAA does not require excessive-deviation alerting, but will approve systems meeting appropriate criteria (e.g., EASA CS- AWO.B.CATII.115).
• For systems that meet EASA criteria, compliance with the following criteria, from CS-AWO.B.CATII.115, is an acceptable means of compliance, but is not a required means of compliance. For systems meeting the CS- AWO.B.CATII.115 criteria, excess-deviation alerts should:
o Operate when the deviation from the ILS or GLS glide path or localizer centerline exceeds a value from which a safe landing can be made from offset positions equivalent to the excess-deviation alert, without exceptional piloting skill and with the visual references assumed to be available in these conditions.
o Be set to operate with a delay of not more than one
(1) second from the time that the deviation thresholds are exceeded.
o Be active at least from 300 ft. (90m) HAT to 50 ft.
HAT, but the glide path deviation alert may be discontinued below 100 ft. (30m) HAT.
5.2.14.4.3 Advisories.
The system must provide a means to inform the flight crew when the aircraft has reached the AH or DH, as applicable.
5-19
AC 20-191
5.2.14.4.4 Sy stem Status.
The system should provide a means for the operator and flight crew to determine both prior to and after departure, the capability of the aircraft elements to accomplish the intended low visibility operations. While en route, the system should indicate to the flight crew as an advisory the failure of each aircraft component adversely affecting the capability to conduct the intended landing operation.
• The system should provide a means to advise the flight crew of failed aircraft system elements relating to landing system capability which otherwise could adversely affect a flight crew’s decision to use particular landing minima (e.g., adversely affect a decision to continue to a destination or divert to an alternate).
• If multiple landing system capability is installed (e.g., MMR), then during approach the system should provide an indication to the flight crew of a failure in each non-selected aircraft landing system element (e.g., a GLS receiver failure during conduct of an ILS approach) as an indication of system status. Such failures or non-availability, however, should not produce a caution or warning if they are not relevant to the system in use.
• The system should identify system status indications by names that are different than operational authorization categories (e.g., annunciations such as "LAND 3," or "DUAL" may be used). The system should not use system or configuration status annunciations which may change over time as operational criteria change. The system should not use system or configuration status that could be confusing or ambiguous. For example, system or configuration annunciations such as "CAT I", "CAT II", or "CAT III" should typically not be used for new designs. This is because the flight crew, operator, runway, or aircraft may not be eligible for a particular minima or operation.
5.2.15 Multiple Landing Systems .
This section identifies performance provisions for aircraft that are capable of conducting approach and landing operations using multiple landing systems (e.g., ILS or GLS).
5.2.15.1 General.
5.2.15.1.1 Where practical, the approach procedure, from the pilot’s perspective, should be the same irrespective of the navigation source being used. Call outs, such as “approaching minimums” 5-20
AC 20-191 and “decision height” should have the same meaning for each lan ding system.
5.2.15.1.2 The system must provide a means (e.g., the current ILS facility identification, GLS RPDS) to confirm that the intended approach aid(s) have been correctly selected.
5.2.15.1.3 Indications.
5.2.15.1.4 The following criteria apply to indications in the fli ght deck for the use of a m ulti-mode landing system:
5.2.15.1.5 The primary flight display must indicate deviation data for the selected landing system.
5.2.15.1.6 The MMR must indicate the loss of deviation data on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.
5.2.15.2 Annunciations.
The following criteria apply to annunciations when using a multi-mode landing system.
5.2.15.2.1 The MMR must positively indicate the navigation source (e.g., ILS, GLS, FMS) selected for the approach in the primary field of view at each pilot station.
5.2.15.2.2 The MMR must indicate the data designating the approach
(e.g., ILS frequency or GLS channel number) in a position readily accessible and visible to each pilot.
5.2.15.2.3 The MMR should use a common set of ARM and ACTIVE mode indications (e.g., LOC and GS) for ILS and GLS operations to ease flight crew training.
5.2.15.2.4 The aircraft must provide a means for the flight crew to determine a failure of the non -selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with navigation source.
5.2.15.3 Alerting.
Flight operations may require planning to alternate destination runways or alternate airports for takeoff, en route diversion, and landing. Various runways at these airports may have different landing systems. Thus, flight operations may be planned, released, and conducted based on one or more landing systems. Accordingly, the system should provide a means for the 5-21
AC 20-191 flight crew to det ermine the capability of each element of a multi-mode landing system to support flight planning. The MMR must:
5.2.15.3.1 Indicate to the flight crew failure of a non-selected landing mode (i.e., ILS or GLS) as an ad visory if the mode is not available or will not be available for use during the next approach and landin g.
5.2.15.3.2 Issue a warning, caution, or advi sory, as appropriate if there is a failure of the active element of a multi-mode landing system during an approach.
5.2.15.3.3 Provide an indication of a failure in each non-selected element of a multi-mode landing system to the flight crew as an advisory. This indication should not produce a caution or warning. Such advisories may be inhibited during takeoff, below AH, and at other times as determined necessary or appropriate for the alerting system and flight deck design philosophy for the aircraft type.
5.2.16 MMR.
In cases where MMRs are used for CAT III systems that are using more than one type of landing system, the means of compliance required for certification can be simplified provided the applicant provides appropriate justification. This section provides guidance for retrofit certifications, and for certification of ILS installations with either new or modified receivers.
5.2.16.1 Retrofit Considerations.
5.2.16.1.1 Typical receiver configurations for retrofit applications include:
• An ILS receiver from a new supplier.
• A modified ILS receiver from the same supplier (e.g., for purposes of providing improved FM Immunity).
• A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment).
• A stand-alone GLS receiver.
• A GLS partition in an MMR.
5.2.16.1.2 General certification considerations include:
• Certification Process. An “impact assessment” should address any new receiver functionality considering:
o Differences between the current basis of certification and that which is requested, if applicable.
5-22
AC 20-191 o The functionality being added.
o C redit that can be taken for the existing approval.
• Equipment Approval. The applicant should follow Part 21, Subpart O, to obtain TSO authorization, where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.
• Aircraft installation approval should consider the following:
o Impact on aircraft system safety assessments;
o Equipment approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna);
o EMI/EMC testing;
o Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays;
o Electrical loading;
o Flight data recorder requirements;
o Suitable AFM provisions; and o Certification means of compliance for the receiver installation (e.g., specification of ground or flight testing or both, as necessary).
5.2.16.2 Re-certification.
Re-certification of an ILS function following the Introduction of a New or Modified ILS Navigation Receiver Installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. The applicant may use an impact assessment to propose a certification basis. The assessment will typically address the following:
5.2.16.2.1 New or Modified ILS Impact Assessment.
• An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration:
o Hardware design;
o Software design;
o Signal processing and functional performance;
o Failure analysis;
o Receiver function, installation, and integration (e.g., with controls, indicators, and warnings).
5-23
AC 20-191
• The impact assessment should also identify any additional con siderations such as:
o Future functionality provisions that have no impact on system operation;
o Shared resources to support future functionality;
o Based upon the assumption that the applicant can show the ILS receiver, or receiver function, to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver (replacing the existing receiver) for installation on a given aircraft type.
5.2.16.2.2 New or Modified ILS Failure Analysis.
The failure characteristics of the new or modified installation should be reviewed, and shown to be equivalent to systems using ILS data. This ensures that the failure characteristics are compatible with and do not invalidate any original or previous safety assessments.
5.2.16.2.3 New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary).
5.2.16.2.4 The flight test program should include a minimum of 15 approaches terminating in a successful (automatic or HUD) landing and rollout (if applicable) using the flight control/guidance system . Applicants should use a minimum of two ILS facilities. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical I nstrument Approach Procedures (IAPs), and, if applicable, from below and above the GS. If unable to show equivalency, then the applicant should conduct a complete flight te st program per section 5.4.2.
5.2.16.2.5 Approach and Landing Performance.
The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) as appropriate is equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to support an equivalency demonstration.
5.2.16.2.6 New or Modified ILS Documentation.
The applicant should provide the following documentation for certification:
• An impact assessment including effects on system safety assessments;
5-24
AC 20-191
• A flig ht test report, if applicable ;
• Revisions to the flight manual where appropriate.
5.2.16.3 Recertification following the Introduction of a new or modified GLS Navigation Receiver Installation.
5.2.16.3.1 GLS Introduction Impact Assessment.
The impact assessment, if applicable, should assess equivalent aspects of the GLS receiver or receiver function to those for the existing ILS receiver configuration.
5.2.16.3.2 GLS aircraft Integration/ Installation Failure Mode and Effects Analysis.
The applicant should review the failure characteristics of the new or modified installation to ensure the failure characteristics do not invalidate any original or previous safety assessments.
5.2.16.3.3 GLS Statistical Performance Assessment.
If the flight control/guidance system control algorithms are unchanged or the applicant has already accounted for the effects of any changes (e.g., navigation reference point), the applicant may not have to re-assess the statistical performance assessment of a currently certificated automatic landing system or HUD landing or takeoff system for the addition of GLS functionality.
5.2.16.3.4 GLS Antenna or Navigation Reference Point Location.
The applicant should assess the implication of differences in position of the GLS and ILS aircraft antennas or navigation reference point considering:
• Wheel-to-threshold crossing height;
• Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).
5.2.16.3.5 GLS Introduction Flight Testing (as necessary).
When installing a GLS system to support CAT III operation, the applicant must accomplish a flight test program including a minimum of 30 approaches. The approaches must terminate in a landing and rollout (if applicable) using the flight control/guidance system, and the approaches must include a minimum of two GLS facilities. The approaches should include captures from both sides of the final approach course using representative angles and distances, captures from below and 5-25
AC 20-191 above the glidepath if applic able, and representative wind conditions where antenna or navigation reference point positions may impact performance.
5.2.16.3.6 Approach and Landing Performance.
The approach and landing performance (flight path deviation, touchdown data, etc.) must be equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to confirm equivalency. If unable to show equivalency, then the applicant should conduct a complete flight test program per section 5.4.2.
5.2.16.3.7 GLS Certification.
The applicant should provide the following documentation for GLS certification:
• An impact assessment including effects on system safety assessments,
• A flight test report, if applicable, and
• Revisions to the flight manual where appropriate.
5.3 Airborne Systems for CAT III.
The airborne system should meet the performance, integrity, and availability provisions identified in this AC, as applicable to the type(s) of operation(s) intended. In addition, airborne systems intended for use for CAT III approach and landing or approach, landing, and rollout must meet the pertinent provisions of sections 5.2.10 and 5.2.11 of this chapter.
5.3.1 Automatic Flight Control Systems.
When established on a final approach path below 1000 ft. HAT, it must not be possible to change the flight path of the aircraft with the autopilot(s) engaged, except by initiating an automatic go-around.
5.3.1.1 The automatic landing system must be able to be disengaged at any time without the pilot facing significant out-of-trim forces that might lead to an unacceptable flight path disturbance.
5.3.1.2 Pursuant to 14 CFR §§ 23.2135, 25.143, 27.143, or 29.143 as applicable, each pilot must be able to disengage the automatic landing system by applying a suitable force to the control column, wheel, or stick. This force should be high enough to preclude inadvertent disengagement, and low enough to be applied with one hand.
5.3.1.3 Following a failure or inadvertent disconnect of the autopilot, or loss of the automatic landing mode, when it is necessary for the pilot to immediately assume manual control, the aircraft must provide a visual alert and an aural 5-26
AC 20-191 warning. This warning must be given without delay and be distinct from all othe r cockpit warnings. Even when the pilot disengages the autopilot, the warning must sound for a period long enough to ensure that both the pilot and the other flight crew can hear and recognize the sound. The warning should continue until one of the pilots silences the warning using an autopilot quick release control, or another acceptable means. For purposes of this provision, an autopilot quick release control must be mounted on each control wheel or control stick.
5.3.2 Autothrottle/Autothrust Systems.
For 14 CFR Part 25 aircraft, the autothrottle/autothrust system should follow the guidance in AC 25.1329-1 and the following criteria when used with a low visibility landing system. For 14 CFR Parts 23, 27 and 29 aircraft, AC 25.1329-1 may be used as a guidance, as much as applicable.
5.3.2.1 Include automatic control of throttles/thrust to touchdown unless the applicant shows:
• Aircraft speed can be controlled manually without excessive workload, in representative conditions for which the system is intended and as demonstrated; and
• For manual control of throttles/thrust, the touchdown performance limits will be achieved both for normal autopilot operations and applicable non-normal operations (e.g., engine failure, as applicable; during pilot takeover to manual control using HUD guidance, if part of a hybrid system).
5.3.2.2 An automatic throttle system must provide safe operation and should:
• Adjust throttles to maintain aircraft speed* within acceptable limits, Note: *The approach speed may be selected manually or automatically. If automatically selected, each pilot must be able to determine that the aircraft is flying an appropriate speed.
• Provide throttle application at a rate consistent with the recommendations of the appropriate engine and airframe manufacturers,
• Modulate thrust or throttle application at a rate consistent with, and activity consistent with typical pilot expectation, considering speed error to be corrected, and any conditions or circumstances (e.g., flare retard, go-around thrust application, response to wind gradients), and
• Respect maximum limits, minimum limits, and any limits necessary for specific conditions (e.g., anti-ice, approach idle).
5-27
AC 20-191
5.3.2.3 An i ndication of pertinent automatic throttle system engagement must be provided.
5.3.2.4 The Autothrottle/Autothrust Systems must provide an appropriate alert or warning of automatic throttle failure.
5.3.2.5 It must be possible for each pilot to override the automatic throttle (when provided) without using excessive force.
5.3.2.6 Automatic throttle disengagement switches must be mounted on or adjacent to the throttle levers where they can be operated without removing the hand from the throttles.
5.3.2.7 Following a failure, failure disconnect, or inadvertent disconnect of the automatic throttle, or uncommanded loss of a selected automatic throttle mode, a suitably clear and compelling alert should be provided.
5.3.3 Automatic Braking System .
If an applicant seeks credit for the use of automatic braking, then the following apply.
5.3.3.1 The automatic braking system should incorporate the anti-skid protection and have manual reversion capability. An automatic braking system should provide smooth and continuous deceleration from touchdown until the aircraft comes to a complete stop on the runway and:
• Disconnect of the autobrake system must not create unacceptable additional flight crew workload or flight crew distraction from normal rollout braking.
• Normal operation of the automatic braking system should not interfere with the rollout control system. Manual override of the automatic braking system must be possible without excessive brake pedal forces or interference with the rollout control system. The system should not be susceptible to inadvertent disconnect.
• The automatic braking system should provide a positive indication of system disengagement and a conspicuous indication of system failure .
• No malfunction of the automatic braking system should interfere with either pilot’s use of the manual braking system.
5.3.3.2 The wet and dry runway braking distances, for each mode of the automatic braking system, should be determined and presented in the AFM as performance information. This will assist operators in complying with 14 CFR §§ 121.195 (d), 135.385 (d), and 91.1037 (e).
5.3.4 Head Up Guidance .
5.3.4.1 An applicant can use this section when the Head Up Guidance landing system is intended for manual "pilot-in-the-loop" control during a low 5-28
AC 20-191 visibility approach and landing, and if applicable, a low visibility rollout.
The HUD must provide sufficient command information as guidance to enable the pilot to maintain the approach path, to make the alignment with the runway, flare, and land the aircraft within the prescribed limits. The HUD must also provide sufficient information to enable the pilot to initiate a go-around without reference to other cockpit displays. The HUD should follow the guidance found in AC 25-11 and this section.
5.3.4.2 The workload associated with use of the HUD must comply with the minimum flightcrew requirements found in 14 CFR §§ 23.2610, 25.1523,
27.1523, or 29.1523, as applicable. Reference AC 23.1523, AC 25.1523-1, and AC 25-11, AC 27-1, or AC 29-2 for additional guidance, as applicable.
5.3.4.3 Any HUD installation or HUD display presentation must comply with the requirements found in §§ 23.2600(a), 25.773, 27.773, or 29.773, as applicable. Reference AC 23.1311-1, 25.773-1 and AC 25-11; or AC 27-1;
or AC 29-2 for additional guidance, as applicable.
5.3.4.4 Head Up Guidance systems may be considered fail passive if, after a failure, the aircraft's flight path does not experience a significant, immediate deviation due to the pilot following the failed guidance, before detecting the failure and discontinuing its use.
5.3.4.5 If an automatic flight control system is used to control the flight path of the aircraft prior to establishing manual "pilot-in-the-loop" HUD guidance on final approach, the transition from automatic to manual flight mode must be evaluated during the HUD demonstration, the automatic flight control system demonstration, or both demonstrations. One such example is when the aircraft uses the autoflight system to intercept and establish tracking of the final approach path.
5.3.4.6 During demonstration of any HUD intended for manual "pilot-in-the-loop" flight guidance for CAT III approach and landing, both landing cases and go-around cases should be demonstrated where:
• External visual reference is available at or below 50 ft. HAT to touchdown;
• External visual reference is not available at any time below 50 ft. HAT to touchdown, and, if applicable, is also not available for rollout;
• External visual references, HUD, and instrument references disagree
(e.g., LOC centering errors).
5.3.4.7 If rollout guidance is provided on the HUD, the HUD information must enable the pilot to safely control the aircraft along the runway after touchdown within the prescribed limits. Both normal tracking and any 5-29