AC 20-191
• A flig ht test report, if applicable ;
• Revisions to the flight manual where appropriate.
5.2.16.3 Recertification following the Introduction of a new or modified GLS Navigation Receiver Installation.
5.2.16.3.1 GLS Introduction Impact Assessment.
The impact assessment, if applicable, should assess equivalent aspects of the GLS receiver or receiver function to those for the existing ILS receiver configuration.
5.2.16.3.2 GLS aircraft Integration/ Installation Failure Mode and Effects Analysis.
The applicant should review the failure characteristics of the new or modified installation to ensure the failure characteristics do not invalidate any original or previous safety assessments.
5.2.16.3.3 GLS Statistical Performance Assessment.
If the flight control/guidance system control algorithms are unchanged or the applicant has already accounted for the effects of any changes (e.g., navigation reference point), the applicant may not have to re-assess the statistical performance assessment of a currently certificated automatic landing system or HUD landing or takeoff system for the addition of GLS functionality.
5.2.16.3.4 GLS Antenna or Navigation Reference Point Location.
The applicant should assess the implication of differences in position of the GLS and ILS aircraft antennas or navigation reference point considering:
• Wheel-to-threshold crossing height;
• Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).
5.2.16.3.5 GLS Introduction Flight Testing (as necessary).
When installing a GLS system to support CAT III operation, the applicant must accomplish a flight test program including a minimum of 30 approaches. The approaches must terminate in a landing and rollout (if applicable) using the flight control/guidance system, and the approaches must include a minimum of two GLS facilities. The approaches should include captures from both sides of the final approach course using representative angles and distances, captures from below and 5-25
AC 20-191 above the glidepath if applic able, and representative wind conditions where antenna or navigation reference point positions may impact performance.
5.2.16.3.6 Approach and Landing Performance.
The approach and landing performance (flight path deviation, touchdown data, etc.) must be equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to confirm equivalency. If unable to show equivalency, then the applicant should conduct a complete flight test program per section 5.4.2.
5.2.16.3.7 GLS Certification.
The applicant should provide the following documentation for GLS certification:
• An impact assessment including effects on system safety assessments,
• A flight test report, if applicable, and
• Revisions to the flight manual where appropriate.
5.3 Airborne Systems for CAT III.
The airborne system should meet the performance, integrity, and availability provisions identified in this AC, as applicable to the type(s) of operation(s) intended. In addition, airborne systems intended for use for CAT III approach and landing or approach, landing, and rollout must meet the pertinent provisions of sections 5.2.10 and 5.2.11 of this chapter.
5.3.1 Automatic Flight Control Systems.
When established on a final approach path below 1000 ft. HAT, it must not be possible to change the flight path of the aircraft with the autopilot(s) engaged, except by initiating an automatic go-around.
5.3.1.1 The automatic landing system must be able to be disengaged at any time without the pilot facing significant out-of-trim forces that might lead to an unacceptable flight path disturbance.
5.3.1.2 Pursuant to 14 CFR §§ 23.2135, 25.143, 27.143, or 29.143 as applicable, each pilot must be able to disengage the automatic landing system by applying a suitable force to the control column, wheel, or stick. This force should be high enough to preclude inadvertent disengagement, and low enough to be applied with one hand.
5.3.1.3 Following a failure or inadvertent disconnect of the autopilot, or loss of the automatic landing mode, when it is necessary for the pilot to immediately assume manual control, the aircraft must provide a visual alert and an aural 5-26
AC 20-191 warning. This warning must be given without delay and be distinct from all othe r cockpit warnings. Even when the pilot disengages the autopilot, the warning must sound for a period long enough to ensure that both the pilot and the other flight crew can hear and recognize the sound. The warning should continue until one of the pilots silences the warning using an autopilot quick release control, or another acceptable means. For purposes of this provision, an autopilot quick release control must be mounted on each control wheel or control stick.
5.3.2 Autothrottle/Autothrust Systems.
For 14 CFR Part 25 aircraft, the autothrottle/autothrust system should follow the guidance in AC 25.1329-1 and the following criteria when used with a low visibility landing system. For 14 CFR Parts 23, 27 and 29 aircraft, AC 25.1329-1 may be used as a guidance, as much as applicable.
5.3.2.1 Include automatic control of throttles/thrust to touchdown unless the applicant shows:
• Aircraft speed can be controlled manually without excessive workload, in representative conditions for which the system is intended and as demonstrated; and
• For manual control of throttles/thrust, the touchdown performance limits will be achieved both for normal autopilot operations and applicable non-normal operations (e.g., engine failure, as applicable; during pilot takeover to manual control using HUD guidance, if part of a hybrid system).
5.3.2.2 An automatic throttle system must provide safe operation and should:
• Adjust throttles to maintain aircraft speed* within acceptable limits, Note: *The approach speed may be selected manually or automatically. If automatically selected, each pilot must be able to determine that the aircraft is flying an appropriate speed.
• Provide throttle application at a rate consistent with the recommendations of the appropriate engine and airframe manufacturers,
• Modulate thrust or throttle application at a rate consistent with, and activity consistent with typical pilot expectation, considering speed error to be corrected, and any conditions or circumstances (e.g., flare retard, go-around thrust application, response to wind gradients), and
• Respect maximum limits, minimum limits, and any limits necessary for specific conditions (e.g., anti-ice, approach idle).
5-27
AC 20-191
5.3.2.3 An i ndication of pertinent automatic throttle system engagement must be provided.
5.3.2.4 The Autothrottle/Autothrust Systems must provide an appropriate alert or warning of automatic throttle failure.
5.3.2.5 It must be possible for each pilot to override the automatic throttle (when provided) without using excessive force.
5.3.2.6 Automatic throttle disengagement switches must be mounted on or adjacent to the throttle levers where they can be operated without removing the hand from the throttles.
5.3.2.7 Following a failure, failure disconnect, or inadvertent disconnect of the automatic throttle, or uncommanded loss of a selected automatic throttle mode, a suitably clear and compelling alert should be provided.
5.3.3 Automatic Braking System .
If an applicant seeks credit for the use of automatic braking, then the following apply.
5.3.3.1 The automatic braking system should incorporate the anti-skid protection and have manual reversion capability. An automatic braking system should provide smooth and continuous deceleration from touchdown until the aircraft comes to a complete stop on the runway and:
• Disconnect of the autobrake system must not create unacceptable additional flight crew workload or flight crew distraction from normal rollout braking.
• Normal operation of the automatic braking system should not interfere with the rollout control system. Manual override of the automatic braking system must be possible without excessive brake pedal forces or interference with the rollout control system. The system should not be susceptible to inadvertent disconnect.
• The automatic braking system should provide a positive indication of system disengagement and a conspicuous indication of system failure .
• No malfunction of the automatic braking system should interfere with either pilot’s use of the manual braking system.
5.3.3.2 The wet and dry runway braking distances, for each mode of the automatic braking system, should be determined and presented in the AFM as performance information. This will assist operators in complying with 14 CFR §§ 121.195 (d), 135.385 (d), and 91.1037 (e).
5.3.4 Head Up Guidance .
5.3.4.1 An applicant can use this section when the Head Up Guidance landing system is intended for manual "pilot-in-the-loop" control during a low 5-28
AC 20-191 visibility approach and landing, and if applicable, a low visibility rollout.
The HUD must provide sufficient command information as guidance to enable the pilot to maintain the approach path, to make the alignment with the runway, flare, and land the aircraft within the prescribed limits. The HUD must also provide sufficient information to enable the pilot to initiate a go-around without reference to other cockpit displays. The HUD should follow the guidance found in AC 25-11 and this section.
5.3.4.2 The workload associated with use of the HUD must comply with the minimum flightcrew requirements found in 14 CFR §§ 23.2610, 25.1523,
27.1523, or 29.1523, as applicable. Reference AC 23.1523, AC 25.1523-1, and AC 25-11, AC 27-1, or AC 29-2 for additional guidance, as applicable.
5.3.4.3 Any HUD installation or HUD display presentation must comply with the requirements found in §§ 23.2600(a), 25.773, 27.773, or 29.773, as applicable. Reference AC 23.1311-1, 25.773-1 and AC 25-11; or AC 27-1;
or AC 29-2 for additional guidance, as applicable.
5.3.4.4 Head Up Guidance systems may be considered fail passive if, after a failure, the aircraft's flight path does not experience a significant, immediate deviation due to the pilot following the failed guidance, before detecting the failure and discontinuing its use.
5.3.4.5 If an automatic flight control system is used to control the flight path of the aircraft prior to establishing manual "pilot-in-the-loop" HUD guidance on final approach, the transition from automatic to manual flight mode must be evaluated during the HUD demonstration, the automatic flight control system demonstration, or both demonstrations. One such example is when the aircraft uses the autoflight system to intercept and establish tracking of the final approach path.
5.3.4.6 During demonstration of any HUD intended for manual "pilot-in-the-loop" flight guidance for CAT III approach and landing, both landing cases and go-around cases should be demonstrated where:
• External visual reference is available at or below 50 ft. HAT to touchdown;
• External visual reference is not available at any time below 50 ft. HAT to touchdown, and, if applicable, is also not available for rollout;
• External visual references, HUD, and instrument references disagree
(e.g., LOC centering errors).
5.3.4.7 If rollout guidance is provided on the HUD, the HUD information must enable the pilot to safely control the aircraft along the runway after touchdown within the prescribed limits. Both normal tracking and any 5-29
AC 20-191 applicable non- normal capture or tracking conditions (e.g., recovery from displacements) should be assessed.
5.3.4.8 After touchdown, loss of a fail passive rollout system for manual control with guidance, must be annunciated with an appropriate visual alert and removal of the command guidance.
5.3.5 Hybrid HUD/Autoland Systems .
A hybrid HUD/autoland system combines a fail passive autoflight capability and a fail passive HUD to establish a fail operational system for CAT III operations. Equipping with two fail passive systems does not necessarily create a fail operational system. The applicant must meet the broader performance provisions of Chapter 5 as well as the specific criteria of this section to qualify your hybrid system as fail operational. The applicant can use the following guidance, or establish an acceptable means of compliance to qualify the hybrid system as fail operational:
5.3.5.1 Approach and Landing:
5.3.5.1.1 The applicant shows each system element independently meets its respective performance criteria for a fail passive system.
5.3.5.1.2 The automatic landing system must be the primary means of control, with the manual flight guidance system serving as a backup mode or reversionary mode.
5.3.5.1.3 Hybrid systems without automatic rollout capability must provide manual rollout flight guidance capability. The applicant must show the manual rollout capability has the performance and reliability at least equivalent to that required of a fail passive automatic rollout system.
5.3.5.1.4 The transition between auto matic mode of operation and manual mode of operation should not require extraordinary skill, training, or proficiency.
5.3.5.1.5 If the system requires a pilot to initiate manual control at or shortly after touchdown, the applicant must show the transition from automatic control prior to touchdown to manual control using the remaining element of the hybrid system (e.g., HUD) after touchdown is safe and reliable.
5.3.5.1.6 The applicant must demonstrate the capability of the pilot to use a hybrid system to safely accomplish the landing and rollout, following a failure of one of the hybrid system elements below AH even if operational procedures require the pilot to initiate a go-around.
5.3.5.1.7 The system must provide a ppropriate annunciations to the 5-30
AC 20-191 flight crew to en sure a safe operation.
5.3.5.1.8 The applicant must demonstrate the combined elements of the system meet the required fail operational criteria necessary to support the operation.
5.3.5.1.9 The applicant must show the overall system meets the accuracy, availability, and integrity criteria suitable for fail operational systems . The applicant must also show each component is individually reliable (e.g., a highly reliable automatic flight control system and an unreliable HUD would not be acceptable).
5.3.5.1.10 Hybrid System Transition from Automatic to Manual Flight.
The applicant must demonstrate a safe manual takeover of aircraft control to complete the landing within the established touchdown footprint. The demonstration should consider the use of appropriate takeover response time delays for the transition. The applicant must conduct t hese demonstrations in the following conditions:
• Without external visual reference,
• With visual reference, and
• With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).
5.3.5.2 Hybrid System Touchdown Capability.
5.3.5.2.1 Demonstrations are necessary for each element of the hybrid system for low altitude go-around, in the altitude ran ge between 50 ft. HAT to touchdown.
5.3.5.2.2 The applicant must conduct hybrid system demonstrations in the following conditions :
• Without external visual reference,
• With visual reference, and
• With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).
5.4 Landing and Rollout System Evaluation.
The applicant should conduct an evaluation to verify that the pertinent systems as installed in the aircraft meet the airworthiness criteria identified in section 5.2 of this 5-31
AC 20-191 chapter. The evaluation should include verification of landing and rollout system per formance and a system safety assessment for verification of the integrity and availability performance provisions. The applicant should demonstrate engine failure cases and other selected failure conditions identified by the safety assessment using simulator or flight tests or both.
5.4.1 Certification Plan.
An applicant should provide a certification plan that describes how any non-aircraft elements of the landing and rollout system relate to the aircraft system from a performance, integrity, and availability perspective.
5.4.1.1 The certification plan should describe the system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and performance provisions other than those contained in this AC are necessary.
5.4.1.2 The applicant should apply criteria contained in this AC, an equivalent foreign standard acceptable to the Administrator, or any other criteria acceptable to the Administrator for the landing and rollout system.
5.4.1.3 The safety level for automatic landing and rollout, or manual landing and rollout using command information as guidance, may not be less than that achieved by a conventional unguided manual landing using visual reference.
In showing compliance with the performance and failure criteria, the applicant may not factor the proportion of landings made with the landing and rollout system into the probabilities of performance or failure effects.
5.4.1.4 The applicant should establish the landing and rollout system performance considering the environmental and deterministic effects that the applicant expects to experience for the type of operation for which the applicant seeks certification and operational approval.
5.4.1.5 Command information provided as guidance during the landing and rollout should be consistent with a pilot’s manual technique and not require excessive skill or flight crew workload to accomplish the operation.
5.4.1.6 For those segments of the flight path where an applicant takes credit for non-automatic systems, the applicant must show acceptable performance of those systems for landing and rollout by reference to instruments alone without requiring the use of external visual reference. This performance 5-32
AC 20-191 demonstration is appropriate because the landing rollout may begin off cent erline and at higher speed.
5.4.1.7 When a system relies on the pilot to detect a selected mode engagement failure, and the pilot cannot reliably detect this failure by other means, the system must provide an appropriate indication or warning.
5.4.1.8 The transition from automatic control to manual control may not require exceptional piloting skill, alertness, or strength.
5.4.1.9 The applicant should show the means proposed to meet the airworthiness performance criteria of section 5.2, with particular attention to methods that differ significantly from those described in this chapter.
5.4.1.10 The assumptions on how the performance, integrity, and availability requirements of the non-aircraft elements will be ensured.
5.4.1.11 The applicant should reach early agreement with the FAA on the proposed certification plan.
5.4.2 Performance Evaluation.
The applicant must demonstrate the performance of the aircraft and its systems by either flight test or by analysis and simulator tests supported by flight test.
5.4.2.1 The performance evaluation must verify that the landing and rollout system meets the performance provisions of section 5.2.8, section 5.2.9, section
5.2.10, and section 5.2.13 in this chapter. The tests must cover:
• Range aircraft configurations, weight, center of gravity, etc.
• Variations in flight path determination associated with the sensors used by the landing and rollout system.
• A sufficient number of normal and non-normal approaches.
• Conditions which are reasonably representative of actual expected conditions. When evaluating performance in a range of wind conditions, applicants should use the wind model in Appendix B, or other model found acceptable by the Administrator.
5.4.2.2 The applicant must identify the reference speed used as the basis for certification. The applicant must demonstrate acceptable performance within a speed range of -5 to +10 knots with respect to the reference speed, unless otherwise agreed by the FAA and the applicant. The reference speed used as the basis for certification should be the same as the speed used for normal landing operations, including wind and other environmental conditions.
5.4.2.3 The applicant must demonstrate the landing and rollout system does not exhibit any guidance system or abnormal control characteristics during the 5-33
AC 20-191 transition to ro llout causing the flight crew to react in an inappropriate manner (e.g., during nose wheel touchdown, spoiler extension, initiation of reverse thrust).
5.4.2.4 Landing systems for manual control with guidance must meet the same performance provisions for touchdown footprints, sink rates, and attitude as automatic landing systems.
5.4.2.5 The applicant must d emonstrate satisfactory performance of landing and rollout system with and without the use of any outside visual references.
The applicant must determine whether the combination of guidance and outside visual references would unacceptably degrade task performance, require excessive pilot compensation or workload during normal and nonnormal operations.
5.4.2.6 For GLS, the applicant must assess fault free performance of GLS using simulations such as Monte-Carlo with the input variables distributed according to their performance characteristics and a model of the GLS guidance including fault free error characteristics defined by the GLS signal model as specified in 5.5.8 Appendix C or another equivalent model.
5.4.2.7 For low visibility systems for manual control with guidance, the applicant must demonstrate rollout guidance without external visual reference to show a pilot can satisfactorily perform the lateral tracking task with the guidance alone. The applicant must also demonstrate rollout guidance with external visual references to show the combination of guidance and visual reference is compatible and does not unacceptably degrade task performance, or require excessive pilot compensation or workload during normal and nonnormal operations.
5.4.2.8 For the evaluation of low visibility systems for manual control with guidance for landing or rollout, the set of subject pilots provided by the applicant should have relevant variability of experience (e.g., experience with or without HUD, Captain or First Officer flight crew position experience as applicable, and experience in type). Subject pilots must not typically have special experience that invalidates the test (e.g., pilots should not have special recent training to cope with HUD failures, beyond that which a line pilot would be expected to have for routine operation).
5.4.2.9 Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.
5.4.2.10 For the initial certification of a landing and rollout system for manual control with guidance (e.g., HUD guidance system) in a new type aircraft or new type HUD installation, at least 1,000 simulated landings and at least 100 actual aircraft landings are typically necessary. For evaluation of these systems, individual pilot performance should also be considered as a variable affecting performance, see section 5.2.9.9. As described in the 5-34
AC 20-191 section a bov e, subject pilots of varying background and experience level should be used in the flight and simulation programs. Subject pilots should have appropriate qualifications and, when applicable, be trained in the use of the landing system in a manner equivalent to that expected for pilots who will use the system in operational service.
5.4.2.11 For data collection tests, after a significant number of consecutive approaches (e.g., 10 approaches), subject pilots should be afforded the opportunity for an appropriate rest break.
5.4.3 High Altitude Automatic Landing System Demonstration.
5.4.3.1 The following describes an acceptable means to demonstrate performance of automatic landing systems at high altitude with a combination of flight test results and validated simulation. The highest airport elevation, at which satisfactory performance of an automatic landing system has been demonstrated by this method, should be documented in the AFM. The flight test demonstration is considered the primary data source, which can then be supplemented with data from a validated simulation.
5.4.3.2 The simulation and flight test demonstrations must show that the system successfully performs in accordance with the nominal landing criteria found in section 5.2.9.4 and section 5.2.9.5. When there are cases that do not satisfy the touchdown box criteria, and there is data to establish that these cases were the result of abnormal circumstances not related to system performance, then each of these cases must be successfully reaccomplished.
5.4.3.3 High altitude performance simulations should be conducted to verify that the guidance performs safely up to the altitude selected by the applicant.
The minimum required altitude or elevation for the flight test which is used to demonstrate a desired AFM Elevation Value, by this method, is shown in Figure 5-1, below. For example, the applicant may document an AFM Elevation Value of 8,000 ft., by a successful flight demonstration at 8,000 ft., or by a flight demonstration at a minimum elevation of 5,000 ft. with a simulation to the desired 8,000 ft. Note the lines in Figure 5-1 converge at 11,000 ft., which indicates that credit for simulation is not available at 11,000 ft. or above.
5.4.3.4 The atmospheric temperature and pressure during the flight test, for either method, should not be more favorable than International Standard Atmosphere (ISA) conditions to ensure the density altitude is not less than the airport elevation. When the density altitude value of the flight test is less than the airport elevation, then the density altitude value should be used as 5-35
AC 20-191 the effectiv e f light test demonstrated elevation and this will decrease the maximum AFM elevation value.
5.4.3.5 Assuring acceptable autoland performance at high altitude by using a flight test validated by simulation requires a sufficient quantity of flight test data.
Flight test data should be obtained from approximately 10-15 landings at a flight test demonstrated elevation shown in Figure 5-1.
5.4.3.6 For flight validation, the test aircraft should be equipped with instrumentation to measure and record:
5.4.3.6.1 The aircraft's trajectory, using an acceptably accurate method, such as by a Differential Global Positioning System (DGPS) receiver, a laser optical tracker, a calibrated camera, or other equivalent method.
5.4.3.6.2 Touchdown vertical velocity and runway touchdown point, expressed in suitable units and coordinates.
5.4.3.6.3 GS and LOC signal deviations.
5.4.3.6.4 Aircraft state parameters as necessary, including relevant engine and flight control information.
5.4.3.6.5 Relevant autopilot, autothrottle /autothrust or HUD guidance system parameters and perform ance or both.
5.4.3.6.6 Atmospheric conditions at the airport at the time of each approach, including temperature, barometric pressure (QNH), mean wind velocity, and direction.
5.4.3.7 The applicant should validate the simulation through comparison of simulation data with quantitative flight test measurements. The applicant should compare time histories of the aircraft and systems performance in the approach, flare, touchdown, rollout, and go-around flight phases, for flight tests at the Flight Test Demonstration Elevation with corresponding simulation results. The comparison between the flight test data and the simulation data should show the two are consistent at corresponding altitudes.
5.4.3.8 The applicant may determine acceptable autoland performance at the selected AFM elevation based on validated simulation results, within the acceptable extrapolation range for flight test data shown in Table 5-1. To assure acceptable autoland performance in a range of altitudes and atmospheric conditions up to and including the selected AFM elevation, the simulation should include variation in atmospheric conditions at least as listed below. The applicant should conduct a sensitivity analysis to assure 5-36