AC 20-191 o The functionality being added.
o C redit that can be taken for the existing approval.
• Equipment Approval. The applicant should follow Part 21, Subpart O, to obtain TSO authorization, where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.
• Aircraft installation approval should consider the following:
o Impact on aircraft system safety assessments;
o Equipment approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna);
o EMI/EMC testing;
o Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays;
o Electrical loading;
o Flight data recorder requirements;
o Suitable AFM provisions; and o Certification means of compliance for the receiver installation (e.g., specification of ground or flight testing or both, as necessary).
5.2.16.2 Re-certification.
Re-certification of an ILS function following the Introduction of a New or Modified ILS Navigation Receiver Installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. The applicant may use an impact assessment to propose a certification basis. The assessment will typically address the following:
5.2.16.2.1 New or Modified ILS Impact Assessment.
• An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration:
o Hardware design;
o Software design;
o Signal processing and functional performance;
o Failure analysis;
o Receiver function, installation, and integration (e.g., with controls, indicators, and warnings).
5-23
AC 20-191
• The impact assessment should also identify any additional con siderations such as:
o Future functionality provisions that have no impact on system operation;
o Shared resources to support future functionality;
o Based upon the assumption that the applicant can show the ILS receiver, or receiver function, to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver (replacing the existing receiver) for installation on a given aircraft type.
5.2.16.2.2 New or Modified ILS Failure Analysis.
The failure characteristics of the new or modified installation should be reviewed, and shown to be equivalent to systems using ILS data. This ensures that the failure characteristics are compatible with and do not invalidate any original or previous safety assessments.
5.2.16.2.3 New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary).
5.2.16.2.4 The flight test program should include a minimum of 15 approaches terminating in a successful (automatic or HUD) landing and rollout (if applicable) using the flight control/guidance system . Applicants should use a minimum of two ILS facilities. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical I nstrument Approach Procedures (IAPs), and, if applicable, from below and above the GS. If unable to show equivalency, then the applicant should conduct a complete flight te st program per section 5.4.2.
5.2.16.2.5 Approach and Landing Performance.
The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) as appropriate is equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to support an equivalency demonstration.
5.2.16.2.6 New or Modified ILS Documentation.
The applicant should provide the following documentation for certification:
• An impact assessment including effects on system safety assessments;
5-24
AC 20-191
• A flig ht test report, if applicable ;
• Revisions to the flight manual where appropriate.
5.2.16.3 Recertification following the Introduction of a new or modified GLS Navigation Receiver Installation.
5.2.16.3.1 GLS Introduction Impact Assessment.
The impact assessment, if applicable, should assess equivalent aspects of the GLS receiver or receiver function to those for the existing ILS receiver configuration.
5.2.16.3.2 GLS aircraft Integration/ Installation Failure Mode and Effects Analysis.
The applicant should review the failure characteristics of the new or modified installation to ensure the failure characteristics do not invalidate any original or previous safety assessments.
5.2.16.3.3 GLS Statistical Performance Assessment.
If the flight control/guidance system control algorithms are unchanged or the applicant has already accounted for the effects of any changes (e.g., navigation reference point), the applicant may not have to re-assess the statistical performance assessment of a currently certificated automatic landing system or HUD landing or takeoff system for the addition of GLS functionality.
5.2.16.3.4 GLS Antenna or Navigation Reference Point Location.
The applicant should assess the implication of differences in position of the GLS and ILS aircraft antennas or navigation reference point considering:
• Wheel-to-threshold crossing height;
• Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).
5.2.16.3.5 GLS Introduction Flight Testing (as necessary).
When installing a GLS system to support CAT III operation, the applicant must accomplish a flight test program including a minimum of 30 approaches. The approaches must terminate in a landing and rollout (if applicable) using the flight control/guidance system, and the approaches must include a minimum of two GLS facilities. The approaches should include captures from both sides of the final approach course using representative angles and distances, captures from below and 5-25
AC 20-191 above the glidepath if applic able, and representative wind conditions where antenna or navigation reference point positions may impact performance.
5.2.16.3.6 Approach and Landing Performance.
The approach and landing performance (flight path deviation, touchdown data, etc.) must be equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to confirm equivalency. If unable to show equivalency, then the applicant should conduct a complete flight test program per section 5.4.2.
5.2.16.3.7 GLS Certification.
The applicant should provide the following documentation for GLS certification:
• An impact assessment including effects on system safety assessments,
• A flight test report, if applicable, and
• Revisions to the flight manual where appropriate.
5.3 Airborne Systems for CAT III.
The airborne system should meet the performance, integrity, and availability provisions identified in this AC, as applicable to the type(s) of operation(s) intended. In addition, airborne systems intended for use for CAT III approach and landing or approach, landing, and rollout must meet the pertinent provisions of sections 5.2.10 and 5.2.11 of this chapter.
5.3.1 Automatic Flight Control Systems.
When established on a final approach path below 1000 ft. HAT, it must not be possible to change the flight path of the aircraft with the autopilot(s) engaged, except by initiating an automatic go-around.
5.3.1.1 The automatic landing system must be able to be disengaged at any time without the pilot facing significant out-of-trim forces that might lead to an unacceptable flight path disturbance.
5.3.1.2 Pursuant to 14 CFR §§ 23.2135, 25.143, 27.143, or 29.143 as applicable, each pilot must be able to disengage the automatic landing system by applying a suitable force to the control column, wheel, or stick. This force should be high enough to preclude inadvertent disengagement, and low enough to be applied with one hand.
5.3.1.3 Following a failure or inadvertent disconnect of the autopilot, or loss of the automatic landing mode, when it is necessary for the pilot to immediately assume manual control, the aircraft must provide a visual alert and an aural 5-26
AC 20-191 warning. This warning must be given without delay and be distinct from all othe r cockpit warnings. Even when the pilot disengages the autopilot, the warning must sound for a period long enough to ensure that both the pilot and the other flight crew can hear and recognize the sound. The warning should continue until one of the pilots silences the warning using an autopilot quick release control, or another acceptable means. For purposes of this provision, an autopilot quick release control must be mounted on each control wheel or control stick.
5.3.2 Autothrottle/Autothrust Systems.
For 14 CFR Part 25 aircraft, the autothrottle/autothrust system should follow the guidance in AC 25.1329-1 and the following criteria when used with a low visibility landing system. For 14 CFR Parts 23, 27 and 29 aircraft, AC 25.1329-1 may be used as a guidance, as much as applicable.
5.3.2.1 Include automatic control of throttles/thrust to touchdown unless the applicant shows:
• Aircraft speed can be controlled manually without excessive workload, in representative conditions for which the system is intended and as demonstrated; and
• For manual control of throttles/thrust, the touchdown performance limits will be achieved both for normal autopilot operations and applicable non-normal operations (e.g., engine failure, as applicable; during pilot takeover to manual control using HUD guidance, if part of a hybrid system).
5.3.2.2 An automatic throttle system must provide safe operation and should:
• Adjust throttles to maintain aircraft speed* within acceptable limits, Note: *The approach speed may be selected manually or automatically. If automatically selected, each pilot must be able to determine that the aircraft is flying an appropriate speed.
• Provide throttle application at a rate consistent with the recommendations of the appropriate engine and airframe manufacturers,
• Modulate thrust or throttle application at a rate consistent with, and activity consistent with typical pilot expectation, considering speed error to be corrected, and any conditions or circumstances (e.g., flare retard, go-around thrust application, response to wind gradients), and
• Respect maximum limits, minimum limits, and any limits necessary for specific conditions (e.g., anti-ice, approach idle).
5-27
AC 20-191
5.3.2.3 An i ndication of pertinent automatic throttle system engagement must be provided.
5.3.2.4 The Autothrottle/Autothrust Systems must provide an appropriate alert or warning of automatic throttle failure.
5.3.2.5 It must be possible for each pilot to override the automatic throttle (when provided) without using excessive force.
5.3.2.6 Automatic throttle disengagement switches must be mounted on or adjacent to the throttle levers where they can be operated without removing the hand from the throttles.
5.3.2.7 Following a failure, failure disconnect, or inadvertent disconnect of the automatic throttle, or uncommanded loss of a selected automatic throttle mode, a suitably clear and compelling alert should be provided.
5.3.3 Automatic Braking System .
If an applicant seeks credit for the use of automatic braking, then the following apply.
5.3.3.1 The automatic braking system should incorporate the anti-skid protection and have manual reversion capability. An automatic braking system should provide smooth and continuous deceleration from touchdown until the aircraft comes to a complete stop on the runway and:
• Disconnect of the autobrake system must not create unacceptable additional flight crew workload or flight crew distraction from normal rollout braking.
• Normal operation of the automatic braking system should not interfere with the rollout control system. Manual override of the automatic braking system must be possible without excessive brake pedal forces or interference with the rollout control system. The system should not be susceptible to inadvertent disconnect.
• The automatic braking system should provide a positive indication of system disengagement and a conspicuous indication of system failure .
• No malfunction of the automatic braking system should interfere with either pilot’s use of the manual braking system.
5.3.3.2 The wet and dry runway braking distances, for each mode of the automatic braking system, should be determined and presented in the AFM as performance information. This will assist operators in complying with 14 CFR §§ 121.195 (d), 135.385 (d), and 91.1037 (e).
5.3.4 Head Up Guidance .
5.3.4.1 An applicant can use this section when the Head Up Guidance landing system is intended for manual "pilot-in-the-loop" control during a low 5-28
AC 20-191 visibility approach and landing, and if applicable, a low visibility rollout.
The HUD must provide sufficient command information as guidance to enable the pilot to maintain the approach path, to make the alignment with the runway, flare, and land the aircraft within the prescribed limits. The HUD must also provide sufficient information to enable the pilot to initiate a go-around without reference to other cockpit displays. The HUD should follow the guidance found in AC 25-11 and this section.
5.3.4.2 The workload associated with use of the HUD must comply with the minimum flightcrew requirements found in 14 CFR §§ 23.2610, 25.1523,
27.1523, or 29.1523, as applicable. Reference AC 23.1523, AC 25.1523-1, and AC 25-11, AC 27-1, or AC 29-2 for additional guidance, as applicable.
5.3.4.3 Any HUD installation or HUD display presentation must comply with the requirements found in §§ 23.2600(a), 25.773, 27.773, or 29.773, as applicable. Reference AC 23.1311-1, 25.773-1 and AC 25-11; or AC 27-1;
or AC 29-2 for additional guidance, as applicable.
5.3.4.4 Head Up Guidance systems may be considered fail passive if, after a failure, the aircraft's flight path does not experience a significant, immediate deviation due to the pilot following the failed guidance, before detecting the failure and discontinuing its use.
5.3.4.5 If an automatic flight control system is used to control the flight path of the aircraft prior to establishing manual "pilot-in-the-loop" HUD guidance on final approach, the transition from automatic to manual flight mode must be evaluated during the HUD demonstration, the automatic flight control system demonstration, or both demonstrations. One such example is when the aircraft uses the autoflight system to intercept and establish tracking of the final approach path.
5.3.4.6 During demonstration of any HUD intended for manual "pilot-in-the-loop" flight guidance for CAT III approach and landing, both landing cases and go-around cases should be demonstrated where:
• External visual reference is available at or below 50 ft. HAT to touchdown;
• External visual reference is not available at any time below 50 ft. HAT to touchdown, and, if applicable, is also not available for rollout;
• External visual references, HUD, and instrument references disagree
(e.g., LOC centering errors).
5.3.4.7 If rollout guidance is provided on the HUD, the HUD information must enable the pilot to safely control the aircraft along the runway after touchdown within the prescribed limits. Both normal tracking and any 5-29
AC 20-191 applicable non- normal capture or tracking conditions (e.g., recovery from displacements) should be assessed.
5.3.4.8 After touchdown, loss of a fail passive rollout system for manual control with guidance, must be annunciated with an appropriate visual alert and removal of the command guidance.
5.3.5 Hybrid HUD/Autoland Systems .
A hybrid HUD/autoland system combines a fail passive autoflight capability and a fail passive HUD to establish a fail operational system for CAT III operations. Equipping with two fail passive systems does not necessarily create a fail operational system. The applicant must meet the broader performance provisions of Chapter 5 as well as the specific criteria of this section to qualify your hybrid system as fail operational. The applicant can use the following guidance, or establish an acceptable means of compliance to qualify the hybrid system as fail operational:
5.3.5.1 Approach and Landing:
5.3.5.1.1 The applicant shows each system element independently meets its respective performance criteria for a fail passive system.
5.3.5.1.2 The automatic landing system must be the primary means of control, with the manual flight guidance system serving as a backup mode or reversionary mode.
5.3.5.1.3 Hybrid systems without automatic rollout capability must provide manual rollout flight guidance capability. The applicant must show the manual rollout capability has the performance and reliability at least equivalent to that required of a fail passive automatic rollout system.
5.3.5.1.4 The transition between auto matic mode of operation and manual mode of operation should not require extraordinary skill, training, or proficiency.
5.3.5.1.5 If the system requires a pilot to initiate manual control at or shortly after touchdown, the applicant must show the transition from automatic control prior to touchdown to manual control using the remaining element of the hybrid system (e.g., HUD) after touchdown is safe and reliable.
5.3.5.1.6 The applicant must demonstrate the capability of the pilot to use a hybrid system to safely accomplish the landing and rollout, following a failure of one of the hybrid system elements below AH even if operational procedures require the pilot to initiate a go-around.
5.3.5.1.7 The system must provide a ppropriate annunciations to the 5-30
AC 20-191 flight crew to en sure a safe operation.
5.3.5.1.8 The applicant must demonstrate the combined elements of the system meet the required fail operational criteria necessary to support the operation.
5.3.5.1.9 The applicant must show the overall system meets the accuracy, availability, and integrity criteria suitable for fail operational systems . The applicant must also show each component is individually reliable (e.g., a highly reliable automatic flight control system and an unreliable HUD would not be acceptable).
5.3.5.1.10 Hybrid System Transition from Automatic to Manual Flight.
The applicant must demonstrate a safe manual takeover of aircraft control to complete the landing within the established touchdown footprint. The demonstration should consider the use of appropriate takeover response time delays for the transition. The applicant must conduct t hese demonstrations in the following conditions:
• Without external visual reference,
• With visual reference, and
• With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).
5.3.5.2 Hybrid System Touchdown Capability.
5.3.5.2.1 Demonstrations are necessary for each element of the hybrid system for low altitude go-around, in the altitude ran ge between 50 ft. HAT to touchdown.
5.3.5.2.2 The applicant must conduct hybrid system demonstrations in the following conditions :
• Without external visual reference,
• With visual reference, and
• With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).
5.4 Landing and Rollout System Evaluation.
The applicant should conduct an evaluation to verify that the pertinent systems as installed in the aircraft meet the airworthiness criteria identified in section 5.2 of this 5-31
AC 20-191 chapter. The evaluation should include verification of landing and rollout system per formance and a system safety assessment for verification of the integrity and availability performance provisions. The applicant should demonstrate engine failure cases and other selected failure conditions identified by the safety assessment using simulator or flight tests or both.
5.4.1 Certification Plan.
An applicant should provide a certification plan that describes how any non-aircraft elements of the landing and rollout system relate to the aircraft system from a performance, integrity, and availability perspective.
5.4.1.1 The certification plan should describe the system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and performance provisions other than those contained in this AC are necessary.
5.4.1.2 The applicant should apply criteria contained in this AC, an equivalent foreign standard acceptable to the Administrator, or any other criteria acceptable to the Administrator for the landing and rollout system.
5.4.1.3 The safety level for automatic landing and rollout, or manual landing and rollout using command information as guidance, may not be less than that achieved by a conventional unguided manual landing using visual reference.
In showing compliance with the performance and failure criteria, the applicant may not factor the proportion of landings made with the landing and rollout system into the probabilities of performance or failure effects.
5.4.1.4 The applicant should establish the landing and rollout system performance considering the environmental and deterministic effects that the applicant expects to experience for the type of operation for which the applicant seeks certification and operational approval.
5.4.1.5 Command information provided as guidance during the landing and rollout should be consistent with a pilot’s manual technique and not require excessive skill or flight crew workload to accomplish the operation.
5.4.1.6 For those segments of the flight path where an applicant takes credit for non-automatic systems, the applicant must show acceptable performance of those systems for landing and rollout by reference to instruments alone without requiring the use of external visual reference. This performance 5-32
AC 20-191 demonstration is appropriate because the landing rollout may begin off cent erline and at higher speed.
5.4.1.7 When a system relies on the pilot to detect a selected mode engagement failure, and the pilot cannot reliably detect this failure by other means, the system must provide an appropriate indication or warning.
5.4.1.8 The transition from automatic control to manual control may not require exceptional piloting skill, alertness, or strength.
5.4.1.9 The applicant should show the means proposed to meet the airworthiness performance criteria of section 5.2, with particular attention to methods that differ significantly from those described in this chapter.
5.4.1.10 The assumptions on how the performance, integrity, and availability requirements of the non-aircraft elements will be ensured.
5.4.1.11 The applicant should reach early agreement with the FAA on the proposed certification plan.
5.4.2 Performance Evaluation.
The applicant must demonstrate the performance of the aircraft and its systems by either flight test or by analysis and simulator tests supported by flight test.
5.4.2.1 The performance evaluation must verify that the landing and rollout system meets the performance provisions of section 5.2.8, section 5.2.9, section
5.2.10, and section 5.2.13 in this chapter. The tests must cover:
• Range aircraft configurations, weight, center of gravity, etc.
• Variations in flight path determination associated with the sensors used by the landing and rollout system.
• A sufficient number of normal and non-normal approaches.
• Conditions which are reasonably representative of actual expected conditions. When evaluating performance in a range of wind conditions, applicants should use the wind model in Appendix B, or other model found acceptable by the Administrator.
5.4.2.2 The applicant must identify the reference speed used as the basis for certification. The applicant must demonstrate acceptable performance within a speed range of -5 to +10 knots with respect to the reference speed, unless otherwise agreed by the FAA and the applicant. The reference speed used as the basis for certification should be the same as the speed used for normal landing operations, including wind and other environmental conditions.
5.4.2.3 The applicant must demonstrate the landing and rollout system does not exhibit any guidance system or abnormal control characteristics during the 5-33
AC 20-191 transition to ro llout causing the flight crew to react in an inappropriate manner (e.g., during nose wheel touchdown, spoiler extension, initiation of reverse thrust).
5.4.2.4 Landing systems for manual control with guidance must meet the same performance provisions for touchdown footprints, sink rates, and attitude as automatic landing systems.
5.4.2.5 The applicant must d emonstrate satisfactory performance of landing and rollout system with and without the use of any outside visual references.
The applicant must determine whether the combination of guidance and outside visual references would unacceptably degrade task performance, require excessive pilot compensation or workload during normal and nonnormal operations.
5.4.2.6 For GLS, the applicant must assess fault free performance of GLS using simulations such as Monte-Carlo with the input variables distributed according to their performance characteristics and a model of the GLS guidance including fault free error characteristics defined by the GLS signal model as specified in 5.5.8 Appendix C or another equivalent model.
5.4.2.7 For low visibility systems for manual control with guidance, the applicant must demonstrate rollout guidance without external visual reference to show a pilot can satisfactorily perform the lateral tracking task with the guidance alone. The applicant must also demonstrate rollout guidance with external visual references to show the combination of guidance and visual reference is compatible and does not unacceptably degrade task performance, or require excessive pilot compensation or workload during normal and nonnormal operations.
5.4.2.8 For the evaluation of low visibility systems for manual control with guidance for landing or rollout, the set of subject pilots provided by the applicant should have relevant variability of experience (e.g., experience with or without HUD, Captain or First Officer flight crew position experience as applicable, and experience in type). Subject pilots must not typically have special experience that invalidates the test (e.g., pilots should not have special recent training to cope with HUD failures, beyond that which a line pilot would be expected to have for routine operation).
5.4.2.9 Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.
5.4.2.10 For the initial certification of a landing and rollout system for manual control with guidance (e.g., HUD guidance system) in a new type aircraft or new type HUD installation, at least 1,000 simulated landings and at least 100 actual aircraft landings are typically necessary. For evaluation of these systems, individual pilot performance should also be considered as a variable affecting performance, see section 5.2.9.9. As described in the 5-34