AC 20-191 applicable non- normal capture or tracking conditions (e.g., recovery from displacements) should be assessed.
5.3.4.8 After touchdown, loss of a fail passive rollout system for manual control with guidance, must be annunciated with an appropriate visual alert and removal of the command guidance.
5.3.5 Hybrid HUD/Autoland Systems .
A hybrid HUD/autoland system combines a fail passive autoflight capability and a fail passive HUD to establish a fail operational system for CAT III operations. Equipping with two fail passive systems does not necessarily create a fail operational system. The applicant must meet the broader performance provisions of Chapter 5 as well as the specific criteria of this section to qualify your hybrid system as fail operational. The applicant can use the following guidance, or establish an acceptable means of compliance to qualify the hybrid system as fail operational:
5.3.5.1 Approach and Landing:
5.3.5.1.1 The applicant shows each system element independently meets its respective performance criteria for a fail passive system.
5.3.5.1.2 The automatic landing system must be the primary means of control, with the manual flight guidance system serving as a backup mode or reversionary mode.
5.3.5.1.3 Hybrid systems without automatic rollout capability must provide manual rollout flight guidance capability. The applicant must show the manual rollout capability has the performance and reliability at least equivalent to that required of a fail passive automatic rollout system.
5.3.5.1.4 The transition between auto matic mode of operation and manual mode of operation should not require extraordinary skill, training, or proficiency.
5.3.5.1.5 If the system requires a pilot to initiate manual control at or shortly after touchdown, the applicant must show the transition from automatic control prior to touchdown to manual control using the remaining element of the hybrid system (e.g., HUD) after touchdown is safe and reliable.
5.3.5.1.6 The applicant must demonstrate the capability of the pilot to use a hybrid system to safely accomplish the landing and rollout, following a failure of one of the hybrid system elements below AH even if operational procedures require the pilot to initiate a go-around.
5.3.5.1.7 The system must provide a ppropriate annunciations to the 5-30
AC 20-191 flight crew to en sure a safe operation.
5.3.5.1.8 The applicant must demonstrate the combined elements of the system meet the required fail operational criteria necessary to support the operation.
5.3.5.1.9 The applicant must show the overall system meets the accuracy, availability, and integrity criteria suitable for fail operational systems . The applicant must also show each component is individually reliable (e.g., a highly reliable automatic flight control system and an unreliable HUD would not be acceptable).
5.3.5.1.10 Hybrid System Transition from Automatic to Manual Flight.
The applicant must demonstrate a safe manual takeover of aircraft control to complete the landing within the established touchdown footprint. The demonstration should consider the use of appropriate takeover response time delays for the transition. The applicant must conduct t hese demonstrations in the following conditions:
• Without external visual reference,
• With visual reference, and
• With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).
5.3.5.2 Hybrid System Touchdown Capability.
5.3.5.2.1 Demonstrations are necessary for each element of the hybrid system for low altitude go-around, in the altitude ran ge between 50 ft. HAT to touchdown.
5.3.5.2.2 The applicant must conduct hybrid system demonstrations in the following conditions :
• Without external visual reference,
• With visual reference, and
• With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).
5.4 Landing and Rollout System Evaluation.
The applicant should conduct an evaluation to verify that the pertinent systems as installed in the aircraft meet the airworthiness criteria identified in section 5.2 of this 5-31
AC 20-191 chapter. The evaluation should include verification of landing and rollout system per formance and a system safety assessment for verification of the integrity and availability performance provisions. The applicant should demonstrate engine failure cases and other selected failure conditions identified by the safety assessment using simulator or flight tests or both.
5.4.1 Certification Plan.
An applicant should provide a certification plan that describes how any non-aircraft elements of the landing and rollout system relate to the aircraft system from a performance, integrity, and availability perspective.
5.4.1.1 The certification plan should describe the system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and performance provisions other than those contained in this AC are necessary.
5.4.1.2 The applicant should apply criteria contained in this AC, an equivalent foreign standard acceptable to the Administrator, or any other criteria acceptable to the Administrator for the landing and rollout system.
5.4.1.3 The safety level for automatic landing and rollout, or manual landing and rollout using command information as guidance, may not be less than that achieved by a conventional unguided manual landing using visual reference.
In showing compliance with the performance and failure criteria, the applicant may not factor the proportion of landings made with the landing and rollout system into the probabilities of performance or failure effects.
5.4.1.4 The applicant should establish the landing and rollout system performance considering the environmental and deterministic effects that the applicant expects to experience for the type of operation for which the applicant seeks certification and operational approval.
5.4.1.5 Command information provided as guidance during the landing and rollout should be consistent with a pilot’s manual technique and not require excessive skill or flight crew workload to accomplish the operation.
5.4.1.6 For those segments of the flight path where an applicant takes credit for non-automatic systems, the applicant must show acceptable performance of those systems for landing and rollout by reference to instruments alone without requiring the use of external visual reference. This performance 5-32
AC 20-191 demonstration is appropriate because the landing rollout may begin off cent erline and at higher speed.
5.4.1.7 When a system relies on the pilot to detect a selected mode engagement failure, and the pilot cannot reliably detect this failure by other means, the system must provide an appropriate indication or warning.
5.4.1.8 The transition from automatic control to manual control may not require exceptional piloting skill, alertness, or strength.
5.4.1.9 The applicant should show the means proposed to meet the airworthiness performance criteria of section 5.2, with particular attention to methods that differ significantly from those described in this chapter.
5.4.1.10 The assumptions on how the performance, integrity, and availability requirements of the non-aircraft elements will be ensured.
5.4.1.11 The applicant should reach early agreement with the FAA on the proposed certification plan.
5.4.2 Performance Evaluation.
The applicant must demonstrate the performance of the aircraft and its systems by either flight test or by analysis and simulator tests supported by flight test.
5.4.2.1 The performance evaluation must verify that the landing and rollout system meets the performance provisions of section 5.2.8, section 5.2.9, section
5.2.10, and section 5.2.13 in this chapter. The tests must cover:
• Range aircraft configurations, weight, center of gravity, etc.
• Variations in flight path determination associated with the sensors used by the landing and rollout system.
• A sufficient number of normal and non-normal approaches.
• Conditions which are reasonably representative of actual expected conditions. When evaluating performance in a range of wind conditions, applicants should use the wind model in Appendix B, or other model found acceptable by the Administrator.
5.4.2.2 The applicant must identify the reference speed used as the basis for certification. The applicant must demonstrate acceptable performance within a speed range of -5 to +10 knots with respect to the reference speed, unless otherwise agreed by the FAA and the applicant. The reference speed used as the basis for certification should be the same as the speed used for normal landing operations, including wind and other environmental conditions.
5.4.2.3 The applicant must demonstrate the landing and rollout system does not exhibit any guidance system or abnormal control characteristics during the 5-33
AC 20-191 transition to ro llout causing the flight crew to react in an inappropriate manner (e.g., during nose wheel touchdown, spoiler extension, initiation of reverse thrust).
5.4.2.4 Landing systems for manual control with guidance must meet the same performance provisions for touchdown footprints, sink rates, and attitude as automatic landing systems.
5.4.2.5 The applicant must d emonstrate satisfactory performance of landing and rollout system with and without the use of any outside visual references.
The applicant must determine whether the combination of guidance and outside visual references would unacceptably degrade task performance, require excessive pilot compensation or workload during normal and nonnormal operations.
5.4.2.6 For GLS, the applicant must assess fault free performance of GLS using simulations such as Monte-Carlo with the input variables distributed according to their performance characteristics and a model of the GLS guidance including fault free error characteristics defined by the GLS signal model as specified in 5.5.8 Appendix C or another equivalent model.
5.4.2.7 For low visibility systems for manual control with guidance, the applicant must demonstrate rollout guidance without external visual reference to show a pilot can satisfactorily perform the lateral tracking task with the guidance alone. The applicant must also demonstrate rollout guidance with external visual references to show the combination of guidance and visual reference is compatible and does not unacceptably degrade task performance, or require excessive pilot compensation or workload during normal and nonnormal operations.
5.4.2.8 For the evaluation of low visibility systems for manual control with guidance for landing or rollout, the set of subject pilots provided by the applicant should have relevant variability of experience (e.g., experience with or without HUD, Captain or First Officer flight crew position experience as applicable, and experience in type). Subject pilots must not typically have special experience that invalidates the test (e.g., pilots should not have special recent training to cope with HUD failures, beyond that which a line pilot would be expected to have for routine operation).
5.4.2.9 Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.
5.4.2.10 For the initial certification of a landing and rollout system for manual control with guidance (e.g., HUD guidance system) in a new type aircraft or new type HUD installation, at least 1,000 simulated landings and at least 100 actual aircraft landings are typically necessary. For evaluation of these systems, individual pilot performance should also be considered as a variable affecting performance, see section 5.2.9.9. As described in the 5-34
AC 20-191 section a bov e, subject pilots of varying background and experience level should be used in the flight and simulation programs. Subject pilots should have appropriate qualifications and, when applicable, be trained in the use of the landing system in a manner equivalent to that expected for pilots who will use the system in operational service.
5.4.2.11 For data collection tests, after a significant number of consecutive approaches (e.g., 10 approaches), subject pilots should be afforded the opportunity for an appropriate rest break.
5.4.3 High Altitude Automatic Landing System Demonstration.
5.4.3.1 The following describes an acceptable means to demonstrate performance of automatic landing systems at high altitude with a combination of flight test results and validated simulation. The highest airport elevation, at which satisfactory performance of an automatic landing system has been demonstrated by this method, should be documented in the AFM. The flight test demonstration is considered the primary data source, which can then be supplemented with data from a validated simulation.
5.4.3.2 The simulation and flight test demonstrations must show that the system successfully performs in accordance with the nominal landing criteria found in section 5.2.9.4 and section 5.2.9.5. When there are cases that do not satisfy the touchdown box criteria, and there is data to establish that these cases were the result of abnormal circumstances not related to system performance, then each of these cases must be successfully reaccomplished.
5.4.3.3 High altitude performance simulations should be conducted to verify that the guidance performs safely up to the altitude selected by the applicant.
The minimum required altitude or elevation for the flight test which is used to demonstrate a desired AFM Elevation Value, by this method, is shown in Figure 5-1, below. For example, the applicant may document an AFM Elevation Value of 8,000 ft., by a successful flight demonstration at 8,000 ft., or by a flight demonstration at a minimum elevation of 5,000 ft. with a simulation to the desired 8,000 ft. Note the lines in Figure 5-1 converge at 11,000 ft., which indicates that credit for simulation is not available at 11,000 ft. or above.
5.4.3.4 The atmospheric temperature and pressure during the flight test, for either method, should not be more favorable than International Standard Atmosphere (ISA) conditions to ensure the density altitude is not less than the airport elevation. When the density altitude value of the flight test is less than the airport elevation, then the density altitude value should be used as 5-35
AC 20-191 the effectiv e f light test demonstrated elevation and this will decrease the maximum AFM elevation value.
5.4.3.5 Assuring acceptable autoland performance at high altitude by using a flight test validated by simulation requires a sufficient quantity of flight test data.
Flight test data should be obtained from approximately 10-15 landings at a flight test demonstrated elevation shown in Figure 5-1.
5.4.3.6 For flight validation, the test aircraft should be equipped with instrumentation to measure and record:
5.4.3.6.1 The aircraft's trajectory, using an acceptably accurate method, such as by a Differential Global Positioning System (DGPS) receiver, a laser optical tracker, a calibrated camera, or other equivalent method.
5.4.3.6.2 Touchdown vertical velocity and runway touchdown point, expressed in suitable units and coordinates.
5.4.3.6.3 GS and LOC signal deviations.
5.4.3.6.4 Aircraft state parameters as necessary, including relevant engine and flight control information.
5.4.3.6.5 Relevant autopilot, autothrottle /autothrust or HUD guidance system parameters and perform ance or both.
5.4.3.6.6 Atmospheric conditions at the airport at the time of each approach, including temperature, barometric pressure (QNH), mean wind velocity, and direction.
5.4.3.7 The applicant should validate the simulation through comparison of simulation data with quantitative flight test measurements. The applicant should compare time histories of the aircraft and systems performance in the approach, flare, touchdown, rollout, and go-around flight phases, for flight tests at the Flight Test Demonstration Elevation with corresponding simulation results. The comparison between the flight test data and the simulation data should show the two are consistent at corresponding altitudes.
5.4.3.8 The applicant may determine acceptable autoland performance at the selected AFM elevation based on validated simulation results, within the acceptable extrapolation range for flight test data shown in Table 5-1. To assure acceptable autoland performance in a range of altitudes and atmospheric conditions up to and including the selected AFM elevation, the simulation should include variation in atmospheric conditions at least as listed below. The applicant should conduct a sensitivity analysis to assure 5-36
AC 20-191 that pe rfor mance is safe near any limits. Unless otherwise found acceptable to the FAA, simulation cases should typically include the following:
5.4.3.8.1 Temperatures ranging from ISA value to ISA +40C.
5.4.3.8.2 Barometric pressure ranging from ISA value for that elevation to ISA -50 hPa.
5.4.3.8.3 Mean wind variations, including:
• Headwinds to at least 25 knots.
• Crosswinds to at least 15 knots.
• Tailwinds to at least 10 knots.
5-37
AC 20-191 Figure 5-1 AFM Elevation Value From Flight Test And Validated Simulation 14000 12000 AFM Elevation Value (ft.) 10000 8000 6000 AEM Elevation Value trated Elevation rest-Dem 4000 2000 2000 4000 6000 8000 10000 12000 14000 Flight Test Demonstrated Elevation (ft.)
5-38
AC 20-191 Table 5-1: Example AFM Elevation Values Flight Test Demonstration Airport Elevation (feet above mean sea level) Airport Elevation Value Which May Be Listed in the AFM (feet above mean sea level) 1,000 6,000 2,000 6,500 3,000 7,000 5,000 8,000 7,000 9,000 9,000 10,000 11,000 11,000
5.4.4 Validation of Simulators for Pilot-in-the-Loop Systems.
The certification process for a "Pilot-in-the-Loop" system intended for Category III typically requires use of a high-fidelity engineering quality simulation.
5.4.4.1 AC 120-40, as amended, and 14 CFR Part 60 provide a means to qualify simulators for qualification of pilots. Meeting these performance provisions provides a known basis for acceptance of simulation capability, and is desirable, but may not necessarily be sufficient to meet the performance threshold of an engineering simulation to demonstrate landing system performance.
5.4.4.2 Training simulators may not have suitable fidelity in each relevant area, and may not be acceptable for use without modification. For purposes of system airworthiness demonstration, meeting the criteria of AC 120-40 is optional.
Meeting the criteria of this AC provides an acceptable basis for establishing certification simulation capability.
5.4.4.3 When simulation is used for demonstration of manual "pilot-in-the-loop" systems with guidance, the applicant should address suitable simulation fidelity for at least each critical characteristic affecting the validity of the simulation. An acceptable simulation should typically be capable of varying one parameter at a time and be able to facilitate examination of the effects of 5-39
AC 20-191 specific wind, wind gradient, and turbulence conditions on approach and landing performance.
5.4.4.4 Factors of the simulation an applicant should consider include the following:
• Guidance and control system interfaces;
• Motion base suitability;
• "Ground effect" aerodynamic characteristics;
• Wind/turbulence model suitability and adequacy of interface with the simulation;
• Suitability of landing gear and ground handling dynamics;
• Adequacy of stability derivative estimates used;
• Adequacy of any simplification assumptions used for the equations of motion;
• Fidelity of flight controls and consequent simulated aircraft response to control inputs;
• Fidelity of the simulation of aircraft performance;
• Suitability of the simulation for alignment, flare, and rollout control tasks for any normal or non- normal configurations or disturbance conditions to be assessed;
• Adequacy of instruments and displays;
• Adequacy of simulator and display transient response to disturbances or failures (e.g., engine failure, autofeather, electrical bus switching);
• Visual reference availability, fidelity, and delays;
• Suitability of visibility restriction models such as appropriate calibration of visual references for the tests to be performed for day, night, and dusk conditions as necessary;
• Ability to simulate flight deck visual cutoff angles;
• Ability to simulate fog, rain, snow, or patchy or intermittent conditions or external visual runway, lighting, marking or nearby terrain scenes as necessary; and
• Fidelity of any other significant factor or limitation relevant to the validity of the simulation.
5.4.4.5 For airworthiness certification credit, a review of the simulation, on a caseby-case basis, must address at least the following factors:
• Simulation fidelity relevant to landing system assessment;
5-40
AC 20-191
• Stability derivatives, equation of motion assumptions, and relevant ground e ffect and air and ground dynamic models used;
• Adequacy of the source of aerodynamic performance and handling quality data used;
• Visual system fidelity and configuration;
• Environmental models and methods of model input to the equations of motion, including suitable incorporation of altitude and atmospheric temperature effects;
• Adequacy of adverse weather models (e.g., visual reference models, runway friction); and
• Adequacy of irregular terrain models.
5.4.4.6 A suitably high degree of fidelity is required in each relevant component part of the simulation including:
• Longitudinal, lateral and directional stability (static and dynamic);
• Ground effect during takeoff or landing as applicable;
• Rollout dynamic characteristics;
• Propulsion system characteristics, (especially for turbo-propeller aircraft which may have significant lift from thrust effects, and drag transient effects due to engine failure);
• Flying qualities;
• Display or visual system capability as it affects tracking tasks;
• Force characteristics of flight controls (e.g., yoke/wheel, rudder, brakes);
and
• Performance of the aircraft.
5.4.4.6.1 The applicant may demonstrate the fidelity of the simulator using matching time histories and ensemble touchdown footprint correlation obtained from flight test. The applicant will include the data provided to validate the simulation and the simulation data itself as part of the type certification data package.
5.4.5 Simulations for Automatic System Perf ormance Demonstration.
5.4.5.1 The certification process for systems intended for assessment of automatic systems for Category III operations (e.g., automatic landing systems, 5-41