Airworthiness Approval of Airborne Systems used for Takeoff, Precision Approach, Landing and Rollout in low-visibility conditions

AC 20-191 CHAPTER 1. GENERAL 1.1 Purpose.

1.1.1 This Advisory Circular (AC) provides guidance for the airworthiness approval of airborne systems used for takeoff, precision approach, landing, and rollout in low visibility conditions. You may use this guidance as a basis for Title 14 of the Code of Federal Regulations (14 CFR) Parts 23, 25, 27, and 29.

1.1.2 This AC provides criteria for an acceptable means of compliance with performance, integrity and availability criteria for low visibility takeoff, approach, landing, and rollout systems to accomplish takeoff, landing, and rollout in low-visibility conditions. The contents of the document do not have the force and effect of law and are not meant to bind the public in any way. This document is only intended to provide the public with information regarding existing requirements under the law or agency policies.

1.1.3 The applicant is responsible for regulatory compliance and should work closely with their applicable Certification Branch to ensure regulatory compliance. Mandatory terms such as “must” used in this AC are only applicable when following the compliance method outlined in this AC.

1.1.4 This is a guidance document. Its content is not legally binding in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance document is voluntary only. Nonconformity will not affect rights and obligations under existing statutes and regulations.

1.2 Audience.

This AC is for those applicants applying for an initial type certificate (TC), supplemental type certificate (STC), amended TC, or amended STC for the installation and airworthiness approval of airborne systems used for takeoff, precision approach, landing, and rollout in low visibility conditions.

1.3 Cancellation .

1.3.1 This AC updates and incorporates the airworthiness guidance formerly offered in AC 120-29A, Criteria for Approval of Category I and Category II Weather Minima for Approach, and AC 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout. This AC and AC 120-118, Criteria for Approval/Authorization of All Weather Operations (AWO) for Takeoff, Landing, and Rollout, cancel both AC 120-29A and AC 120-28D.

1.3.2 Aircraft types and systems approved previously to issuance of AC 120-29A, AC 120- 28D, or equivalent criteria remain valid. Applicants may continue to produce, install, 1-1 AC 20-191 and retrofit those systems in existing aircraft, new production aircraft, variants, or future derivatives of those types or variants; however, applicants seeking any additional credit permitted in this AC must meet the provisions of the applicable section in this AC. New airworthiness demonstrations should use the criteria in this AC.

1.3.3 Airworthiness demonstrations may use equivalent European Union Aviation Safety Agency (EASA) criteria as agreed upon by the FAA through the FAA/EASA criteria harmonization process.

1.4 Where to Find This AC.

You may find this AC at FAA Advisory Circulars or at Dynamic Regulatory System (DRS).

1.5 Related Materials See Chapter 2, section 2.4 for all materials related to this AC.

1.6 Definitions of Key Terms See Appendix A for terms and definitions that apply to this AC.

1-2

AC 20-191 CHAPTER 2. SCOPE 2.1 Introduction.

2.1.1 This AC provides an acceptable means of compliance for airworthiness criteria for the approval of aircraft to conduct takeoff in low-visibility conditions, and final approach, landing, and rollout in CAT II and CAT III weather minima. It includes equipment such as Head Up Displays (HUD), Ground Based Augmentation System (GBAS), Landing System (GLS), Instrument Landing System (ILS), and low-visibility takeoff guidance systems. This AC uses the generic term HUD to refer to HUD or any other equivalent display.

2.1.2 Criteria for operational approval for low-visibility takeoff and CAT II/III precision approach and landing as well as special authorization (SA) CAT 1 and SA CAT II are in AC 120-118.

Note: This AC does not provide airworthiness criteria for SA CAT I and SA CAT II.

2.2 Applicability. Explanation of Change.

This AC incorporates and revises the airworthiness criteria previously contained in AC 120-29A and AC 120-28D. This includes low-visibility takeoff and CAT II and CAT III precision approach, landing, and rollout using ILS and GBAS; and integrations that use multi-mode receivers supporting both ILS and GBAS.

2-1 AC 20-191 2.3 Contents of this AC.

2.3.1 Chapter 1 provides the purpose of this AC and other general information.

2.3.2 Chapter 2 provides general airworthiness criteria and references for low visibility takeoff, and CAT II and CAT III precision approach, landing, and rollout.

2.3.3 Chapter 3 provides airworthiness criteria for equipment used to conduct low-visibility takeoff operations.

2.3.4 Chapter 4 provides airworthiness criteria for equipment used to conduct CAT II precision approaches.

2.3.5 Chapter 5 provides airworthiness criteria for equipment used to conduct CAT III precision approaches.

2.3.6 Appendix A provides Acronyms and Definitions.

2.3.7 Appendix B provides Wind Models for Approach and Landing Simulation.

2.3.8 Appendix C provides a GBAS Performance Model for Approach and Landing Simulation.

2.3.9 Appendix D provides an Example Aircraft Flight Manual (AFM).

2.4 Related Regulations.

2.4.1 Title 14 of the Code of Federal Regulations (14 CFR).

Title 14 CFR parts and sections can be found at eCFR and on the DRS.

• Sections 21.3, 23.1529, 23.2135, 23.2220, 23.2500, 23.2510, 23.2600, 23.2605, 23.2610, 23.2620, 25.143, 25.473, 25.479, 25.773, 25.1309, 25.1322, 25.1329, 25.1523, 25.1529, 25.1581, 27.143, 27.473, 27.479, 27.1309, 27.1322, 27.1523, 27.1529, 27.1581, 29.143, 29.473, 29.479, 29.1309, 29.1322, 29.1523, 29.1529, 29.1581, and 135.385, • Parts 91, 121, 125, and 129.

2.4.2 Advisory Circulars.

Unless this AC makes a specific reference to a particular version of an AC, applicants should use the current editions of the following ACs. You can find the following ACs at FAA Advisory Circulars and on DRS.

• AC 23-8, Flight Test Guide for Certification of Part 23 Airplanes.

• AC 23-17, Systems and Equipment Guide for Certification of Part 23 Airplanes and Airships.

2-2 AC 20-191 • AC 23.1309-1, System Safety Analysis and Assessment for Part 23 Airplanes.

• AC 23.1311-1, Installation of Electronic Display in Part 23 Airplanes.

• AC 23.1523, Minimum Flight Crew.

• AC 25-7, Flight Test Guide for Certification of Transport Category Airplanes.

• AC 25-11, Electronic Flight Displays.

• AC 25.773-1, Pilot Compartment View Design Considerations.

• AC 25.1309-1, System Design and Analysis.

• AC 25.1322-1, Flightcrew Alerting.

• AC 25.1329-1, Approval of Flight Guidance Systems.

• AC 25.1523-1, Minimum Flightcrew.

• AC 27-1, Certification of Normal Category Rotorcraft.

• AC 29-2, Certification of Transport Category Rotorcraft.

• AC 120-40, Airplane Simulator Qualification.

• AC 120-118, Criteria for Approval/Authorization of All Weather Operations (AWO) for Takeoff, Landing, and Rollout.

2.4.3 Technical Standard Orders.

The following TSOs are related to this AC; you can find them on DRS.

• TSO-C34e, ILS Glide Slope Receiving Equipment Operating within the Radio Frequency Range of 328.6-335.4 Megahertz (MHz), 1/15/88.

• TSO-36e, Airborne ILS Localizer Receiving Equipment Operating within the Radio Frequency Range of 108-112 Megahertz (MHz), 1/25/88.

• TSO-C161b, Ground Based Augmentation System Positioning and Navigation Equipment, 12/17/2019.

• TSO-C162b, Ground Based Augmentation System Very High Frequency Data Broadcast Equipment, 12/17/2019.

2.4.4 Other Publications.

The following documents are related to this AC.

• European Union Aviation Safety Agency (EASA) AMC AWO 231, Flight Demonstration (Acceptable Means of Compliance) , available at EASA.

• RTCA DO-253D Change 1, Minimum Operational Performance Standards for GPS Local Area Augmentation System Airborne Equipment, June 27, 2019, available at RTCA.

2-3

AC 20-191 CHAPTER 3. TAKEOFF GUIDANCE SYSTEM 3.1 Introduction. This chapter provides an acceptable means of compliance for airworthiness approval criteria to conduct takeoff in low-visibility weather conditions.

This AC defines a low-visibility takeoff as a takeoff made when runway visibility is below the standard weather minima. Takeoff guidance equipment is required under this AC when visibility conditions alone are inadequate.

Note: Chapter 3 may not be applicable to 14 CFR Part 23 certificated airplanes operating under Part 91; applicants may apply Chapter 3 guidance during Part 23 certification.

3.1.2 Takeoff guidance systems include position sensors, cockpit displays, indicators, and controls as a minimum. The takeoff guidance system provides directional command display guidance to the pilot during takeoff and rejected takeoffs.

3.2 Airworthiness Criteria.

3.2.1 An approved takeoff guidance system must enable the pilot to track and maintain the runway centerline during takeoff from brake release to liftoff, or from brake release through deceleration to a stop for a rejected takeoff. In addition to enabling satisfactory centerline tracking during the takeoff roll, the system must enable the pilot to maintain ground track aligned with the runway heading through the transition to the appropriate mode for post takeoff climb. In addition to enabling satisfactory centerline tracking on the ground, the takeoff guidance system should also lead to a combination of the airplane’s position and track at the point of liftoff that would not result in significant deviations after liftoff. At the point of liftoff, the airplane track should neither be diverging from the runway centerline nor be at such an angle from the runway heading that would cause significant deviations during the climb. After liftoff, the takeoff guidance system must enable the pilot to detect divergence of the airplane’s track from the runway centerline, and at least to be able to arrest further deviation until the system transitions to the appropriate mode for post takeoff climb.

3.2.2 The applicant’s proposal for type certification approval for the equipment, system installations, and test methods should include factors such as the intended function of the installed system, its accuracy, reliability, and fail-safe features, as well as the operational concepts contained in AC 120-118.

3.2.3 The following sections identify the performance and workload provisions for the low- visibility takeoff roll through liftoff or for a rejected takeoff .

3.2.3.1 The FAA considers the entire takeoff operation, through completion of the en route climb configuration, an intensive phase of flight from an airworthiness perspective. The use of the takeoff system must not require exceptional skill, workload or pilot compensation. The takeoff guidance system must provide an appropriate transition from lateral takeoff guidance 3-1 AC 20-191 to en route climb guidance for a takeoff. It must also provide lateral guidance from brake release through deceleration to a stop for a rejected takeoff. The pilot must be able to continue the use of the same primary display(s) for the airborne portion as well as for the runway portion.

Changes in guidance modes and display formats must be automatic and apparent to the pilot regarding the guidance being utilized.

3.2.3.2 The applicant must show the relationship and interaction of the aircraft elements of the takeoff system with non-aircraft elements (e.g., ground station, satellites, etc.).

3.2.3.3 The applicant may establish the performance of the aircraft elements with reference to an approved flight path (e.g., localizer, GBAS lateral guidance) provided the budgeting between aircraft and non-aircraft elements does not compromise the overall performance.

3.2.3.4 When international standards exist for the performance and integrity aspects of any non-aircraft elements of the takeoff system, the applicant can assume member states of the International Civil Aviation Organization (ICAO) apply these standards.

3.2.3.5 When international standards do not exist for the performance and integrity aspects of any non-aircraft elements, the applicant must address these considerations as part of the airworthiness process. The applicant must provide a means to inform the operator of the limitations and assumptions necessary to ensure a safe operation.

3.2.3.6 Takeoff guidance system.

3.2.3.6.1 The applicant must evaluate the takeoff guidance system to ensure the performance is satisfactory for normal operations, aircraft failure cases (e.g., engine failure), and recovery from displacements from non-normal events. Guidance cues should be easy to follow and not increase workload significantly compared to the basic flight instruments. The applicant should not solicit any credit for performance improvements resulting from available visual cues.

3.2.3.6.2 The applicant must evaluate the takeoff guidance system displays to ensure that the pilot correctly interprets the display information to maintain the desired takeoff flight path. The applicant should evaluate the cockpit integration issues to ensure consistent operations and pilot response in all situations.

3.2.3.6.3 The system’s reference path is usually defined by the ILS localizer or other approved approach navigation aids (e.g., GBAS) that normally coincides with the runway centerline. As 3-2 AC 20-191 such, the applicant must demonstrate that the takeoff guidance system accounts for any differences, if any, between the runway centerline and the reference lateral path. The applicant should demonstrate compliance by flight test, or by a combination of flight test and simulation. Flight testing must cover those factors affecting the behavior of the aircraft (e.g., wind conditions, ILS characteristics, weight, center of gravity).

3.2.3.6.4 The applicant should demonstrate that when the airplane is displaced from the runway centerline at any point during the takeoff or rejected takeoff, including engine failure cases, the takeoff guidance system will allow the “pilot flying” (PF) to control the airplane smoothly back to the intended path in a controlled and predictable manner. Minor overshoot or oscillations around the centerline are permissible when not leading to unacceptable flight crew workload.

3.2.3.6.5 The applicant should use the performance envelope and conditions in Figure 3-1 for evaluating the takeoff guidance system.

• Takeoff with all engines operating, • Engine failure at or slightly after V1- continued takeoff*, • Engine failure just prior to V1- rejected takeoff *; and • Engine failure at a speed prior to VMCG – rejected takeoff (VFAILURE< VMCG)*.

*Wind and runway conditions consistent with basic aircraft takeoff performance demonstrations.

3-3 AC 20-191 Figure 3-1. Performance Envelope for Evaluating Takeoff System Command Guidance V 1 is takeoff decision speed V – speed at which failure occurs FAILURE V is Ground Minimum Control Speed MCG V LOF is Liftoff Speed Note 1: When showing compliance, the pilot may adjust the lateral flight path after liftoff to account for wind and drift effects.

Note 2: The 14m lateral region addresses tracking on the runway surface.

Note 3: The FAA expects the pilot to position the aircraft on the runway centerline.

Once on the runway, the takeoff guidance system should provide an indication to confirm proper operation.

Note 4: The lateral tracking criteria is referenced to the lateral offset of the aircraft’s centerline between the main landing gear (or aircraft center of gravity).

3.2.3.6.6 The system should have no characteristic making it difficult for a pilot to transition to a safe climb flight path, consistent 3-4 AC 20-191 with obstacle clearance for objects near the runway.

3.2.3.6.7 When demonstrating compliance, the applicant can take into consideration testing techniques such as normal pilot technique for responding to engine failure, application of rudder, maintaining safe bank angles, rotating to suitable pitch attitudes, and compensating for crosswind, as necessary.

3.2.3.6.8 When the rejected takeoff is the result of an engine failure, the actual performance should reflect the effects of a short-term increase in lateral deviation and then converge toward the centerline during the deceleration to a full stop.

3.2.3.6.9 During takeoff, the system must annunciate guidance signal loss to the flight crew.

3.2.3.6.10 The applicant should demonstrate the vertical axis guidance of the takeoff system during normal operation provides an appropriate pitch attitude and climb speed when considering the following factors.

• A normal rate of rotation to the commanded pitch attitude, at V R -10 knots for all engines operating and V R -5 knots for an engine-out condition, does not result in a tail-strike.

• Acquire a pitch attitude resulting in the capture and tracking of the All-Engine Takeoff Climb Speed, V 2 + X, where X is the All-Engine Speed Additive from the AFM (normally 10 knots or higher).

3.2.3.6.11 For engine-out operations, the applicant should demonstrate the takeoff guidance system provides commands to acquire a pitch attitude resulting in the capture and tracking of the following reference airspeeds.

• V , for engine failure at or below V . (The aircraft should 2 2 attain this speed after liftoff.)

• Airspeed at engine failure, for failures between V 2 and V 2 + X.

• V + X, for failures at or above V + X. Alternatively, the 2 2 applicant may use the airspeed at engine failure provided the system can achieve the minimum takeoff climb gradient at that speed.

3.2.3.6.12 The applicant should demonstrate the workload associated with the use of the takeoff system complies with the Handling Quality Rating System (HQRS) criteria in AC 25-7, Flight Test Guide for Certification of Transport Category Airplanes, 3-5 AC 20-191 as amended, or equivalent criteria for the type of aircraft. The takeoff guidance system should provide required tracking performance with “satisfactory” workload and pilot compensation, under foreseeable normal conditions. The takeoff guidance system may provide reduced (i.e., HQRS Rating Adequate) path tracking performance (e.g., up to 14m lateral deviation on the ground, ref. Figure 3-1) with adequate workload (i.e., heightened pilot effort and attention) during takeoffs with engine failures.

3.2.4 Integrity.

The applicant must demonstrate the takeoff guidance system provides command information as lateral guidance, which will enable maintaining the aircraft on the runway during the takeoff roll through acceleration to liftoff or, during a deceleration to a stop during a rejected takeoff.

3.2.4.1 The applicant must evaluate the design of the onboard components of the low-visibility system, separately and in relation to other systems, pursuant to 14 CFR Parts 23, 25, 27, and 29; and sections 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, and 29.1309, respectively, as applicable. The following criteria is provided for the application of§ 25.1309 to the takeoff guidance system: 3.2.4.1.1 The takeoff guidance system design should not possess characteristics, in normal operation or when failed, that would degrade takeoff safety or lead to a hazardous condition.

3.2.4.1.2 The probability of the takeoff guidance system generating misleading information that could lead to an unsafe condition must be improbable when the flight crew is alerted to the condition by suitable fault annunciation or by information from other independent sources available within the pilot's primary field of view. For airworthiness, the applicant must demonstrate the effectiveness of the fault annunciation or information from other independent sources. Any single failure of the aircraft that could impact the takeoff path (e.g., engine failure, single electrical generator or bus failure, single Inertial Reference Unit (IRU) failure) must not cause loss of guidance information or give incorrect guidance information.

3.2.4.1.3 The probability of the takeoff guidance system generating misleading information that would be unsafe to follow, must be extremely improbable, if: • No means are available for the takeoff system to detect and annunciate the failure, and • No information is provided to the pilot to immediately 3-6 AC 20-191 detect the malfunction and take corrective action.

3.2.4.1.4 ILS. The applicant must establish the aircraft system response to loss of ILS localizer transmitter. The applicant must also establish the aircraft system response during a switchover from an active localizer or to an optional backup transmitter.

3.2.4.1.5 GLS. The applicant must establish the aircraft system response to loss of GLS guidance signals.

3.2.4.2 In the event of a probable failure (e.g., engine failure, electrical source failure), if the pilot follows the takeoff display and disregards external visual references, if applicable, the aircraft performance must meet the criteria illustrated in Figure 3-1.

In showing system compliance, the applicant may not factor the proportion of takeoffs made in low visibility into the probabilities of performance or failure effects.

3.2.5 Information, Annunciation, and Alerting.

This section identifies information, annunciations, and alerting criteria for the takeoff guidance system. The design of the controls, indicators, and alerts must minimize crew errors that could cause a hazard. The takeoff guidance system must present the mode and system malfunction indications in a manner compatible with the procedures and assigned tasks of the flight crew. The takeoff guidance system must group the indications in a logical and consistent manner and ensure they are visible under all expected normal lighting conditions.

3.2.5.1 Compliance. The design of the Information, Annunciation, and Alerting HUD must comply with 14 CFR §§ 23.2605, 25.1322, 27.1322, or 29.1322 as applicable. Reference AC 23.1311-1, AC 25.1322-1, AC 27-1, or AC 29- 2 for additional guidance.

3.2.5.2 Annunciation. The applicant must demonstrate prior to initiating takeoff and during takeoff, the takeoff guidance system provides positive indications of the following information to the flight crew: • System status, • Modes of engagement and operation, and • Guidance source.

If pitch or speed or both guidance is also provided, the takeoff guidance system must detect and promptly announce to the pilot failures that would result in rotation at an unsafe speed, or an unsafe pitch rate or pitch angle.

3.2.5.3 Alerting.

The takeoff guidance system must alert the flight crew whenever a failure or 3-7 AC 20-191 condition prevents it from meeting the performance specified in sections 3.2.3 and 3.2.4. The removal of guidance alone is not adequate annunciation. Alerts must be timely, unambiguous, readily evident to each flight crew member, and compatible with the alerting philosophy of the airplane. Annunciations must be located to ensure rapid recognition and must not distract the pilot making the takeoff or significantly degrade the forward view.

3.2.5.3.1 Annunciations.During takeoff, whenever the takeoff guidance system does not provide valid guidance appropriate for the takeoff operation, it must clearly annunciate the failure to the flight crew, and the invalid guidance must be removed. The location of the annunciation must be positioned to ensure rapid recognition without distracting the pilot or significantly degrading the forward view.

3.2.5.3.2 Warnings.The takeoff guidance system must provide warnings for conditions requiring immediate pilot awareness and action (e.g., failure of the guidance system).

3.2.5.3.3 Cautions.The takeoff guidance system must provide cautions for conditions requiring immediate pilot awareness and possible subsequent pilot action. These alerts need not generate a Master Caution light that would be contrary to the takeoff alert inhibit philosophy. Caution annunciations should not cause flight crew distraction during takeoff roll.

3.2.5.3.4 Advisories.The takeoff guidance system must provide advisories for conditions requiring pilot awareness in a timely manner. It should not generate advisories after takeoff commences.

3.2.5.3.5 System Status.

The takeoff guidance system should provide a system status (e.g., status of built-in test equipment (BITE)/self-test).

3.2.6 Availability.

The probability of loss of takeoff guidance system should be remote.

3.3 Airborne Systems for Takeoff.

This section covers the criteria for a HUD that is integrated with ILS localizer or GBAS signals. In all cases, this AC assumes the sensors used for approach and landing will guide the aircraft during takeoff.

3-8 AC 20-191 3.3.1 HUD for Takeoff Guidance.

The following criteria apply if an applicant employs a HUD to provide takeoff guidance: 3.3.1.1 The workload associated with use of the HUD must comply with 14 CFR §§ 23.2610, 25.1523, 27.1523, or 29.1523 as applicable. Reference AC 23.1523 and AC 23.1311-1; AC 25.1523-1 and AC 25-11, AC 27-1; or AC 29-2 as applicable for additional guidance.

3.3.1.2 The HUD installation and display presentation must meet 14 CFR §§ 23.2600(a), 25.773, 27.773, or 29.773 as applicable. Reference AC 23.1311- 1; or AC 25.773 and AC 25-11, appendix F; or AC 27-1; or AC 29-2 for additional guidance.

3.3.1.3 For the entire takeoff path and for all normal and non-normal conditions, except loss of the HUD itself, the HUD takeoff system must provide acceptable guidance and flight information to enable the PF to complete the takeoff or abort the takeoff. HUD takeoff system use should not require excessive workload, exceptional skill, or excessive reference to other cockpit displays.

3.3.2 GBAS.

An applicant may use the guidance in this chapter to obtain airworthiness approval of a GBAS receiver for low visibility takeoff guidance. In addition, the applicant must evaluate the effect of loss and signal reacquisition during takeoffs.

3.4 Takeoff Guidance Evaluation.

An applicant should submit performance data for components used for takeoff guidance.

3.4.1 Certification Plan.

The applicant should provide a certification plan that includes a description of the aircraft systems, the certification basis, the certification methods, and compliance documentation. The certification plan should describe how any non-aircraft elements relate to the operation of aircraft systems from a performance, integrity, and availability perspective.

3.4.1.1 For ILS-based system elements, the applicant can predicate satisfaction of these performance provisions upon compliance with the ICAO Standards and Recommended Practices (SARPs), equivalent State standard, or by reference to an acceptable standard for performance of any navigation service.

3.4.1.2 For a Global Navigation Satellite System (GNSS) based system such as GBAS, the applicant can predicate satisfaction of these performance 3-9 AC 20-191 provisions upon compliance with either the ICAO SARPs, or equivalent State standards. The applicant should address any gaps or shortfalls in performance and how they relate to the aircraft system certification plan.

3.4.1.3 The certification plan should describe any new or novel system concepts or operational philosophy as applicable. The FAA will determine the need for additional criteria and provisions beyond this AC.

3.4.2 Performance Evaluation.

For new systems and any significant changes to an existing system, the applicant should demonstrate the performance of the aircraft and its systems by flight tests. Flight tests should include those maneuvers that are reasonably representative of actual expected conditions and should cover the range of parameters affecting the behavior of the aircraft (e.g., wind speed, ILS, or GBAS characteristics, aircraft configurations, weight, center of gravity, and non-normal events).

3.4.2.1 The performance evaluation should verify the takeoff guidance system meets the centerline tracking performance guidance specified in section 3.2.3.6.

3.4.2.2 The applicant should demonstrate the system performance in non-visual conditions for: • Normal operations, • Engine failure cases, and • Recovery from displacements from non-normal events.

3.4.2.3 The applicant should demonstrate this performance to have a satisfactory level of workload and pilot compensation. The methods defined in AC 25-7 or AC 23-8 are acceptable.

3.4.2.4 The applicant should show the takeoff guidance meets its stated performance criteria without the use of any outside visual references.

Note: The pilot may begin the takeoff using external visual reference, but from a speed no greater than 50% of V , the pilot should follow the guidance commands as accurately as possible without using the external view. The applicant may need to safely integrate a view limiting means during the demonstration.

3.4.2.5 The takeoff guidance system performance demonstration should comprise a sufficient number of takeoffs to show the system meets its intended function under any foreseeable operating conditions. The number of takeoffs specified below is adequate for this compliance demonstration. Note, however, the FAA may require more demonstrations depending on aircraft characteristics and design, or difficulties encountered during testing.

• Twenty (20) normal, all-engine takeoffs, 3-10 AC 20-191 • Ten (10) completed takeoffs, with simulated engine failure at or after the appropriate V FAILURE . The assessment must consider all critical cases, and • Ten (10) rejected takeoffs, some with simulated engine failure just prior to V , and at least one run with simulated engine failure at a speed less than V MCG .

Note 1: EASA’s AMC AWO 431 recommends a different number of takeoffs.

Note 2: An applicant may propose an alternate method of compliance in their certification plan or through issue paper. An example of an alternate method could be a reduced number of takeoffs for the takeoff guidance system performance demonstration with rationale for a reduction in flight- testing. Examples of rationale could include recognition for modeling and simulation testing done as part of the demonstration or a similar previously certified system with consistent flight test data.

3.4.2.6 The applicant may seek credit for an earlier demonstration of the takeoff guidance system. New testing of the aircraft may be necessary if the FAA deems credit for design similarity or performance is not appropriate. In cases where the aircraft’s performance dynamics associated with retarding the throttle to idle do not adequately simulate the dynamics of an engine failure, the FAA may require an actual engine shutdown.

3.4.2.7 The applicant should demonstrate the takeoff guidance system performance with headwinds for which credit is sought, and at least 150 percent of the tailwinds, and crosswinds for which credit is sought. Headwinds and crosswinds must be 15 knots or greater.

3.4.2.8 The applicant should demonstrate the operation does not exhibit any guidance or control characteristics that would cause the flight crew to react in an inappropriate or unsafe manner.

3.4.2.9 The demonstration aircraft should be configured with the appropriate instruments to record the time history of track with respect to the extended runway and the climb profile after liftoff to a reasonable point (e.g., departure end of the runway) as a means to show satisfactory performance.

3.4.2.10 The applicant should demonstrate no display or failure characteristics degrade the flight crew’s ability to adequately monitor takeoff performance.

Examples of takeoff performance parameters to monitor include acceleration, engine performance, takeoff speed callouts, attitude, and airspeed. The demonstration should include the entire takeoff, and transition 3-11 AC 20-191 to the enroute climb speed and configuration, for all normal, abnormal, and emergency situations.

3.4.2.11 The performance evaluation must demonstrate that the takeoff guidance system provides command information as lateral guidance, which will enable maintaining the aircraft on the runway during the takeoff roll through acceleration to liftoff or, during a deceleration to a stop during a rejected takeoff. The evaluation must also demonstrate the failure annunciation criteria of section 3.2.5, as well as the crew’s ability to immediately detect and mitigate non-annunciated failures.

3.4.2.12 The applicant should demonstrate the aircraft system response to loss of the takeoff guidance signal and appropriate annunciation to the flight crew.

3.4.2.13 Pilot Experience Levels. The applicant must demonstrate the takeoff guidance system meets the performance provisions in this chapter with pilots of varying experience levels.

3.4.2.14 Failure cases should typically be spontaneous and unpredictable on the subject’s or evaluation pilot’s part.

3.4.3 Safety Assessment.

In addition to any specific safety-related criteria identified in this chapter, the applicant must conduct a safety assessment of all aircraft’s takeoff system and associated components, considered separately and in conjunction with other systems, to show compliance with §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309 per the guidance contained in AC 23.1309-1, 25.1309-1, AC 27-1, or AC 29-2, respectively.

3.4.3.1 The applicant must consider the responses to failures of navigation facilities, taking into account pertinent criteria for navigation facilities.

3.4.3.2 The applicant’s documented safety analysis conclusions must include: 3.4.3.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, a Functional Hazard Assessment (FHA) conducted in accordance with AC 23.1309-1, AC 25.1309-1, AC 27-1, or AC 29-2, respectively; results summary from the fault tree analysis, demonstrated compliance, and probability determinations for significant functional hazards.

3.4.3.2.2 Information regarding “alleviating flight crew actions” considered in the safety analysis. This information should list appropriate alleviating actions and be consistent with the test validation. If alleviating actions are identified, the applicant should describe the alleviating actions in a form suitable to aid in developing: • Pertinent provisions of the Aircraft Flight Manual (AFM) 3-12 AC 20-191 procedures section(s) • Flight Crew Operating Manual (FCOM) provisions, or equivalent • Pilot qualification criteria (e.g., training requirements, Flight Standardization Board (FSB) provisions) • Any other reference material necessary for an operator or flight crew to use the system safely.

3.4.3.2.3 Information to support preparation of any maintenance and preventive maintenance procedures necessary for safety, such as: • Certification Maintenance Requirements (CMR), • Periodic checks, or • Other checks, as necessary (e.g., return to service).

3.4.3.2.4 Information applicable to limitations, as necessary.

3.4.3.2.5 Information necessary for development of Non-normal Procedures.

3.5 AFM.

Pursuant to 14 CFR §§ 23.1581, 25.1581, 27.1581, or 29.1581, as applicable, an applicant must furnish AFM with each aircraft. The AFM should contain the following information: 3.5.1 The criteria and configurations used for the takeoff system demonstration.

3.5.2 Any constraints or limitations necessary for safe operation.

3.5.3 Acceptable normal and non-normal procedures.

3.5.4 The type of navigation facilities used as a basis for certification. This should not be taken as a limitation on the use of other facilities. The AFM may contain a statement regarding the type of facilities or conditions known to be unacceptable for use (e.g., ILS localizer or GLS).

3.5.5 Applicable atmospheric conditions under which the system was demonstrated (e.g., headwind, crosswind, tailwind).

3.5.6 All necessary performance, procedure, or configuration data to permit an operator to determine climb gradient and transition distances for safe obstacle clearance during a takeoff operation; Note that this information need not be specifically included in the AFM if it is available to the operator using some other method acceptable to the 3-13 AC 20-191 operator and manufacturer (e.g., Flight Crew Operating Manual (FCOM), supplementary performance information, separate AFM appendix).

3.5.7 For a takeoff system meeting the provisions of this chapter, the Normal Procedures, Normal Operations, or equivalent section, of the AFM should also contain the following statements: • “The airborne system has been demonstrated to meet the airworthiness guidance of AC 20-191 (Chapter 3) for [specify the pertinent takeoff capability section(s) criteria met] when the following equipment is installed and operative:” • “[list pertinent equipment]” • “This AFM provision does not constitute operational approval for low visibility takeoff use of the system.” 3-14

AC 20-191 CHAPTER 4. CATEGORY (CAT) II 4.1 Introduction.

4.1.1 This chapter contains airworthiness approval criteria for equipment used to conduct a CAT II weather minima approach using certain radio navigation aids (navaids) such as ILS or GBAS. This chapter does not provide criteria for each potential combination of aircraft and non-aircraft elements.

4.1.2 This chapter addresses the approach phase of flight, beginning at the Final Approach Fix (FAF) and ending at the CAT II Decision Height (DH).

4.1.3 ICAO Annex 10 includes standards for ILS, MLS, and GBAS intended to support CAT II operations. This chapter addresses approval of equipment for operations using either ILS class (II/D/2) or better performance or GBAS facility classification (D/G1/any/any ). This chapter addresses ILS avionics with Technical Standard Order (TSO)-C34e, TSO-C36e authorization, and GBAS avionics with the latest TSO- C161b and TSO-C162b authorization.

Note 1: While the airworthiness criteria for the guidance system for the approach and landing system applies from the FAF to the DH, guidance should be available down to half the DH.

Note 2: GBAS approach service volume is defined in ICAO Annex 10 Amendment 91.

4.1.4 The standards for GBAS (RTCA DO-253D Change 1 and ICAO Annex 10) define two general classes of GBAS service, Approach Services and the GBAS Positioning Service. The standards further differentiate GBAS approach services into multiple types referred to as GBAS Approach Service Types (GAST). A GAST is defined as the matched set of airborne and ground performance and functional requirements intended to be used in concert to provide approach guidance with quantifiable performance.

4.1.5 GBAS GAST C is the approved GBAS to support CAT I level of service. Applicants for CAT II airworthiness approvals typically seek approval through GBAS GAST D level of service using GBAS airborne equipment class (GAEC) D. Applicants seeking CAT II airworthiness approval using GAST C and GAEC C avionics with TSO- C161b and TSO-C162b authorization need to show equivalence to performance achieved with ILS II/D/2 with additional criteria, limitations, and exceptions as RTCA DO-253D Change 1, appendix I, contains a detailed discussion of approach service types, facility classification and airborne equipment classification for GBAS.

4-1 AC 20-191 determined by the FAA.

4.2 Airworthiness Criteria.

4.2.1 Airborne Equipment.

Airborne equipment meeting the airworthiness criteria contained in this chapter for the CAT II landing system satisfy the operational requirements of CAT II ILS found in AC 120-118. The basic airworthiness criteria rely on meeting the specific airworthiness performance provisions and are independent of the specific implementation in the aircraft or the type of approach system selected for the approach.

4.2.2 Applicant’s Proposal.

The applicant’s proposal for type certification approval for the equipment, system installations, and test methods should include factors such as the intended function of the installed system, its accuracy, reliability, and fail-safe features.

4.2.3 Intended Flight Path.

The applicant may establish the intended flight path in a number of ways, for example using a navigation aid (e.g., ILS, GBAS, etc.). Other methods may be acceptable if the applicant can show feasibility through other means (e.g., sensing of the runway environment such as surface, lighting or markings or both with a vision enhancement system).

4.2.4 Onboard Navigation Systems.

Onboard navigation systems may have various sensor elements by which to determine the aircraft’s position. The sensor elements may include ILS, GBAS, or inertial information. Each of these sensor elements must perform within its appropriate limitations with regard to accuracy, integrity, and availability.

4.2.5 Indications.

The system must provide indications of the aircraft position with respect to the intended flight path. A list of accepted means of providing these indications to the pilot includes: • Deviation displays with reference to navigation source (e.g., ILS receiver, GLS receiver, etc.)

• Onboard navigation system computations with corresponding displays of position and reference path • Vision enhancement system, if applicable.

4.2.6 Approach System Accuracy Criteria.

The criteria for acceptable approach performance are based upon acquiring and tracking the required flight path to the appropriate approach procedure’s minimum altitude. The acquisition should be accomplished in a manner compatible with instrument procedure requirements and flight crew requirements for the type of approach being conducted.

4-2 AC 20-191 4.2.6.1 Approach Guidance System.

The approach guidance system must not generate sustained oscillatory command information (e.g., flight director, HUD, etc.) or require unusual effort by the pilot to control the flight path.

4.2.6.2 Lateral and Vertical Tracking Performance.

The applicant must show the system will meet the following performance.

4.2.6.2.1 Lateral tracking performance from 1000 ft. Height Above Touchdown (HAT) to 300 ft. HAT will be stable without large deviations (i.e., within ±50 microamps deviation or equivalent) from the indicated course or path.

4.2.6.2.2 Lateral tracking performance from 300 ft. (HAT) down to 100 ft. HAT will be stable without large deviations (i.e., within ±25 microamps deviation) from the indicated course, for 95% of the time.

4.2.6.2.3 Vertical tracking from 700 ft. HAT to 300 ft. HAT should be stable without large deviations (i.e., within ±75 microamps deviation or equivalent) from the indicated course or path.

4.2.6.2.4 Vertical tracking performance from 300 ft. HAT down to 100 ft. HAT will be stable without large deviations (i.e., within ±35 microamps deviation) from the indicated path or ±12 ft., whichever is greater, for 95% of the time. When applying this provision to path tracking in conjunction with CAT III, momentary excursions up to ±75 microamps during test demonstrations may be acceptable if the applicant shows satisfactory performance of the flight guidance system through touchdown and landing.

Note: The performance standards for ILS or GBAS GAST D signal in space contained in ICAO SARPs Annex 10, or an equivalent State standard, are acceptable standards for operations based on an ILS or GBAS, respectively.

4.2.7 Approach System Integrity Criteria.

Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the onboard components of the landing system, when considered separately and in relation to other associated onboard systems, must consider all specific safety related criteria identified in this AC, or as identified in accordance with the operating rules. The applicant can use the following criteria as advisory material for the application of §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309 to Approach and Landing Systems: 4.2.7.1 ILS.

The applicant must establish the aircraft system response to loss of ILS 4-3 AC 20-191 guidance signals (localizer (LOC) or glideslope (GS)). The applicant must also establish the aircraft system response during a switchover from an active LOC or GS transmitter to an optional backup transmitter.

4.2.7.2 GLS.

The applicant must establish the aircraft system response to loss of GLS guidance signals.

4.2.7.2.1 When using GBAS, the required flight path is uplinked to the aircraft after the approach has been selected. This path will be used for flight guidance or the autopilot or both when required to conduct an approach, landing, and rollout.

4.2.7.2.2 Corruption of the information contained in the received VHF Data Broadcast (VDB) to define the reference path is hazardous. Failure resulting in undetected changes to the approach path definitions data must be extremely remote.

4.2.7.2.3 The flight crew must not be able to modify information that relates to the critical definition of required flight path.

4.2.8 Approach System Continuity Criteria.

The applicant should verify the continuity of navigation during normal aircraft maneuvering while in approach. For GLS, this includes verifying VDB signal reception at all angles relative to the airframe, as the GBAS facility could be located anywhere with respect to the approach path.

4.2.9 Approach System Availability Criteria.

While on approach below 500 ft., the demonstrated probability of a successful landing should be at least 95% (i.e., no more than 5% of the approaches result in a go-around due to the combination of failures in the landing system and the incidence of unsatisfactory performance).

4.2.10 Go-around.

4.2.10.1 Go-Around Safety.

An aircraft conducting a CAT II instrument approach must be capable of safely executing a go-around from any point in an approach prior to touchdown with the aircraft in a normal configuration or specified non- normal configurations (e.g., engine out for multiengine aircraft).

4.2.10.1.1 A go-around should not require unusual pilot skill, alertness, or strength.

4.2.10.1.2 The system should have information indicating the availability of a safe go-around flight path.

4-4 AC 20-191 4.2.11 Information, Annunciation, and Alerting.

This section identifies the provisions for information, annunciations, and alerting.

4.2.11.1 Compliance.

The design of the Information, Annunciation, and Alerting must comply with §§ 23.2605, 25.1322, 27.1322, or 29.1322 as applicable. Reference AC 23.1311-1, AC 25.1322, AC 27-1, or AC 29-2 for additional guidance.

4.2.11.2 Information guidance .

This section identifies criteria for basic situational and guidance information.

4.2.11.2.1 The system must present the mode and system malfunction indications in a manner consistent with the human factors cockpit design philosophy. The indications must be grouped in a logical and consistent manner and be visible under all expected normal lighting conditions.

4.2.11.2.2 For manual control of approach flight path, the appropriate flight display(s), whether head down (HDD) or HUD, must provide sufficient information, without excessive reference to other cockpit displays, to enable a suitably trained pilot to: • Maintain the approach path, • Make the alignment with the runway, and if applicable, safely flare and roll out, or • Go-around.

4.2.11.2.3 The information provided along with any additional information necessary to the design of the system must be sufficient to allow the pilots to monitor the progress and safety of the approach operation.

4.2.11.2.4 The system must have flight performance monitoring to include at least the following: • Unambiguous identification of the intended path for the approach, and, if applicable, flare and roll-out, (e.g., ILS approach identifier/frequency, and selected navigation source, GBAS Runway Path Identifier (RPI), approach service type, etc.).

• Indication of the position of the aircraft with respect to the intended path (e.g., raw data localizer and glide path, deviation from FAS or equivalent).

4.2.11.3 Annunciation.

The system should provide a positive, continuous, and unambiguous 4-5 AC 20-191 indication for the modes in operation, as well as those armed for engagement. In addition, where mode engagement is automatic (e.g., LOC and glide path acquisition), the system must provide a clear indication when the mode has been armed by either crew action, or automatically by the system itself (e.g., a pre-land test annunciating LAND 3).

4.2.11.4 Alerting.

Alerting is intended to address the need for warning, caution, and advisory information for the flight crew.

4.2.11.4.1 Warnings.

ACs 23-8, 23-17, 23.1309-1, 23.1311-1, 25.1309-1, 25-1322-1, 27.7, and 29-2 provides an acceptable means for the system to provide information to alert the flight crew to unsafe system operating conditions and to enable the flight crew to take appropriate corrective action. The system must provide a warning indication for any condition requiring the flight crew to take immediate corrective action. The system design should account for flight crew alerting cues, corrective action required, and the capability of detecting faults.

4.2.11.4.2 Cautions.

The system must provide a caution for any condition requiring immediate flight crew awareness and timely subsequent action.

The system must provide a means to advise the flight crew of failed aircraft system elements affecting the decision to continue or discontinue the approach.

4.2.11.4.3 Advisories.

The system must provide a means to inform the flight crew when the aircraft has reached the Alert Height (AH) or DH, as applicable, requiring pilot awareness in a timely manner. It should not generate advisories after takeoff commences.

4.2.11.4.4 Excessive-Deviation Alerting.

The FAA does not require excessive-deviation alerting but will approve systems that meet appropriate criteria (e.g., EASA CS- AWO.B.CATII.115).

4.2.11.4.5 Excessive-Deviation Alerting Method of Compliance.

Meeting EASA CS-AWO.B.CATII.115 criteria are an acceptable means of compliance for airworthiness approval.

4.2.11.4.6 System Status.

The system should provide a means for the operator and flight crew to determine prior to departure and the flight crew to 4-6 AC 20-191 determine after departure, the capability of the aircraft elements to accomplish the intended approach.

4.2.11.4.7 System Identification.

The system should identify system status indications by names that are different than operational authorization categories (e.g., do not use names such as “CAT I,” “CAT II,” “CAT III”).

4.2.12 Multiple Landing Systems and Multi-Mode Receivers (MMR) for CAT II.

Multiple landing systems typically consist of one or more MMRs that are capable of providing navigation information for ILS, GLS, or other combinations of landing sensor systems. The MMR characteristics should be consistent with applicable related ARINC characteristics for MMRs.

4.2.12.1 Approach Procedure.

From the pilot’s perspective, the approach procedure should be the same regardless of the navigation source being used.

4.2.12.2 MMR.

The MMR must provide a means to confirm that the intended approach aid(s) was correctly selected (e.g., the current ILS audio identification, GLS Reference Path Data Selector (RPDS)).

4.2.12.3 Indications.

The MMR must indicate the loss of deviation data on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.

4.2.12.4 Annunciations.

The following criteria apply to annunciations when using a multi-mode approach system: 4.2.12.4.1 The MMR must positively indicate the navigation source (e.g., ILS, GLS, FMS) selected for the approach in the primary field of view at each pilot station.

4.2.12.4.2 The MMR must indicate the data designating the approach (e.g., ILS frequency, GLS channel number) in a position readily accessible and visible to each pilot.

4.2.12.4.3 The MMR should use a common set of mode ARM and ACTIVE indications (e.g., LOC and GS) for ILS and GLS operations. ARM mode indicates the MMR is ready and waiting to capture the signal while ACTIVE mode indicates the MMR is currently operating in that specific navigation mode.

4-7 AC 20-191 4.2.12.4.4 The MMR must provide a means for the flight crew to determine a failure of the non-selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with the navigation source. For example, it would not be acceptable for the annunciation “ILS FAIL” to be displayed when the selected navigation source is GLS, and the failure actually affects the GLS receiver.

4.2.12.4.5 Outside the approach phase, the MMR should have the capability to indicate a failure of each element of a multi- mode approach and landing system as an advisory to the flight crew without pilot action.

4.2.12.4.6 During an approach, a failure of the active element of a multi-mode approach and landing system must be accompanied by a warning, caution, or advisory.

4.2.13 Multi-Mode Receivers This section provides guidance for MMRs used for CAT II for retrofit certifications, and for certification of ILS installations with either new or modified receivers.

4.2.13.1 Retrofit Considerations.

4.2.13.1.1 Typical receiver configurations for retrofit applications include: • An ILS receiver from a new supplier • A modified ILS receiver from the same supplier (e.g., for purposes of providing improved Frequency Modulation (FM) Immunity) • A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment) • A stand-alone GLS receiver • A GLS partition in an MMR 4.2.13.1.2 General certification considerations include: • Certification Process. An “impact assessment” should address all new receiver functionality considering: o Differences between the current certification basis and that which is requested, if applicable.

o The functionality being added 4-8 AC 20-191 o Credit that can be taken for the existing approval • Equipment Approval. The applicant must follow 14 CFR Part 21, subpart O, to obtain a TSO authorization where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.

• Aircraft installation approval should consider the following: o Impact on aircraft system safety assessments o Equipment approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna) o Electromagnetic Interference (EMI)/Electromagnetic Compatibility (EMC) testing o Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays o Electrical loading o Flight data recorder requirements o Suitable AFM provisions o Certification means of compliance for the receiver installation (e.g., specification of ground or flight testing or both, as necessary) 4.2.13.2 Re-certification.

Re-certification of an ILS function following the Introduction of a new or modified ILS navigation receiver installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. The applicant may use an impact assessment to establish a certification basis. The assessment will typically address the following: 4.2.13.2.1 New or Modified ILS Impact Assessment.

An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration: • Hardware design • Software design • Signal processing and functional performance • Failure analysis • Receiver function, installation, and integration (e.g., with controls, indicators, and warnings) 4-9 AC 20-191 The impact assessment should also identify any additional considerations such as: • Future functionality provisions that have no impact on system operation • Shared resources to support future functionality • Based upon the assumption that the applicant can show the ILS receiver, or receiver function, to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver (replacing the existing receiver) for installation on a given aircraft type 4.2.13.2.2 New or Modified ILS Failure Analysis.The failure characteristics of the new or modified installation should be shown to be equivalent to systems using ILS data. This ensures the failure characteristics are compatible and do not invalidate any original or previous safety assessments.

4.2.13.2.3 New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary).

For systems using a new ILS, or combined MMR receiver, complete a minimum of eight (8) approaches terminating in a successful (automatic or HUD) landing, and rollout (if applicable) using the flight control/guidance system, including a minimum of two (2) ILS facilities. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical Instrument Approach Procedures (IAPs), and, if applicable, from below and above the GS.

4.2.13.2.4 Approach and Landing Performance.

The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) is equivalent to that achieved in the original ILS certification.

The FAA may require recorded flight test data to support equivalency demonstration.

4.2.13.2.5 New or Modified ILS Documentation.

The applicant should provide the following documentation for certification: • An impact assessment including effects on system safety assessments.

• A flight test report, if applicable.

• Revisions to the flight manual where appropriate.

4-10 AC 20-191 4.2.13.3 Re-certification Following the Introduction of a GLS Navigation Receiver Installation.

4.2.13.3.1 GLS Introduction Impact Assessment.

The impact assessment, if applicable, should assess equivalent aspects of the GLS receiver or receiver function to those for the existing ILS receiver configuration.

4.2.13.3.2 GLS Aircraft Integration/Installation Failure Mode and Effects Analysis.

The applicant should review the failure characteristics of the new or modified installation to ensure that the failure characteristics do not invalidate any original or previous safety assessments.

4.2.13.3.3 GLS Statistical Performance Assessment.

If the flight control/guidance system control algorithms are unchanged, or the applicant has already accounted for the effects of any changes (e.g., navigation reference point), the applicant may not have to re-assess the statistical performance of a currently certificated automatic landing system, HUD landing/takeoff system for the addition of GLS functionality.

4.2.13.3.4 GLS Antenna or Navigation Reference Point Location.

The applicant should assess the implication of differences in position of the GLS and ILS aircraft antennas or Navigation Reference Point considering: • Wheel-to-threshold crossing height.

• Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).

4.2.13.3.5 GLS Introduction Flight Testing.

When installing a new GLS system to support CAT II operation, the applicant must accomplish a flight test program including a minimum of 10 approaches.

• The approaches must terminate in a landing (and rollout, if applicable) using the flight control/guidance system, and the approaches must include a minimum of two GLS facilities for each system.

• The approaches should include captures from both sides of the final approach course using representative angles and distances. Approaches should include captures from below 4-11 AC 20-191 and above the glidepath if applicable, and representative wind conditions where antenna or navigation reference point positions may impact performance.

4.2.13.3.6 Approach and Landing Performance.

The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) is equivalent to the original ILS certification. The FAA may require recorded flight test data to confirm equivalency.

4.2.13.3.7 New or Modified ILS Documentation.

The applicant should provide the following documentation for GLS: • An impact assessment including effects on system safety assessments • A flight test report, if applicable; and • Revisions to the flight manual where appropriate.

4.3 Airborne Systems for CAT II Operations.

This section identifies criteria applicable to specific aircraft system architecture selected to conduct CAT II.

4.3.1 General.

Applicable aircraft systems should comply with the basic performance, integrity, and availability criteria as identified in section 4.2 of this Chapter.

4.3.2 Autopilot.

The following criteria apply to autopilot systems: 4.3.2.1 The suitability of pertinent autopilot modes or features applicable to conducting or monitoring an approach, landing, rollout, or go around, as applicable, should follow the principles/guidance contained in ACs 23-8, 23-17, 25.1329-1, 27-1 and 29-2 as applicable.

4.3.2.2 The autopilot must not cause undue flight crew concern and lead to disconnect (e.g., inappropriate response to ILS beam disturbances or turbulence, inappropriate response to temporary loss of VDB signals, unnecessarily abrupt flare or go-around attitude changes, unusual or inappropriate pitch or bank attitudes, or sideslip response).

4.3.2.3 Regarding control of approach flight path, the autopilot must: • Maintain the approach path • If applicable, make the alignment with the runway, flare, and land the 4-12 AC 20-191 aircraft within the prescribed limits • If applicable, promptly go-around, with minimum practical altitude loss 4.3.2.4 Autopilot performance must be compatible with either manual speed control, or, if applicable, autothrottle/autothrust speed control.

4.3.2.5 Mode definition and logic should be consistent with appropriate industry practice for mode identification and use (e.g., naming, mode arming, and engagement). Definition of new modes or features, not otherwise commonly used, should be consistent with their intended function, and the applicant should consider their potential for setting inappropriate or adverse precedent.

4.3.2.6 If the autopilot is used to control the flight path of the aircraft to intercept and establish the approach path, the pilot should be able to transition from automatic to manual flight at any time without undue effort, attention, or control forces, and with a minimum of disturbance of flight path.

4.3.2.7 A flight director system, or alternative form of guidance, if used, must be compatible with the autopilot.

4.3.2.8 The FAA recommends at least one autopilot and dual flight director systems with an independent display for each pilot. Dual guidance systems providing the same information to both pilots may be acceptable only if suitable comparison monitoring between the systems is available, and timely transfer to the standby system can be completed, and suitable annunciation to the flight crew is provided.

4.3.2.9 A fault must cause an autopilot advisory, caution, or warning, as necessary.

If a warning is necessary, the pilot must be able to detect the warning with a normal level of attention and alertness expected during an approach or go- around.

4-13 AC 20-191 4.3.3 Head Down Guidance . The following criteria applies to Head Down Guidance systems: 4.3.3.1 A flight director system, or alternative form of guidance, must be designed so that the probability of display of incorrect guidance commands is remote.

4.3.3.2 Wherever practical, a fault must cause guidance information to be immediately removed from view. If a warning is given instead, it must be such that the pilot will observe the warning while using the guidance information.

4.3.4 Head Up Guidance.

If the system includes a HUD, the following criteria are applicable to Head Up Guidance systems: 4.3.4.1 The workload associated with use of the HUD must comply with 14 CFR §§ 23.2610, 25.1523, 27.1523, or 29.1523. Reference AC 23.1523, AC 25.1523-1 and AC 25-11, AC 27-1, or AC 29-2 as applicable for additional guidance.

4.3.4.2 The HUD installation and display presentation must meet 14 CFR §§ 23.2600(a), 25.773, 27.773, or 29.773, as applicable. Reference AC 23.1311-1, AC 25.773 and AC 25-11, appendix F; or AC 27-1 or AC 29-2 for additional guidance.

4.3.4.3 If the autopilot is used to control the flight path of the aircraft to intercept and establish the approach path, the point during the approach at which the transition from automatic to manual flight takes place must be identified and used for the performance demonstration.

4.3.4.4 A flight director system, or alternative form of guidance, must be designed so that the probability of display of incorrect guidance commands is remote.

4.3.5 HUD use to monitor autoflight systems.

The HUD must be compatible with the autoflight system and permit the pilot to detect unsuitable autopilot performance.

4.3.6 Autothrottle/Autothrust.

4.3.6.1 If autothrottle/autothrust capability is installed, the applicant should identify any necessary modes, conditions, procedures, or constraints that apply to its use.

4.3.6.2 Use of the autothrottle/autothrust should not cause unacceptable performance of any autopilot modes intended for use. And any autopilot 4-14 AC 20-191 mode intended for use with autothrottle/autothrust should not cause unacceptable autothrottle/autothrust performance.

4.3.6.3 The autothrottle/autothrust should expeditiously capture any commanded speed adjustments and maintain speed. The autothrottle/autothrust should not cause any hazardous conditions with normal use or in any probable failure modes, considering pilot intervention using normal piloting skills.

4.3.6.4 The autothrottle/autothrust should hold speed within -5 to +10 knots of the intended speed except for momentary gusts, in typical environmental conditions expected for use.

4.3.6.5 The autothrottle/autothrust should provide appropriate status, advisory, caution, and warning information for failures.

4.3.6.6 The autothrottle/autothrust should provide timely application of go-around thrust if a go-around mode is available.

4.3.6.7 The autothrottle/autothrust should not require undue flight crew attention or skill to recognize and respond to an engine failure during approach or go- around.

4.4 Approach System Evaluation.

The applicant should conduct an evaluation to verify that the pertinent systems as installed in the aircraft meet the airworthiness criteria of section 4.2 of this AC. The evaluation should include verification of approach system performance and a safety assessment for verification of the integrity and availability provisions. The applicant should demonstrate engine failure cases and other selected failure conditions identified by the safety assessment by simulator or flight test.

4.4.1 Certification Plan.

An applicant should provide a certification plan(s) describing: 4.4.1.1 The means proposed to show compliance with the criteria of section 4.2 of this AC, with particular attention to methods that differ significantly from those described in this chapter.

4.4.1.2 How non-aircraft elements of the approach system relate to the aircraft system from a performance, integrity, and availability perspective (e.g., appropriate reference to ICAO Annex or U.S. Standard).

4.4.1.3 The assumptions on how the performance, integrity, and availability requirements of the non-aircraft elements of standard landing aids will be assured, if applicable.

4.4.1.4 The effect of the aircraft navigation reference point on the aircraft flight path and wheel-to-threshold crossing height.

4-15 AC 20-191 4.4.1.5 The system concepts and operational philosophy to allow the FAA to determine whether criteria and guidance in excess of that contained in this chapter are necessary.

4.4.1.6 The applicant should reach an early agreement with the FAA on his/her proposed certification plan.

4.4.2 Performance Evaluation.

The applicant should demonstrate the airborne system performance meets provisions of this chapter using simulations and flight tests.

4.4.3 Airborne Performance System.

The airborne system performance demonstration should include at least the following conditions taking into account manual/coupled autopilot, autothrottle/autothrust configurations for CAT II approaches: 4.4.3.1 Wind Conditions: • 20 kts - Head wind component • 10 kts - Crosswind component • 10 kts - Tailwind component Note: The FAA may accept lower limits if the applicant appropriately documents in the AFM and the certification plan.

4.4.3.2 The applicant must demonstrate performance by flight test, or analysis validated by flight test, using at least three different representative facilities for a minimum of 20 total approaches, with a representative range of environmental and system variables affecting overall performance. The applicant must achieve a minimum of 95% success in the number of attempted approaches.

4.4.3.3 The performance assessment must take into account at least the following variables with the variables being applied based upon their expected distribution: • Configurations of the aircraft (e.g., flap settings), • Center of gravity, • Landing weight, • Conditions of wind, turbulence, and wind shear, • Characteristics of ground- and space-based systems and aids (i.e., ILS or GLS), and • Any other parameter which may affect system performance (e.g., airport altitude, approach path slope, variations in approach speed).

4-16 AC 20-191 4.4.3.4 The FAA will accept use of the Continuous Method and the Pass/Fail Method, both found in EASA AMC AWO 231, in lieu of the 95% probability of success tracking requirement described in section 4.2.6.2, and the minimum number of 20 approaches stated in section 4.4.3.2.

4.4.3.5 The FAA recommends wind model analysis to obtain approval of systems related to CAT II. If an applicant elects to use simulation with a wind model to support approval, the applicant should use the model specified in Appendix B.

4.4.3.6 For GLS, the applicant should assess fault free performance of GLS using simulations such as Monte-Carlo with the input variables distributed according to their performance characteristics and a model of the GLS guidance including fault free error characteristics defined by the GLS signal model as specified in 5.5.8 Appendix C.

Note: Applicants with approved airworthiness criteria for GAST D level of service meet all the airworthiness criteria of this chapter.

4.4.4 Safety Assessment.

In addition to any specific safety related criteria identified in this chapter, the applicant must conduct a safety assessment of the approach and landing system, considered separately and in conjunction with other systems, to show compliance with §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309. The applicant can use the guidance contained in AC 23.1309-1, AC 25.1309-1, AC 27-1, or AC 29-2, as applicable.

4.4.4.1 The applicant must consider the responses to failures of navigation facilities, taking into account ICAO and other pertinent state criteria for navigation facilities.

4.4.4.2 Documented safety analysis conclusions must include: 4.4.4.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, an FHA conducted in accordance with the guidance provided by AC 23.1309-1, AC 25.1309-1, AC 27-1 or AC 29-2, respectively, as applicable; a summary of results from the fault tree analysis, demonstrated compliance, and probability determinations for significant functional hazards.

4.4.4.2.2 Information regarding "alleviating flightcrew actions" that were considered in the safety analysis. This information should list appropriate alleviating actions, if any, and should be consistent with the validation conducted during testing. If alleviating actions are identified, the applicant should describe those actions in a form suitable to aid in developing, as applicable: • Pertinent provisions of the AFM procedures section(s) 4-17 AC 20-191 • Flight Crew Operating Manual (FCOM) provisions, or equivalent • Pilot qualification criteria (e.g., training requirements, FSB provisions) • Any other reference material necessary for an operator or flight crew to safely use the system 4.4.4.2.3 Information to support preparation of any necessary maintenance and preventive maintenance such as: • Certification maintenance requirements (CMR) • Periodic checks • Other checks, as necessary (e.g., return to service) 4.4.4.2.4 Information applicable to limitations, as necessary.

4.4.4.2.5 Identification of applicable systems, modes, or equipment necessary for use of the landing system. This information may be used, to aid in development of flight planning, dispatch criteria, or procedures or checklists for pilot selection of modes or assessment of system status, prior to initiation of approach or during approach.

4.4.4.2.6 Information necessary for development of non-normal procedures.

4.4.5 Continued Airworthiness.

4.4.5.1 Pursuant to 14 CFR §§ 23.1529, 25.1529, 27.1529, or 29.1529, an applicant must prepare an Instructions for Continued Airworthiness (ICA) for use by operators. The applicant must submit to the FAA a program showing how the applicant distributes changes made to the ICAs by the applicant or by the manufacturers of the ILS or GBAS avionics installed in the aircraft.

ICAs established during the approval process form the basis for an operator’s maintenance program.

4.4.5.2 Pursuant to 14 CFR §§ 21.3, the applicant must report any failure, malfunction, or defect whose occurrences could impact the safety of the flight crew or the structural integrity of the aircraft itself.

4.5 AFM.

Pursuant to 14 CFR §§ 23.2620, 25.1581, 27.1581, or 29.1581, as applicable, an applicant must furnish an AFM with each aircraft. The AFM should contain the following information: 4.5.1 Relevant conditions or constraints applicable to the approach and landing system use 4-18 AC 20-191 regarding the airport or runway conditions. For example: • Runway elevation • Ambient temperature • Approach path slope • Runway slope • Ground profile under the approach path 4.5.2 The criteria and configurations used for the demonstration of the system.

4.5.3 Any constraints or limitations necessary for safe operation.

4.5.4 Acceptable normal and non-normal procedures.

4.5.5 The type of navigation facilities used as a basis for certification. This should not be taken as a limitation on the use of other facilities. The AFM may contain a statement regarding the type of facilities or condition known to be unacceptable for use (e.g., ILS or GLS). The AFM should indicate the operation is predicated upon the use of an ILS (or GLS) facility with performance and integrity equivalent to, or exceeding, a United States Type II or Type III ILS, GBAS GAST D, or equivalent ICAO Annex 10 Facility Performance CAT II facility.

4.5.6 Applicable atmospheric conditions under which the system was demonstrated (e.g., headwind, crosswind, tailwind).

4.5.7 Any necessary performance, procedure, or configuration data to permit an operator to determine climb gradient and transition distances for safe obstacle clearance during a missed approach, balked landing, or rejected landing. This information need not be specifically included in the AFM if it is available to the operator using some other method acceptable to the operator and manufacturer (e.g., FCOM, supplementary performance information, separate AFM appendix).

4.5.8 For an approach and landing system meeting the provisions of this chapter, the Normal Procedures, Normal Operations, or equivalent sections, of the AFM should also contain the following statements: “The airborne system has been demonstrated to meet the airworthiness provisions of AC 20-191 (Chapter 4) for [specify the pertinent approach capability section(s) criteria met] when the following equipment is installed and operative: “[list pertinent equipment]” “This AFM provision does not constitute operational approval for CAT II use of the system.” 4-19

AC 20-191 CHAPTER 5. CATEGORY (CAT) III 5.1 Introduction.

5.1.1 This chapter contains airworthiness approval criteria for equipment used to conduct an approach, landing, and rollout in CAT III weather minima using an ILS or GBAS.

Landing and rollout may combine various combinations of aircraft sensors and system architecture with various combinations of ground and space-based elements. This AC does not provide criteria for each potential combination of airborne and non-airborne elements.

5.1.2 This chapter addresses the approach, landing and rollout phase of flight, beginning at the FAF, through the CAT III DH, ending at the landing, and rollout phase.

5.1.3 ICAO Annex 10 includes standards for ILS and GBAS systems intended to support CAT III operations. This chapter addresses operations using either ILS or GBAS for approaches, using ILS avionics produced in accordance with TSO-C34e, TSO-C36e authorizations, and GBAS avionics with TSO-C161b and TSO-C162b authorizations.

5.1.4 The standards for GBAS (RTCA DO-253D Change 1 and ICAO Annex 10) define two general classes of GBAS services, Approach Service, and the GBAS Positioning Service. The standards further differentiate GAST. A GAST is defined as the matched set of airborne and ground performance and functional requirements intended to be used in concert in order to provide approach guidance with quantifiable performance.

Applicants for CAT III airworthiness seek approval through GBAS GAST-D level of service.

5.2 Airworthiness Criteria.

5.2.1 The airworthiness criteria contained in this chapter for the CAT III landing and rollout system satisfy the operational requirements described in AC 120-118. The basic airworthiness criteria are independent of the specific implementation in the aircraft or the type of approach landing system and rollout selected for the approach.

5.2.2 Performance provisions for touchdown performance, landing sink rates, and attitudes, etc. (see section 5.4.2.4, below) are the same for landing systems with automatic flight control, and systems for manual flight control with command information as guidance.

5.2.3 The applicant’s type certification proposal should include criterion such as the system’s intended function, accuracy, reliability, and fail-safe features. The proposal should also address the operational concepts contained in AC 120-118.

5.2.4 The low visibility landing system is intended to guide the aircraft to a touchdown in the prescribed touchdown zone, with an appropriate sink rate and attitude without exceeding prescribed load limits of the aircraft. The rollout system is intended to guide the aircraft to converge on and track the runway centerline, from the point of 5-1 AC 20-191 touchdown to a safe taxi speed.

5.2.5 The overall assurance of performance and safety of an operation can only be assessed when all elements of the system are considered.

5.2.6 The low-visibility landing system must be shown to be satisfactory with and without the use of any outside visual references, except that outside visual references will not be considered when assessing lateral tracking performance. The airworthiness evaluation will also determine whether the combination of guidance and outside visual references would unacceptably degrade task performance or require exceptional workload and pilot compensation. The evaluation should include normal operations and non-normal operations with system and aircraft failure conditions.

5.2.7 General Airworthiness Criteria.

5.2.7.1 The applicant establishes the intended flight path. The path may be established in a number of ways, including the use of navigation aids (e.g., ILS or GLS). Other methods may be acceptable if the applicant can show feasibility through other means, for example: • Sensing of the runway environment (e.g., surface, lighting or markings or both) with a vision enhancement system, or • By a vision enhancement system.

5.2.7.2 On-board navigation systems may have various sensor elements by which to determine aircraft position. The sensor elements may include ILS, Inertial information, GLS, or other GNSS elements. Each of these sensor elements should comply with their performance provisions within appropriate limitations.

5.2.7.3 The system should provide an indication of the aircraft position with respect to the intended lateral path using: • Deviation displays with reference to a navigation source (e.g., ILS receiver, GLS receiver, etc.), or • On-board navigation system computations with corresponding displays of position and reference path.

5.2.8 Accuracy.

5.2.8.1 Acquisition Performance.

The acquisition should be accomplished in a manner compatible with instrument procedure requirements and flight crew requirements for the type of approach being conducted. The approach guidance system must not generate sustained oscillating command information (e.g., flight director, HUD, etc.) or require unusual effort by the pilot to control the flight path.

5-2 AC 20-191 5.2.8.2 Lateral and Vertical Tracking Performance.

The applicant must show the system will meet the following performance parameters: 5.2.8.2.1 Stable lateral tracking performance from 1000 ft. Height Above Touchdown (HAT) to 300 ft. HAT should be stable without large deviations (i.e., within ±50 microamps deviation or equivalent) from the indicated course or path.

5.2.8.2.2 Stable lateral tracking performance from 300 ft. HAT to touchdown without large deviations (i.e., within ±25 microamps deviation) from the indicated course, for 95% of the time.

5.2.8.2.3 Stable vertical tracking from 700 ft. HAT to 300 ft. HAT should be stable without large deviations (i.e., within ±75 microamps deviation or equivalent) from the indicated course or path.

5.2.8.2.4 Stable vertical tracking performance from 300 ft. HAT to until commencing the flare maneuver (e.g., 100 ft.) without large deviations (i.e., within ±35 microamps deviation) from the indicated path or ±12 ft., whichever is greater, for 95% of the time. Momentary excursions up to ±75 microamps during test demonstrations may be acceptable if the applicant shows satisfactory performance of the flight guidance system through touchdown and landing.

5.2.8.2.5 The FAA will accept use of the Continuous Method and the Pass/Fail Method, both found in EASA AMC AWO 231, in lieu of the 95% probability of success tracking requirement described in sections 5.2.8.2.1, 5.2.8.2.2, 5.2.8.2.3 and 5.2.8.2.4 using a minimum of 20 approaches.

5.2.9 Approach and Landing System Performance.

5.2.9.1 Stable Approach.

The applicant should conduct a stable approach (i.e., “normal maneuvering” without excessive attitudes, sink rates, path deviations, or speed deviations) to the point where a smooth transition is made to the landing.

5.2.9.1.1 If the landing system is designed to perform an alignment function prior to touchdown, to correct for crosswind effects, the system should operate in a manner consistent with the pilot's manual technique for crosswind landings. Typically, the pilot's manual technique includes the wing low, side slip procedure. Non-availability of the alignment mode, or failure of the alignment mode to perform its intended function must 5-3 AC 20-191 be easily detectable, or be suitably annunciated, so that the flight crew can take appropriate action.

5.2.9.1.2 The "landing flare to touchdown" maneuver should reduce the aircraft sink rate to a value not exceeding the sink rate for landing as listed in the AFM.

5.2.9.2 Speed Control Performance.

Airspeed must be controllable to within +/- five knots of the approach speed*, except for momentary gusts, up to the point where the throttles are retarded to idle for landing. For operations flown with manual control of approach speed, the flight crew must be able to control speed to within +/- five knots of the approach speed.

* This criterion is not specific to low visibility systems but must be met by low visibility systems.

5.2.9.3 Landing System Performance.

All types of low visibility landing systems, including automatic flight control, guidance for manual control, and hybrid systems, must meet the performance specified in section 5.2.9.4. The performance values may vary where justified by the characteristics of the aircraft. Additional performance provisions apply for GLS systems. See sections 5.2.9.5 through 5.2.9.7.

5.2.9.4 Nominal Performance (ILS, GLS).

The nominal performance provisions establish compatibility of the aircraft system performance with basic navigation system accuracy in fault-free conditions and nominal environmental conditions. Nominal conditions include both normal and rare normal conditions. The variables affecting performance that an applicant must include in the assessment are discussed in section 5.2.9.9. The nominal performance criteria and probabilities are as follows: 5.2.9.4.1 Probability of longitudinal touchdown earlier than a point on the runway 200 ft. (60m) from the threshold must not exceed -6 10 .

5.2.9.4.2 Probability of longitudinal touchdown beyond 2700 ft.(823m) -6 from threshold must not exceed 10 .

5.2.9.4.3 Probability of lateral touchdown with the outboard landing gear more than 70 ft. (21.3m) from runway centerline must not -6 exceed 10 (assuming a 150 ft runway width).

5.2.9.4.4 Probability of sink rate at the structural limit load must not -6 exceed 10 . An acceptable means of establishing that the structural limit load is within its specified limit is to show separately and independently that: 5-4 AC 20-191 • The limit load that results from a sink rate at touchdown not greater than 10 fps or the limit rate of descent used for certification under 14 CFR Part 25 subpart C (see § 25.473), whichever is greater. For part 23, 27, and 29 aircraft, the limit load conditions specified in §§ 23.2220, 27.473, or 29.473 apply, respectively.

• The lateral side load does not exceed the limit value determined for the lateral drift landing condition defined in § 25.479(d)(2). For Part 23, 27, and 29 aircraft, the level landing conditions specified in §§ 23.2220, 27.479, or 29.479 apply, respectively.

5.2.9.4.5 Probability of bank angle resulting in hazard must not exceed -7 10 . For example, a hazard to a fixed wing aircraft means a bank angle resulting in any part of the wing including the tip, high lift device, or engine nacelle touching the ground. For rotorcraft the hazard definition will be based on the rotorcraft’s unique capabilities. Reference AC 27-1 or AC 29- 2 for additional information on helicopters.

5.2.9.5 GLS.

The applicant must assess the effect of nominal GLS errors on landing system performance via simulation using the GLS Noise Model provided in 5.5.8 Appendix C or an approved equivalent model), including the fault-free elements, as described in sections C.1.2 through C.1.6.

5.2.9.5.1 When using GBAS, the required flight path is uplinked to the aircraft after the approach is selected. This path is used for flight guidance or the autopilot or both when required to conduct an approach, landing, and rollout.

5.2.9.5.2 Corruption of the information contained in the received VDB to define the reference path is considered a hazardous condition. Failure resulting in undetected changes to the approach path definitions data must be extremely remote.

5.2.9.5.3 The flight crew must not be able to modify information that relates to the critical definition of required flight path.

5.2.9.6 Compatibility with Rare Undetected Non-Aircraft System Error Conditions (e.g., satellite faults, ionospheric anomalies).

For any value of GLS navigation system error resulting from faults, in conjunction with nominal conditions: • The probability of longitudinal touchdown earlier than a point on the -5 runway 200 ft. (60 m) from the threshold must not exceed 10 .

5-5 AC 20-191 • The probability of longitudinal touchdown beyond a point on the -5 runway 3000 ft. (900 m) from the threshold must not exceed 10 .

• The probability of lateral touchdown with the outboard landing gear more than 70 ft. (21 m) from the runway centerline must not exceed -5 10 (assuming a 150 ft runway width).

• The probability of sink rate at the structural limit load, must not -5 exceed 10 .

• The probability of bank angle where the wing tip touches the ground -6 prior to the landing gear must not exceed 10 .

• The probability of lateral velocity (or sideslip angle) at the structural -5 limit load must not exceed 10 .

Note: For HUD landing systems, where total wind strength has been shown to be the most critical parameter affecting performance, an alternative means of compliance may be used.

5.2.9.6.1 Evaluation of landing probability.

The applicant cannot take credit for the probability of faults when evaluating the required landing probabilities. However, the applicant may take credit for the ground subsystem’s probability of detection for satellite faults and the aircraft’s probability of detection for single reference receiver faults. The GLS errors may be considered bias-like for the duration of an approach and landing as this is the worst-case scenario.

5.2.9.6.2 Non-GLS variable.

When assessing the GLS performance, the applicant must account for other non-GLS variables affecting performance.

These non-GLS variables must vary according to their expected distributions.

Note 1: The criteria ensures that undetected faults in conjunction with nominal conditions in the non-aircraft GBAS system, when combined with all other variables affecting landing performance, do not result in an unacceptably high probability of landing outside the limits that define a safe landing. See section 5.2.10.1.6 for the conditions that define a safe landing. These faults include only satellite faults and single ground reference receiver faults.

Note 2: Appendix C - GLS Signal Model section C.1.9 provides an example demonstration method for the performance specified in this section. The appendix also contains a list of references used to derive the signal model. These references describe undetected non-aircraft system error conditions, nominal performance, and faults as well as the ICAO standardized ground system monitoring requirements. The aircraft 5-6 AC 20-191 performance provisions in this section are intended to address non-aircraft system errors that are below the ground monitoring thresholds. Such errors are not considered a malfunction of the non-aircraft system.

Note 3: It is assumed that operations will be approved with knowledge of the runway specific glide path and TCH values and the aircraft’s capability. Therefore, it is not necessary to set the glide path or TCH or both values to the limits allowed for the aircraft.

5.2.9.7 Compatibility with Worst Case Undetected Guidance Errors.

5.2.9.7.1 Undetected errors that are not extremely improbable must be shown to not prevent a safe landing or go-around or both when all other variables affecting performance are at their nominal values. The definition of a safe landing is specified in section 5.2.10.1.6. The definition of a safe approach is an approach that does not penetrate the Obstacle Limitation Surfaces for Precision Approach Category II or III as defined by ICAO SARPs Annex 14 section 4.2.15 & Table 4-1.

5.2.9.7.2 The applicant must assess the effect of worst-case undetected errors on landing system performance via simulation using the GLS Noise Model provided in 5.5.8 Appendix C (or an approved equivalent model). The worst case undetected errors must be simulated by using the maximum range domain error given in Table C-5 and Table C-7 of Appendix C in conjunction with the appropriate geometry screening factors used by the aircraft. The certification plan should specify how the demonstration will be conducted, including the number of cases and variables with pass/fail criteria. The aircraft performance must be assessed in the presence of the full range of bias and ramp type failures produced by the Fault Mode Generator described in Appendix C. This demonstration must include the irregular terrain profile as defined in section 5.2.9.10.

Note: Rare ionosphere events and undetected satellite or ground station failures could result in significant vertical (and lateral) position errors. Under certain conditions, such errors may go undetected by the system and could result in erroneous guidance if unmitigated. The effect of such errors may not be observable by the flight crew.

5.2.9.8 Rollout System Performance.

The rollout system, if included, must control the aircraft, in the case of an automatic flight control system, or provide command information as guidance to the pilot, for manual control, from the point of landing to a safe 5-7 AC 20-191 taxi speed. The loss of rudder effectiveness, as the aircraft speed is reduced, could be a factor in the level of approval which is granted to a system. The applicant should describe the system concept for rollout control so that the absence of low-speed control, such as a nose wheel steering system, can be assessed.

5.2.9.8.1 The automatic flight control system should provide de-rotation for airplanes, consistent with a pilot’s manual technique.

Systems which provide rollout guidance for manually controlled rollout are not required to provide de-rotation.

Systems which provide de-rotation, automatically or with guidance for manual control, must avoid any objectionable oscillatory motion or nose wheel touchdowns, pitch up, or other adverse behavior as a result of ground spoiler deployment or reverse thrust operation.

5.2.9.8.2 Automatic control during the landing and rollout should not result in any aircraft maneuvers which would cause the flight crew to intervene unnecessarily.

5.2.9.8.3 Landing and rollout guidance should be consistent with a pilot’s manual technique, and not require excessive skill or flight crew workload to accomplish the operation.

5.2.9.8.4 Safe taxi speed is the speed at which the pilot can safely leave the runway or bring the aircraft to a safe stop. The safe taxi speed may vary with visibility conditions, aircraft characteristics, and means of lateral control. The performance criteria in this section assume a 150 ft. (45.7m) runway width.

The rollout performance limit may be appropriately increased if operation is restricted to wider runways.

5.2.9.8.5 Rollout systems typically reference the runway centerline via ILS localizer or another approved approach navigation system.

The intended path for the rollout system is to keep the aircraft on the runway, and usually on the runway centerline.

5.2.9.8.6 The applicant should demonstrate that the rollout system: • Does not cause the outboard tire(s) to deviate from the runway centerline by more than 70 ft. (21.3m), starting from the point at which touchdown occurs and continuing to a point at which a safe taxi speed is reached, to a -6 probability of 1 x 10 .

Note 1: These values assume a 150 ft (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.

5-8 AC 20-191 Note 2: 70 ft. (21.3m) deviation from centerline is equivalent to outboard tire(s) at 5 ft. (1.5m) within the edge of a 150 ft. (45.7m) wide runway.

• Captures the intended path or converges on the intended path (e.g., localizer centerline) in a smooth, timely, and predictable manner. While a critically damped response is desired, minor overshoots are acceptable. Sustained or divergent oscillations or unnecessarily aggressive responses are unsatisfactory.

• Promptly corrects any lateral movement away from the runway centerline in a positive manner.

• Following touchdown, if not already on a converging path, causes the aircraft to initially turn and track a path to intercept the runway centerline at a point far enough in front of the aircraft obvious to the flight crew that the rollout system is performing properly. Also, the rollout system should intercept the centerline sufficiently before the stop end of the runway, and before the point at which taxi speed is reached.

5.2.9.9 Variables Affecting Performance.

The performance assessment must take into account at least the following variables with the variables being applied based upon their expected distribution: • Configurations of the aircraft (e.g., flap/slat settings) • Center of gravity • Landing gross weight • Conditions of headwind, tailwind, crosswind, turbulence and wind shear (see Appendix B for acceptable wind models) • Approach airspeed and variations in approach airspeed • Airport conditions (elevation, runway slope, runway condition) • Individual pilot performance, for systems with manual control • Any other parameter which may affect system performance • Characteristics of applicable navigation aids, including variations in flight path definitions (ILS or GLS, aircraft and space elements, etc.)

Note: 5.5.8 Appendix C provides one acceptable model for the assumed characteristics of GLS guidance errors. Applicants using an alternate model are responsible for documenting the alternate model, its basis (including a mapping to ICAO Annex 10 characteristics and any additional assumptions made), and its validity.

5-9 AC 20-191 5.2.9.10 Irregular Approach Terrain.

Approach terrain may affect the performance and pilot acceptance of the Approach and Landing system. ICAO Annex 14 contains the information on the nominal characteristics of an airport. Applicants can use this information to characterize the airport environment for nominal performance assessment. The applicant must evaluate the system’s performance characteristics in the presence of significant approach terrain variations. At a minimum, the following profiles should be examined.

• Sloping runway - slopes of 0.8% • Hilltop runway - 12.5% slope up to a point 200 ft. (60m) prior to the threshold • Sea-wall - 6m (20 ft.) step up to threshold elevation at a point 60m prior to the threshold Note 1: In addition to the profiles described above, the FAA recommends examination of the known airport profiles with significant irregular approach terrain, at which operations are intended.

Note 2: Special operational evaluations are appropriate for certain airports having difficult pre-threshold terrain conditions. These evaluations consider each particular aircraft type, the particular flight control system, and may include consideration of particular system elements such as the type of radar altimeters installed or other equipment. Reference AC 120-118 for details on irregular approach terrain operational evaluations.

5.2.9.11 Approach and Automatic Landing with an Inoperative Engine.

When demonstrating engine-inoperative capabilities, the applicant must show the landing system performs a safe landing and, where applicable, safe rollout in this non-normal aircraft condition taking account the factors described in this chapter and the following: 5.2.9.11.1 Failure of the critical engine, and for propeller driven aircraft, where applicable, accounting for feathering of the propeller following failure of the critical engine.

5.2.9.11.2 Appropriate landing flap configurations.

5.2.9.11.3 Loss of any system associated with the inoperative engine, e.g., electrical and hydraulic power.

5.2.9.11.4 Crosswinds in each direction of at least 10 knots.

5.2.9.11.5 Weight of aircraft.

5.2.9.12 Go Around.

Whether or not the applicant seeks engine out landing approval, the go- around from any point on the approach to touchdown must not require 5-10 AC 20-191 exceptional piloting skill, alertness, or strength. The applicant must ensure that sufficient information is available to determine that the aircraft can remain clear of obstacles.

5.2.9.13 Inoperative Engine Information.

The applicant should provide information for an operator to assure a successful go-around with an inoperative engine. The information may be in a form as requested by the operator, or as determined appropriate by the manufacturer. The information may or may not be provided to the operator as part of the AFM. Examples of acceptable information would include the following: 5.2.9.13.1 Information on height loss as a function of go-around initiation altitude. AC 25-7 provides one acceptable example 5.2.9.13.2 Performance information allowing the operator to determine that the operator can maintain safe obstacle clearance during a go-around with an engine failure 5.2.9.13.3 A method to assess and extend applicability of engine- inoperative takeoff performance obstacle clearance determinations for a balked landing or go-around event 5.2.10 Landing and Rollout System Integrity.

5.2.10.1 Landing System Integrity .

Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the applicant must evaluate the onboard components of the landing systems, considered separately, and in relation to other associated onboard systems.

In addition, the applicant must also include any specific safety related criteria identified in this chapter in the evaluation. The applicant can use the following criteria to show compliance with §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309 for the Landing Systems.

5.2.10.1.1 Probability of unsafe landing.

Any single malfunction or any combination of malfunctions of the landing system preventing a safe landing or go-around must be extremely improbable, unless it can be detected and annunciated, as a warning to allow pilot intervention to avoid catastrophic results and shown to be extremely remote.

5.2.10.1.2 Probability of Missed Detection.

Failure to detect and annunciate malfunctions preventing a safe landing or go-around must be extremely improbable.

5-11 AC 20-191 5.2.10.1.3 Exposure Time.

The exposure time for assessing failure probabilities for fail passive landing systems is the average time required to descend from 100 feet HAT to touchdown. The exposure time for assessing failure probabilities for fail operational landing systems is the average time to descend from 200 feet HAT to touchdown. The applicant must address all latent faults that may exist prior to the start of the exposure time (at or before 100 ft HAT for fail passive and at or before 200 ft. HAT for fail operational).

5.2.10.1.4 Deviations Associated with Malfunction (Fail Passive).

For a fail passive automatic landing system, a single malfunction or any combination of malfunctions must not cause a significant deviation of the flight path or attitude following system disengagement. The aircraft must be safely trimmed when the system disengages to prevent these significant deviations.

5.2.10.1.5 Deviations Associated with Malfunction (Fail Operational).

A fail operational automatic landing system, following a single malfunction, must not lose the capability to perform lateral and vertical path tracking, alignment with runway heading (e.g., de- crab), flare, and touchdown within the safe landing criteria listed in section 5.2.10.1.6.

5.2.10.1.6 Safe Landing Criteria.

For the purpose of analysis, a safe landing may be assumed when the following performance is achieved: • Longitudinal touchdown no earlier than a point on the runway 200 ft. (60m) from the threshold, • Longitudinal touchdown no further than 3000 ft. (1000m) from the threshold (not beyond the end of the touchdown zone lighting), and • Lateral touchdown with the outboard landing gear within 70 ft. (21m) from runway centerline. (These values assume a 150 ft. (45m) runway. The lateral touchdown performance limit may be appropriately increased if operation is restricted to wider runways.)

5.2.10.1.7 Environmental Conditions.

Malfunction cases may be considered under nominal environmental conditions.

5-12 AC 20-191 5.2.10.1.8 Total Autoland System Loss.

The applicant must demonstrate the PF can disconnect the autopilot at his/her discretion and maneuver the aircraft to a safe landing and rollout to a safe taxi speed, or perform a successful go-around to avoid catastrophic results.

5.2.10.2 Rollout System Integrity.

When engaged, the rollout system must provide automatic control, or guidance for manual control, to maintain the aircraft on the runway to a safe taxi speed on the runway.

5.2.10.2.1 Pursuant to §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309, the applicant must design the onboard components of the rollout system, considering the components both separately, and in relation to other associated onboard systems. The applicant may use the following criteria for the application of §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309 to Rollout Systems: 5.2.10.2.2 A fail operational rollout system must meet the safe rollout performance provisions of this chapter, section 5.2.9.8 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any single malfunction, or after any combination of malfunctions not shown to be extremely remote. The applicant may consider malfunction cases under nominal environmental conditions.

5.2.10.2.3 For any rollout system, below 200 ft. HAT, the applicant must demonstrate unannunciated malfunctions preventing a safe rollout are extremely improbable.

5.2.10.2.4 For a fail passive rollout system, the loss of a fail passive automatic rollout function after touchdown must cause the automatic flight control system to disconnect. The loss of a fail passive rollout system after touchdown must be improbable.

Whenever a fail passive guidance system for manual rollout does not provide valid guidance, the system should provide an alert consistent with the flight deck philosophy to each pilot.

5.2.10.2.5 The rollout system performance should not cause the aircraft wheels to exceed the lateral confines of the runway, from the point of touchdown to the point at which a safe taxi speed is reached, more often than once in ten million landings. This performance provision applies for malfunctions only affecting low speed directional control (speeds below effective rudder steering).

5-13 AC 20-191 • The applicant should demonstrate the effect of any nose- wheel steering malfunction can be handled by the rollout system or mitigated by pilot intervention using realistic simulated operational conditions.

• The applicant should include in the safety assessment the worst-case single failure conditions and failure combinations which are not extremely improbable. These conditions should include failures such as a jammed nose wheel steering or nose wheel castering. Where possible, the preferred method of demonstration is by flight test.

• The applicant’s evaluation of failure conditions should include consideration of nominal environmental conditions including visibility, crosswind, and runway surface conditions affecting braking (e.g., snow/ice, water saturated, wet with rubber contamination, etc.). The applicant must accomplish the evaluation of failure conditions with variations in environment unless the applicant can show that the combination of failure and environment is extremely improbable (See AC 25-7, Handling Qualities Rating Method).

• The applicant may use a simulator with a validated ground model to explore the full range of test conditions. These include the effect of simulated runway coefficients of friction, crosswinds, center of gravity, mass distribution (at various ground speeds), runway elevation, and visibility.

5.2.10.2.6 GLS signal anomalies could affect safe system performance in the flare and rollout phases, so the applicant should describe and show how the GLS autoland and automatic rollout functions safely account for them.

5.2.11 Approach System Continuity Criteria.

The applicant should verify the continuity of navigation during normal aircraft maneuvering while in approach. For GLS, this includes verifying reception of VDB signal at all angles relative to the airframe as the GBAS facility could be located anywhere with respect to the approach path.

5.2.12 Landing and Rollout System Availability.

5.2.12.1 Landing System Availability.

On approach below 500 ft., the probability of a successful landing should be at least 95% for approach demonstrations conducted in the aircraft. This means no more than 5% of the approaches result in a go-around, due to the combination of failures in the landing system and the incidence of unsatisfactory performance. The applicant should meet this level of availability during flight test, with approximately 100 approaches.

5-14 AC 20-191 5.2.12.1.1 For an aircraft equipped with a fail passive landing system, the need to initiate a go-around on approach below 100 ft. HAT due to an aircraft system failure condition should be infrequent (i.e., typically fewer than 1 per 1000 approaches).

5.2.12.1.2 For a fail operational system, on approach below 200 ft. HAT, the probability of total loss of the landing system (even though appropriate annunciation of system loss is provided) must be extremely remote. The annunciation must enable the pilot to intervene in a timely manner to avoid a catastrophic result.

Total loss of the system without annunciation must be extremely improbable.

5.2.12.1.3 All single failures and combinations of failures not extremely improbable must be shown to permit completion of the landing and rollout to a safe taxi speed, or a successful go- around.

5.2.12.1.4 If a total loss of the autoland system occurs, the applicant must demonstrate the PF can disconnect the autopilot and maneuver the aircraft to a safe landing, and rollout to a safe taxi speed, or perform a successful go-around to avoid catastrophic results.

5.2.12.2 Rollout System Availability should meet the following criteria: 5.2.12.2.1 For a fail passive rollout system, from 200 ft. HAT through landing, and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%, considering loss or failure of the rollout system.

5.2.12.2.2 For a fail operational rollout system, during the period in which the aircraft descends below 200 ft. HAT to a safe taxi speed, the probability of degradation from fail operational to fail passive should be infrequent (i.e., fewer than 1 degradation per 1000 approaches). The probability of total loss of rollout capability should be extremely remote, considering loss or failure of the rollout system.

5.2.12.2.3 After touchdown, if a complete loss of the fail operational automatic rollout function occurs, or any other unsafe malfunction or condition, the automatic flight control system must disconnect. The loss of a fail operational rollout system after touchdown must be extremely remote.

5-15 AC 20-191 5.2.13 Go-Around.

The aircraft must be capable of safely executing a go-around from any point on the approach to touchdown in all configurations. The maneuver may not require exceptional piloting skill, alertness, or strength.

5.2.13.1 A go-around from a low altitude may result in an inadvertent runway contact, therefore the applicant should establish the safety of the procedure giving consideration to at least the following: 5.2.13.1.1 The automatic control and guidance produced by the go- around mode, when such a mode is provided, should be retained and be shown to have safe and acceptable characteristics throughout the go-around maneuver.

5.2.13.1.2 Inadvertent selection of go-around mode after touchdown should have no adverse effect on the ability of the aircraft to safely roll out and stop.

5.2.13.2 The applicant should assess height loss to assure expeditious go-around from a range of altitudes during the approach and flare when under automatic control and when using the landing guidance system, as appropriate, and as follows: 5.2.13.2.1 Height loss may be assessed by flight testing (typically 10 go- arounds) supported by simulation.

5.2.13.2.2 The simulation should evaluate the effects of variation in parameters such as weight, center of gravity, configuration, and wind. The simulation results should correlate with the flight test results.

5.2.13.2.3 Normal procedures for a go-around for the applicable configuration should be followed. If engine-inoperative capability is sought, and use of the go-around mode is applicable to those operations, an assessment of the engine- inoperative go-around is necessary.

5.2.14 Information, Annunciation, and Alerting.

5.2.14.1 Compliance.

The design of the Information, Annunciation, and Alerting must comply with §§ 23.2605, 25.1322, 27.1322, or 29.1322. Reference AC 23.1311-1, AC 25.1322, AC 27-1, or AC 29-2 for additional guidance.

5.2.14.2 Airworthiness Criteria for Basic Situation and Command Information.

5.2.14.2.1 The controls, indicators, and warnings must be designed to minimize flight crew errors that could create a hazard. Mode 5-16 AC 20-191 and system malfunction indications must be presented in a manner compatible with the procedures and assigned tasks of the flight crew. The indications must be grouped in a logical and consistent manner and be visible under all expected normal lighting conditions.

5.2.14.2.2 For manual control of approach, landing, and rollout flight path, the primary flight display(s), whether head down or head up, must provide sufficient information to enable a suitably trained pilot to: • Maintain the approach path, • Make the alignment with the runway, flare, and land the aircraft within the prescribed limits, and • Go-around without excessive reference to other cockpit displays.

5.2.14.2.3 The information provided above along with any additional information necessary to the design of the system must be sufficient to allow the flightcrew to monitor the progress and safety of the landing and rollout operation.

5.2.14.2.4 Required in flight performance monitoring capability includes at least the following: • Unambiguous identification of the intended path for the approach, landing, and rollout, (e.g., ILS /GLS approach identifier/frequency, and selected navigation source); and • Indication of the position of the aircraft with respect to the intended path (e.g., situation information localizer and glide path, or equivalent).

5.2.14.3 Annunciation.

The system must provide a positive, continuous, and unambiguous indication for the modes actually in operation, as well as those that are armed for engagement. In addition, where mode engagement is automatic (e.g., localizer and glide path acquisition), the system must provide a clear indication when the mode has been armed by either action of a member of the flight crew, or automatically by the system (e.g., a pre-land test – LAND 3).

5.2.14.4 Alerting.

Alerts are intended to address the need for warning, caution, and advisory information for the flight crew.

5-17 AC 20-191 5.2.14.4.1 Warnings.

The system must provide a warning indication for all conditions requiring the flight crew to take immediate corrective action.

The design should account for flight crew alerting cues, corrective action required, and the capability of detecting faults.

• Warnings must be given without delay, be distinct from all other cockpit warnings and provide unmistakable indication of the need for the flight crew to take immediate corrective action. Aural warnings must be audible to each pilot under typically assumed worst-case ambient noise conditions, but not so loud and intrusive as to interfere with the flight crew taking the required corrective action or readily accomplishing flight crew coordination. Visual warnings, such as lights or alphanumeric messages, must be distinct and conspicuously located in the primary field of view for each pilot.

• After beginning final approach (e.g., typically prior to reaching 1000' HAT), the system should annunciate the loss of a fail passive or fail operational system. Whenever a fail passive system, for manual control, does not provide valid guidance, the system must provide a warning indication to each pilot and remove the guidance. The removal of guidance alone is not adequate annunciation. The annunciation must be located to ensure rapid recognition, and must not distract the PF or significantly degrade the forward view.

5.2.14.4.2 Cautions.

The system must provide a caution for any condition requiring immediate flight crew awareness and timely subsequent action.

The system must provide a means to advise the flight crew of failed aircraft system elements that affect the decision to continue or discontinue the approach.

• After initiation of final approach, (which typically occurs at or above 1000' HAT) a fail passive landing system, or landing and rollout system, must alert the flight crew to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.

• After initiation of final approach, a fail passive command guidance system (e.g., HUD guidance), must provide a clear, distinct, and unmistakable indication to alert each pilot to any malfunction or condition that would adversely affect the ability of the system to safely operate or continue the approach or landing.

5-18 AC 20-191 • After initiation of final approach, but above the airworthiness demonstrated AH, a fail operational landing system or landing and rollout system (with either fail operational or fail passive rollout) must alert the flight crew to: o Any malfunction or condition adversely affecting the ability of the system to safely operate or continue the approach or landing, and o Any malfunction degrading the landing system from a fail operational to a fail passive landing system.

• Below the airworthiness demonstrated AH and throughout rollout, a fail operational landing system must inhibit alerts for malfunctions degrading landing system capability from fail operational to fail passive status.

• Excessive-Deviation alerting. The FAA does not require excessive-deviation alerting, but will approve systems meeting appropriate criteria (e.g., EASA CS- AWO.B.CATII.115).

• For systems that meet EASA criteria, compliance with the following criteria, from CS-AWO.B.CATII.115, is an acceptable means of compliance, but is not a required means of compliance. For systems meeting the CS- AWO.B.CATII.115 criteria, excess-deviation alerts should: o Operate when the deviation from the ILS or GLS glide path or localizer centerline exceeds a value from which a safe landing can be made from offset positions equivalent to the excess-deviation alert, without exceptional piloting skill and with the visual references assumed to be available in these conditions.

o Be set to operate with a delay of not more than one (1) second from the time that the deviation thresholds are exceeded.

o Be active at least from 300 ft. (90m) HAT to 50 ft.

HAT, but the glide path deviation alert may be discontinued below 100 ft. (30m) HAT.

5.2.14.4.3 Advisories.

The system must provide a means to inform the flight crew when the aircraft has reached the AH or DH, as applicable.

5-19 AC 20-191 5.2.14.4.4 System Status.

The system should provide a means for the operator and flight crew to determine both prior to and after departure, the capability of the aircraft elements to accomplish the intended low visibility operations. While en route, the system should indicate to the flight crew as an advisory the failure of each aircraft component adversely affecting the capability to conduct the intended landing operation.

• The system should provide a means to advise the flight crew of failed aircraft system elements relating to landing system capability which otherwise could adversely affect a flight crew’s decision to use particular landing minima (e.g., adversely affect a decision to continue to a destination or divert to an alternate).

• If multiple landing system capability is installed (e.g., MMR), then during approach the system should provide an indication to the flight crew of a failure in each non-selected aircraft landing system element (e.g., a GLS receiver failure during conduct of an ILS approach) as an indication of system status. Such failures or non-availability, however, should not produce a caution or warning if they are not relevant to the system in use.

• The system should identify system status indications by names that are different than operational authorization categories (e.g., annunciations such as "LAND 3," or "DUAL" may be used). The system should not use system or configuration status annunciations which may change over time as operational criteria change. The system should not use system or configuration status that could be confusing or ambiguous. For example, system or configuration annunciations such as "CAT I", "CAT II", or "CAT III" should typically not be used for new designs. This is because the flight crew, operator, runway, or aircraft may not be eligible for a particular minima or operation.

5.2.15 Multiple Landing Systems.

This section identifies performance provisions for aircraft that are capable of conducting approach and landing operations using multiple landing systems (e.g., ILS or GLS).

5.2.15.1 General.

5.2.15.1.1 Where practical, the approach procedure, from the pilot’s perspective, should be the same irrespective of the navigation source being used. Call outs, such as “approaching minimums” 5-20 AC 20-191 and “decision height” should have the same meaning for each landing system.

5.2.15.1.2 The system must provide a means (e.g., the current ILS facility identification, GLS RPDS) to confirm that the intended approach aid(s) have been correctly selected.

5.2.15.1.3 Indications.

5.2.15.1.4 The following criteria apply to indications in the flight deck for the use of a multi-mode landing system: 5.2.15.1.5 The primary flight display must indicate deviation data for the selected landing system.

5.2.15.1.6 The MMR must indicate the loss of deviation data on the display. It is acceptable to have a single failure indication for each axis common to all navigation sources.

5.2.15.2 Annunciations.

The following criteria apply to annunciations when using a multi-mode landing system.

5.2.15.2.1 The MMR must positively indicate the navigation source (e.g., ILS, GLS, FMS) selected for the approach in the primary field of view at each pilot station.

5.2.15.2.2 The MMR must indicate the data designating the approach (e.g., ILS frequency or GLS channel number) in a position readily accessible and visible to each pilot.

5.2.15.2.3 The MMR should use a common set of ARM and ACTIVE mode indications (e.g., LOC and GS) for ILS and GLS operations to ease flight crew training.

5.2.15.2.4 The aircraft must provide a means for the flight crew to determine a failure of the non-selected navigation receiver function, in addition to the selected navigation receiver function. When considering equipment failures, the failure indications must not mislead through incorrect association with navigation source.

5.2.15.3 Alerting.

Flight operations may require planning to alternate destination runways or alternate airports for takeoff, en route diversion, and landing. Various runways at these airports may have different landing systems. Thus, flight operations may be planned, released, and conducted based on one or more landing systems. Accordingly, the system should provide a means for the 5-21 AC 20-191 flight crew to determine the capability of each element of a multi-mode landing system to support flight planning. The MMR must: 5.2.15.3.1 Indicate to the flight crew failure of a non-selected landing mode (i.e., ILS or GLS) as an advisory if the mode is not available or will not be available for use during the next approach and landing.

5.2.15.3.2 Issue a warning, caution, or advisory, as appropriate if there is a failure of the active element of a multi-mode landing system during an approach.

5.2.15.3.3 Provide an indication of a failure in each non-selected element of a multi-mode landing system to the flight crew as an advisory. This indication should not produce a caution or warning. Such advisories may be inhibited during takeoff, below AH, and at other times as determined necessary or appropriate for the alerting system and flight deck design philosophy for the aircraft type.

5.2.16 MMR.

In cases where MMRs are used for CAT III systems that are using more than one type of landing system, the means of compliance required for certification can be simplified provided the applicant provides appropriate justification. This section provides guidance for retrofit certifications, and for certification of ILS installations with either new or modified receivers.

5.2.16.1 Retrofit Considerations.

5.2.16.1.1 Typical receiver configurations for retrofit applications include: • An ILS receiver from a new supplier.

• A modified ILS receiver from the same supplier (e.g., for purposes of providing improved FM Immunity).

• A re-packaged receiver from the same supplier (e.g., the ILS partition in an MMR, or the transition from ARINC 700 to 900 series equipment).

• A stand-alone GLS receiver.

• A GLS partition in an MMR.

5.2.16.1.2 General certification considerations include: • Certification Process. An “impact assessment” should address any new receiver functionality considering: o Differences between the current basis of certification and that which is requested, if applicable.

5-22 AC 20-191 o The functionality being added.

o Credit that can be taken for the existing approval.

• Equipment Approval. The applicant should follow Part 21, Subpart O, to obtain TSO authorization, where appropriate, including software qualification and receiver environmental qualification to the appropriate levels.

• Aircraft installation approval should consider the following: o Impact on aircraft system safety assessments; o Equipment approval (e.g., antenna positions, range, polar diagrams, coverage, compatibility between receiver and antenna); o EMI/EMC testing; o Functional integration aspects of the receiver with respect to other systems, controls, warnings, displays; o Electrical loading; o Flight data recorder requirements; o Suitable AFM provisions; and o Certification means of compliance for the receiver installation (e.g., specification of ground or flight testing or both, as necessary).

5.2.16.2 Re-certification.

Re-certification of an ILS function following the Introduction of a New or Modified ILS Navigation Receiver Installation. The certification program should consider the differences between the new configuration and the pre-existing ILS receiver system. The applicant may use an impact assessment to propose a certification basis. The assessment will typically address the following: 5.2.16.2.1 New or Modified ILS Impact Assessment.

• An impact assessment should consider the following aspects of the new or modified ILS receiver, or receiver function, for equivalence with the existing ILS receiver configuration: o Hardware design; o Software design; o Signal processing and functional performance; o Failure analysis; o Receiver function, installation, and integration (e.g., with controls, indicators, and warnings).

5-23 AC 20-191 • The impact assessment should also identify any additional considerations such as: o Future functionality provisions that have no impact on system operation; o Shared resources to support future functionality; o Based upon the assumption that the applicant can show the ILS receiver, or receiver function, to be equivalent to the current ILS configuration, the applicant may propose that the new installation be treated as a new ILS receiver (replacing the existing receiver) for installation on a given aircraft type.

5.2.16.2.2 New or Modified ILS Failure Analysis.

The failure characteristics of the new or modified installation should be reviewed, and shown to be equivalent to systems using ILS data. This ensures that the failure characteristics are compatible with and do not invalidate any original or previous safety assessments.

5.2.16.2.3 New or Modified ILS Autoland or HUD Guidance Landing Function Flight Testing (if necessary).

5.2.16.2.4 The flight test program should include a minimum of 15 approaches terminating in a successful (automatic or HUD) landing and rollout (if applicable) using the flight control/guidance system. Applicants should use a minimum of two ILS facilities. Approaches should include captures from both sides of the final approach course, at angles and distances representative of typical Instrument Approach Procedures (IAPs), and, if applicable, from below and above the GS. If unable to show equivalency, then the applicant should conduct a complete flight test program per section 5.4.2.

5.2.16.2.5 Approach and Landing Performance.

The applicant should show the approach and landing performance (flight path deviation, touchdown data, etc.) as appropriate is equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to support an equivalency demonstration.

5.2.16.2.6 New or Modified ILS Documentation.

The applicant should provide the following documentation for certification: • An impact assessment including effects on system safety assessments; 5-24 AC 20-191 • A flight test report, if applicable; • Revisions to the flight manual where appropriate.

5.2.16.3 Recertification following the Introduction of a new or modified GLS Navigation Receiver Installation.

5.2.16.3.1 GLS Introduction Impact Assessment.

The impact assessment, if applicable, should assess equivalent aspects of the GLS receiver or receiver function to those for the existing ILS receiver configuration.

5.2.16.3.2 GLS aircraft Integration/Installation Failure Mode and Effects Analysis.

The applicant should review the failure characteristics of the new or modified installation to ensure the failure characteristics do not invalidate any original or previous safety assessments.

5.2.16.3.3 GLS Statistical Performance Assessment.

If the flight control/guidance system control algorithms are unchanged or the applicant has already accounted for the effects of any changes (e.g., navigation reference point), the applicant may not have to re-assess the statistical performance assessment of a currently certificated automatic landing system or HUD landing or takeoff system for the addition of GLS functionality.

5.2.16.3.4 GLS Antenna or Navigation Reference Point Location.

The applicant should assess the implication of differences in position of the GLS and ILS aircraft antennas or navigation reference point considering: • Wheel-to-threshold crossing height; • Lateral and vertical antenna position or navigation reference point position effects on flight guidance system performance (including any alignment, flare, or rollout maneuvers).

5.2.16.3.5 GLS Introduction Flight Testing (as necessary).

When installing a GLS system to support CAT III operation, the applicant must accomplish a flight test program including a minimum of 30 approaches. The approaches must terminate in a landing and rollout (if applicable) using the flight control/guidance system, and the approaches must include a minimum of two GLS facilities. The approaches should include captures from both sides of the final approach course using representative angles and distances, captures from below and 5-25 AC 20-191 above the glidepath if applicable, and representative wind conditions where antenna or navigation reference point positions may impact performance.

5.2.16.3.6 Approach and Landing Performance.

The approach and landing performance (flight path deviation, touchdown data, etc.) must be equivalent to that achieved in the original ILS certification. The FAA may require recorded flight test data to confirm equivalency. If unable to show equivalency, then the applicant should conduct a complete flight test program per section 5.4.2.

5.2.16.3.7 GLS Certification.

The applicant should provide the following documentation for GLS certification: • An impact assessment including effects on system safety assessments, • A flight test report, if applicable, and • Revisions to the flight manual where appropriate.

5.3 Airborne Systems for CAT III.

The airborne system should meet the performance, integrity, and availability provisions identified in this AC, as applicable to the type(s) of operation(s) intended. In addition, airborne systems intended for use for CAT III approach and landing or approach, landing, and rollout must meet the pertinent provisions of sections 5.2.10 and 5.2.11 of this chapter.

5.3.1 Automatic Flight Control Systems.

When established on a final approach path below 1000 ft. HAT, it must not be possible to change the flight path of the aircraft with the autopilot(s) engaged, except by initiating an automatic go-around.

5.3.1.1 The automatic landing system must be able to be disengaged at any time without the pilot facing significant out-of-trim forces that might lead to an unacceptable flight path disturbance.

5.3.1.2 Pursuant to 14 CFR §§ 23.2135, 25.143, 27.143, or 29.143 as applicable, each pilot must be able to disengage the automatic landing system by applying a suitable force to the control column, wheel, or stick. This force should be high enough to preclude inadvertent disengagement, and low enough to be applied with one hand.

5.3.1.3 Following a failure or inadvertent disconnect of the autopilot, or loss of the automatic landing mode, when it is necessary for the pilot to immediately assume manual control, the aircraft must provide a visual alert and an aural 5-26 AC 20-191 warning. This warning must be given without delay and be distinct from all other cockpit warnings. Even when the pilot disengages the autopilot, the warning must sound for a period long enough to ensure that both the pilot and the other flight crew can hear and recognize the sound. The warning should continue until one of the pilots silences the warning using an autopilot quick release control, or another acceptable means. For purposes of this provision, an autopilot quick release control must be mounted on each control wheel or control stick.

5.3.2 Autothrottle/Autothrust Systems.

For 14 CFR Part 25 aircraft, the autothrottle/autothrust system should follow the guidance in AC 25.1329-1 and the following criteria when used with a low visibility landing system. For 14 CFR Parts 23, 27 and 29 aircraft, AC 25.1329-1 may be used as a guidance, as much as applicable.

5.3.2.1 Include automatic control of throttles/thrust to touchdown unless the applicant shows: • Aircraft speed can be controlled manually without excessive workload, in representative conditions for which the system is intended and as demonstrated; and • For manual control of throttles/thrust, the touchdown performance limits will be achieved both for normal autopilot operations and applicable non-normal operations (e.g., engine failure, as applicable; during pilot takeover to manual control using HUD guidance, if part of a hybrid system).

5.3.2.2 An automatic throttle system must provide safe operation and should: • Adjust throttles to maintain aircraft speed* within acceptable limits, Note: * The approach speed may be selected manually or automatically. If automatically selected, each pilot must be able to determine that the aircraft is flying an appropriate speed.

• Provide throttle application at a rate consistent with the recommendations of the appropriate engine and airframe manufacturers, • Modulate thrust or throttle application at a rate consistent with, and activity consistent with typical pilot expectation, considering speed error to be corrected, and any conditions or circumstances (e.g., flare retard, go-around thrust application, response to wind gradients), and • Respect maximum limits, minimum limits, and any limits necessary for specific conditions (e.g., anti-ice, approach idle).

5-27 AC 20-191 5.3.2.3 An indication of pertinent automatic throttle system engagement must be provided.

5.3.2.4 The Autothrottle/Autothrust Systems must provide an appropriate alert or warning of automatic throttle failure.

5.3.2.5 It must be possible for each pilot to override the automatic throttle (when provided) without using excessive force.

5.3.2.6 Automatic throttle disengagement switches must be mounted on or adjacent to the throttle levers where they can be operated without removing the hand from the throttles.

5.3.2.7 Following a failure, failure disconnect, or inadvertent disconnect of the automatic throttle, or uncommanded loss of a selected automatic throttle mode, a suitably clear and compelling alert should be provided.

5.3.3 Automatic Braking System.

If an applicant seeks credit for the use of automatic braking, then the following apply.

5.3.3.1 The automatic braking system should incorporate the anti-skid protection and have manual reversion capability. An automatic braking system should provide smooth and continuous deceleration from touchdown until the aircraft comes to a complete stop on the runway and: • Disconnect of the autobrake system must not create unacceptable additional flight crew workload or flight crew distraction from normal rollout braking.

• Normal operation of the automatic braking system should not interfere with the rollout control system. Manual override of the automatic braking system must be possible without excessive brake pedal forces or interference with the rollout control system. The system should not be susceptible to inadvertent disconnect.

• The automatic braking system should provide a positive indication of system disengagement and a conspicuous indication of system failure.

• No malfunction of the automatic braking system should interfere with either pilot’s use of the manual braking system.

5.3.3.2 The wet and dry runway braking distances, for each mode of the automatic braking system, should be determined and presented in the AFM as performance information. This will assist operators in complying with 14 CFR §§ 121.195 (d), 135.385 (d), and 91.1037 (e).

5.3.4 Head Up Guidance.

5.3.4.1 An applicant can use this section when the Head Up Guidance landing system is intended for manual "pilot-in-the-loop" control during a low 5-28 AC 20-191 visibility approach and landing, and if applicable, a low visibility rollout.

The HUD must provide sufficient command information as guidance to enable the pilot to maintain the approach path, to make the alignment with the runway, flare, and land the aircraft within the prescribed limits. The HUD must also provide sufficient information to enable the pilot to initiate a go-around without reference to other cockpit displays. The HUD should follow the guidance found in AC 25-11 and this section.

5.3.4.2 The workload associated with use of the HUD must comply with the minimum flightcrew requirements found in 14 CFR §§ 23.2610, 25.1523, 27.1523, or 29.1523, as applicable. Reference AC 23.1523, AC 25.1523-1, and AC 25-11, AC 27-1, or AC 29-2 for additional guidance, as applicable.

5.3.4.3 Any HUD installation or HUD display presentation must comply with the requirements found in §§ 23.2600(a), 25.773, 27.773, or 29.773, as applicable. Reference AC 23.1311-1, 25.773-1 and AC 25-11; or AC 27-1; or AC 29-2 for additional guidance, as applicable.

5.3.4.4 Head Up Guidance systems may be considered fail passive if, after a failure, the aircraft's flight path does not experience a significant, immediate deviation due to the pilot following the failed guidance, before detecting the failure and discontinuing its use.

5.3.4.5 If an automatic flight control system is used to control the flight path of the aircraft prior to establishing manual "pilot-in-the-loop" HUD guidance on final approach, the transition from automatic to manual flight mode must be evaluated during the HUD demonstration, the automatic flight control system demonstration, or both demonstrations. One such example is when the aircraft uses the autoflight system to intercept and establish tracking of the final approach path.

5.3.4.6 During demonstration of any HUD intended for manual "pilot-in-the-loop" flight guidance for CAT III approach and landing, both landing cases and go-around cases should be demonstrated where: • External visual reference is available at or below 50 ft. HAT to touchdown; • External visual reference is not available at any time below 50 ft. HAT to touchdown, and, if applicable, is also not available for rollout; • External visual references, HUD, and instrument references disagree (e.g., LOC centering errors).

5.3.4.7 If rollout guidance is provided on the HUD, the HUD information must enable the pilot to safely control the aircraft along the runway after touchdown within the prescribed limits. Both normal tracking and any 5-29 AC 20-191 applicable non-normal capture or tracking conditions (e.g., recovery from displacements) should be assessed.

5.3.4.8 After touchdown, loss of a fail passive rollout system for manual control with guidance, must be annunciated with an appropriate visual alert and removal of the command guidance.

5.3.5 Hybrid HUD/Autoland Systems.

A hybrid HUD/autoland system combines a fail passive autoflight capability and a fail passive HUD to establish a fail operational system for CAT III operations. Equipping with two fail passive systems does not necessarily create a fail operational system. The applicant must meet the broader performance provisions of Chapter 5 as well as the specific criteria of this section to qualify your hybrid system as fail operational. The applicant can use the following guidance, or establish an acceptable means of compliance to qualify the hybrid system as fail operational: 5.3.5.1 Approach and Landing: 5.3.5.1.1 The applicant shows each system element independently meets its respective performance criteria for a fail passive system.

5.3.5.1.2 The automatic landing system must be the primary means of control, with the manual flight guidance system serving as a backup mode or reversionary mode.

5.3.5.1.3 Hybrid systems without automatic rollout capability must provide manual rollout flight guidance capability. The applicant must show the manual rollout capability has the performance and reliability at least equivalent to that required of a fail passive automatic rollout system.

5.3.5.1.4 The transition between automatic mode of operation and manual mode of operation should not require extraordinary skill, training, or proficiency.

5.3.5.1.5 If the system requires a pilot to initiate manual control at or shortly after touchdown, the applicant must show the transition from automatic control prior to touchdown to manual control using the remaining element of the hybrid system (e.g., HUD) after touchdown is safe and reliable.

5.3.5.1.6 The applicant must demonstrate the capability of the pilot to use a hybrid system to safely accomplish the landing and rollout, following a failure of one of the hybrid system elements below AH even if operational procedures require the pilot to initiate a go-around.

5.3.5.1.7 The system must provide appropriate annunciations to the 5-30 AC 20-191 flight crew to ensure a safe operation.

5.3.5.1.8 The applicant must demonstrate the combined elements of the system meet the required fail operational criteria necessary to support the operation.

5.3.5.1.9 The applicant must show the overall system meets the accuracy, availability, and integrity criteria suitable for fail operational systems. The applicant must also show each component is individually reliable (e.g., a highly reliable automatic flight control system and an unreliable HUD would not be acceptable).

5.3.5.1.10 Hybrid System Transition from Automatic to Manual Flight.

The applicant must demonstrate a safe manual takeover of aircraft control to complete the landing within the established touchdown footprint. The demonstration should consider the use of appropriate takeover response time delays for the transition. The applicant must conduct these demonstrations in the following conditions: • Without external visual reference, • With visual reference, and • With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).

5.3.5.2 Hybrid System Touchdown Capability.

5.3.5.2.1 Demonstrations are necessary for each element of the hybrid system for low altitude go-around, in the altitude range between 50 ft. HAT to touchdown.

5.3.5.2.2 The applicant must conduct hybrid system demonstrations in the following conditions: • Without external visual reference, • With visual reference, and • With the presence of external visual reference that disagrees with instrument reference (e.g., LOC centering errors).

5.4 Landing and Rollout System Evaluation.

The applicant should conduct an evaluation to verify that the pertinent systems as installed in the aircraft meet the airworthiness criteria identified in section 5.2 of this 5-31 AC 20-191 chapter. The evaluation should include verification of landing and rollout system performance and a system safety assessment for verification of the integrity and availability performance provisions. The applicant should demonstrate engine failure cases and other selected failure conditions identified by the safety assessment using simulator or flight tests or both.

5.4.1 Certification Plan.

An applicant should provide a certification plan that describes how any non-aircraft elements of the landing and rollout system relate to the aircraft system from a performance, integrity, and availability perspective.

5.4.1.1 The certification plan should describe the system concepts and operational philosophy to allow the regulatory authority to determine whether criteria and performance provisions other than those contained in this AC are necessary.

5.4.1.2 The applicant should apply criteria contained in this AC, an equivalent foreign standard acceptable to the Administrator, or any other criteria acceptable to the Administrator for the landing and rollout system.

5.4.1.3 The safety level for automatic landing and rollout, or manual landing and rollout using command information as guidance, may not be less than that achieved by a conventional unguided manual landing using visual reference.

In showing compliance with the performance and failure criteria, the applicant may not factor the proportion of landings made with the landing and rollout system into the probabilities of performance or failure effects.

5.4.1.4 The applicant should establish the landing and rollout system performance considering the environmental and deterministic effects that the applicant expects to experience for the type of operation for which the applicant seeks certification and operational approval.

5.4.1.5 Command information provided as guidance during the landing and rollout should be consistent with a pilot’s manual technique and not require excessive skill or flight crew workload to accomplish the operation.

5.4.1.6 For those segments of the flight path where an applicant takes credit for non-automatic systems, the applicant must show acceptable performance of those systems for landing and rollout by reference to instruments alone without requiring the use of external visual reference. This performance 5-32 AC 20-191 demonstration is appropriate because the landing rollout may begin off centerline and at higher speed.

5.4.1.7 When a system relies on the pilot to detect a selected mode engagement failure, and the pilot cannot reliably detect this failure by other means, the system must provide an appropriate indication or warning.

5.4.1.8 The transition from automatic control to manual control may not require exceptional piloting skill, alertness, or strength.

5.4.1.9 The applicant should show the means proposed to meet the airworthiness performance criteria of section 5.2, with particular attention to methods that differ significantly from those described in this chapter.

5.4.1.10 The assumptions on how the performance, integrity, and availability requirements of the non-aircraft elements will be ensured.

5.4.1.11 The applicant should reach early agreement with the FAA on the proposed certification plan.

5.4.2 Performance Evaluation.

The applicant must demonstrate the performance of the aircraft and its systems by either flight test or by analysis and simulator tests supported by flight test.

5.4.2.1 The performance evaluation must verify that the landing and rollout system meets the performance provisions of section 5.2.8, section 5.2.9, section 5.2.10, and section 5.2.13 in this chapter. The tests must cover: • Range aircraft configurations, weight, center of gravity, etc.

• Variations in flight path determination associated with the sensors used by the landing and rollout system.

• A sufficient number of normal and non-normal approaches.

• Conditions which are reasonably representative of actual expected conditions. When evaluating performance in a range of wind conditions, applicants should use the wind model in Appendix B, or other model found acceptable by the Administrator.

5.4.2.2 The applicant must identify the reference speed used as the basis for certification. The applicant must demonstrate acceptable performance within a speed range of -5 to +10 knots with respect to the reference speed, unless otherwise agreed by the FAA and the applicant. The reference speed used as the basis for certification should be the same as the speed used for normal landing operations, including wind and other environmental conditions.

5.4.2.3 The applicant must demonstrate the landing and rollout system does not exhibit any guidance system or abnormal control characteristics during the 5-33 AC 20-191 transition to rollout causing the flight crew to react in an inappropriate manner (e.g., during nose wheel touchdown, spoiler extension, initiation of reverse thrust).

5.4.2.4 Landing systems for manual control with guidance must meet the same performance provisions for touchdown footprints, sink rates, and attitude as automatic landing systems.

5.4.2.5 The applicant must demonstrate satisfactory performance of landing and rollout system with and without the use of any outside visual references.

The applicant must determine whether the combination of guidance and outside visual references would unacceptably degrade task performance, require excessive pilot compensation or workload during normal and non- normal operations.

5.4.2.6 For GLS, the applicant must assess fault free performance of GLS using simulations such as Monte-Carlo with the input variables distributed according to their performance characteristics and a model of the GLS guidance including fault free error characteristics defined by the GLS signal model as specified in 5.5.8 Appendix C or another equivalent model.

5.4.2.7 For low visibility systems for manual control with guidance, the applicant must demonstrate rollout guidance without external visual reference to show a pilot can satisfactorily perform the lateral tracking task with the guidance alone. The applicant must also demonstrate rollout guidance with external visual references to show the combination of guidance and visual reference is compatible and does not unacceptably degrade task performance, or require excessive pilot compensation or workload during normal and non- normal operations.

5.4.2.8 For the evaluation of low visibility systems for manual control with guidance for landing or rollout, the set of subject pilots provided by the applicant should have relevant variability of experience (e.g., experience with or without HUD, Captain or First Officer flight crew position experience as applicable, and experience in type). Subject pilots must not typically have special experience that invalidates the test (e.g., pilots should not have special recent training to cope with HUD failures, beyond that which a line pilot would be expected to have for routine operation).

5.4.2.9 Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.

5.4.2.10 For the initial certification of a landing and rollout system for manual control with guidance (e.g., HUD guidance system) in a new type aircraft or new type HUD installation, at least 1,000 simulated landings and at least 100 actual aircraft landings are typically necessary. For evaluation of these systems, individual pilot performance should also be considered as a variable affecting performance, see section 5.2.9.9. As described in the 5-34 AC 20-191 section above, subject pilots of varying background and experience level should be used in the flight and simulation programs. Subject pilots should have appropriate qualifications and, when applicable, be trained in the use of the landing system in a manner equivalent to that expected for pilots who will use the system in operational service.

5.4.2.11 For data collection tests, after a significant number of consecutive approaches (e.g., 10 approaches), subject pilots should be afforded the opportunity for an appropriate rest break.

5.4.3 High Altitude Automatic Landing System Demonstration.

5.4.3.1 The following describes an acceptable means to demonstrate performance of automatic landing systems at high altitude with a combination of flight test results and validated simulation. The highest airport elevation, at which satisfactory performance of an automatic landing system has been demonstrated by this method, should be documented in the AFM. The flight test demonstration is considered the primary data source, which can then be supplemented with data from a validated simulation.

5.4.3.2 The simulation and flight test demonstrations must show that the system successfully performs in accordance with the nominal landing criteria found in section 5.2.9.4 and section 5.2.9.5. When there are cases that do not satisfy the touchdown box criteria, and there is data to establish that these cases were the result of abnormal circumstances not related to system performance, then each of these cases must be successfully re- accomplished.

5.4.3.3 High altitude performance simulations should be conducted to verify that the guidance performs safely up to the altitude selected by the applicant.

The minimum required altitude or elevation for the flight test which is used to demonstrate a desired AFM Elevation Value, by this method, is shown in Figure 5-1, below. For example, the applicant may document an AFM Elevation Value of 8,000 ft., by a successful flight demonstration at 8,000 ft., or by a flight demonstration at a minimum elevation of 5,000 ft. with a simulation to the desired 8,000 ft. Note the lines in Figure 5-1 converge at 11,000 ft., which indicates that credit for simulation is not available at 11,000 ft. or above.

5.4.3.4 The atmospheric temperature and pressure during the flight test, for either method, should not be more favorable than International Standard Atmosphere (ISA) conditions to ensure the density altitude is not less than the airport elevation. When the density altitude value of the flight test is less than the airport elevation, then the density altitude value should be used as 5-35 AC 20-191 the effective flight test demonstrated elevation and this will decrease the maximum AFM elevation value.

5.4.3.5 Assuring acceptable autoland performance at high altitude by using a flight test validated by simulation requires a sufficient quantity of flight test data.

Flight test data should be obtained from approximately 10-15 landings at a flight test demonstrated elevation shown in Figure 5-1.

5.4.3.6 For flight validation, the test aircraft should be equipped with instrumentation to measure and record: 5.4.3.6.1 The aircraft's trajectory, using an acceptably accurate method, such as by a Differential Global Positioning System (DGPS) receiver, a laser optical tracker, a calibrated camera, or other equivalent method.

5.4.3.6.2 Touchdown vertical velocity and runway touchdown point, expressed in suitable units and coordinates.

5.4.3.6.3 GS and LOC signal deviations.

5.4.3.6.4 Aircraft state parameters as necessary, including relevant engine and flight control information.

5.4.3.6.5 Relevant autopilot, autothrottle/autothrust or HUD guidance system parameters and performance or both.

5.4.3.6.6 Atmospheric conditions at the airport at the time of each approach, including temperature, barometric pressure (QNH), mean wind velocity, and direction.

5.4.3.7 The applicant should validate the simulation through comparison of simulation data with quantitative flight test measurements. The applicant should compare time histories of the aircraft and systems performance in the approach, flare, touchdown, rollout, and go-around flight phases, for flight tests at the Flight Test Demonstration Elevation with corresponding simulation results. The comparison between the flight test data and the simulation data should show the two are consistent at corresponding altitudes.

5.4.3.8 The applicant may determine acceptable autoland performance at the selected AFM elevation based on validated simulation results, within the acceptable extrapolation range for flight test data shown in Table 5-1. To assure acceptable autoland performance in a range of altitudes and atmospheric conditions up to and including the selected AFM elevation, the simulation should include variation in atmospheric conditions at least as listed below. The applicant should conduct a sensitivity analysis to assure 5-36 AC 20-191 that performance is safe near any limits. Unless otherwise found acceptable to the FAA, simulation cases should typically include the following: 5.4.3.8.1 Temperatures ranging from ISA value to ISA +40C.

5.4.3.8.2 Barometric pressure ranging from ISA value for that elevation to ISA -50 hPa.

5.4.3.8.3 Mean wind variations, including: • Headwinds to at least 25 knots.

• Crosswinds to at least 15 knots.

• Tailwinds to at least 10 knots.

5-37 AC 20-191 Figure 5-1 AFM Elevation Value From Flight Test And Validated Simulation 5-38 AC 20-191 Table 5-1: Example AFM Elevation Values Flight Test Demonstration Airport Airport Elevation Value Elevation (feet above mean sea level) Which May Be Listed in the AFM (feet above mean sea level) 1,000 6,000 2,000 6,500 3,000 7,000 5,000 8,000 7,000 9,000 9,000 10,000 11,000 11,000 5.4.4 Validation of Simulators for Pilot-in-the-Loop Systems.

The certification process for a "Pilot-in-the-Loop" system intended for Category III typically requires use of a high-fidelity engineering quality simulation.

5.4.4.1 AC 120-40, as amended, and 14 CFR Part 60 provide a means to qualify simulators for qualification of pilots. Meeting these performance provisions provides a known basis for acceptance of simulation capability, and is desirable, but may not necessarily be sufficient to meet the performance threshold of an engineering simulation to demonstrate landing system performance.

5.4.4.2 Training simulators may not have suitable fidelity in each relevant area, and may not be acceptable for use without modification. For purposes of system airworthiness demonstration, meeting the criteria of AC 120-40 is optional.

Meeting the criteria of this AC provides an acceptable basis for establishing certification simulation capability.

5.4.4.3 When simulation is used for demonstration of manual "pilot-in-the-loop" systems with guidance, the applicant should address suitable simulation fidelity for at least each critical characteristic affecting the validity of the simulation. An acceptable simulation should typically be capable of varying one parameter at a time and be able to facilitate examination of the effects of 5-39 AC 20-191 specific wind, wind gradient, and turbulence conditions on approach and landing performance.

5.4.4.4 Factors of the simulation an applicant should consider include the following: • Guidance and control system interfaces; • Motion base suitability; • "Ground effect" aerodynamic characteristics; • Wind/turbulence model suitability and adequacy of interface with the simulation; • Suitability of landing gear and ground handling dynamics; • Adequacy of stability derivative estimates used; • Adequacy of any simplification assumptions used for the equations of motion; • Fidelity of flight controls and consequent simulated aircraft response to control inputs; • Fidelity of the simulation of aircraft performance; • Suitability of the simulation for alignment, flare, and rollout control tasks for any normal or non- normal configurations or disturbance conditions to be assessed; • Adequacy of instruments and displays; • Adequacy of simulator and display transient response to disturbances or failures (e.g., engine failure, autofeather, electrical bus switching); • Visual reference availability, fidelity, and delays; • Suitability of visibility restriction models such as appropriate calibration of visual references for the tests to be performed for day, night, and dusk conditions as necessary; • Ability to simulate flight deck visual cutoff angles; • Ability to simulate fog, rain, snow, or patchy or intermittent conditions or external visual runway, lighting, marking or nearby terrain scenes as necessary; and • Fidelity of any other significant factor or limitation relevant to the validity of the simulation.

5.4.4.5 For airworthiness certification credit, a review of the simulation, on a case- by-case basis, must address at least the following factors: • Simulation fidelity relevant to landing system assessment; 5-40 AC 20-191 • Stability derivatives, equation of motion assumptions, and relevant ground effect and air and ground dynamic models used; • Adequacy of the source of aerodynamic performance and handling quality data used; • Visual system fidelity and configuration; • Environmental models and methods of model input to the equations of motion, including suitable incorporation of altitude and atmospheric temperature effects; • Adequacy of adverse weather models (e.g., visual reference models, runway friction); and • Adequacy of irregular terrain models.

5.4.4.6 A suitably high degree of fidelity is required in each relevant component part of the simulation including: • Longitudinal, lateral and directional stability (static and dynamic); • Ground effect during takeoff or landing as applicable; • Rollout dynamic characteristics; • Propulsion system characteristics, (especially for turbo-propeller aircraft which may have significant lift from thrust effects, and drag transient effects due to engine failure); • Flying qualities; • Display or visual system capability as it affects tracking tasks; • Force characteristics of flight controls (e.g., yoke/wheel, rudder, brakes); and • Performance of the aircraft.

5.4.4.6.1 The applicant may demonstrate the fidelity of the simulator using matching time histories and ensemble touchdown footprint correlation obtained from flight test. The applicant will include the data provided to validate the simulation and the simulation data itself as part of the type certification data package.

5.4.5 Simulations for Automatic System Performance Demonstration.

5.4.5.1 The certification process for systems intended for assessment of automatic systems for Category III operations (e.g., automatic landing systems, 5-41 AC 20-191 automatic landing and rollout systems) typically require the use of a high fidelity "fast-time" simulation.

5.4.5.2 For airworthiness certification credit, a review of the simulation, on a case- by-case basis, must address at least the following factors: • Simulation fidelity relevant to landing system assessment; • Stability derivatives, equation of motion assumptions, and relevant ground effect and air and ground dynamic models used; • Adequacy of the source of aerodynamic performance and handling quality data used; • Disturbance input method(s) and fidelity; • Environmental models and methods of model input to the equations of motion, including suitable incorporation of altitude and atmospheric temperature effects; • Adverse weather models (e.g., turbulence, wind gradients, wind models); and • Adequacy of irregular terrain models.

5.4.5.3 Fidelity of the aerodynamic model is needed for at least ground effect, propulsion effects, touchdown dynamics, de-rotation, and landing gear models if required for ground rollout characteristics. The fidelity of the simulator may be demonstrated using matching time histories obtained from flight test. The data provided to validate the simulation and the simulation data itself will be included as part of the type certification data package.

5.4.6 Flight Test Performance Demonstration.

The applicant should conduct a flight test performance demonstration in part, to confirm the results of simulation. A test aircraft equipped with special instrumentation can be used to record the necessary flight test data, for subsequent correlation of flight test results with simulation results. Comparisons should address flight test data, "Monte Carlo simulation" results, and failure demonstration simulation results.

5.4.6.1 The principal performance parameters the applicant must address include, as applicable: • Vertical and lateral flight path tracking with respect to the intended path (e.g., LOC error, GS error, lateral deviation, GLS path deviation error, from runway centerline during rollout); • Altitude and height above terrain during approach or the runway; • Air data vertical speed and radar altitude sink rate; • Airspeed and ground speed; and • Longitudinal and lateral runway touchdown point.

5-42 AC 20-191 5.4.6.2 Instrumentation capable of appropriate sample rates and scaling should be used to record relevant parameters (as a function of time, when applicable) including: • Air data parameters (e.g., airspeed, angle of attack, temperature); • Aircraft position; attitude; heading; • Track; velocity and velocity errors (e.g., ground speed, speed error), relevant accelerations; • Pilot control inputs and resulting surface positions, command information (i.e., flight director), sink rate at touchdown (for structural limit load); • Drift angle at touchdown (for gear/tire load); • Applicable mode and mode transition information (e.g., flare, autothrottle/autothrust retard, rollout engage); • Wind as measured at the aircraft; • A method to determine any unusual aircraft contact with the runway (e.g., wing, nacelle, or tail skid ground contact); and • Reported surface winds and gusts near the runway, at the time of approach and landing.

5.4.6.3 Data taken during demonstration flight tests should be used to validate the simulation(s). Unless otherwise agreed to by the FAA, the objective of a flight test program should be to demonstrate performance of the system to 100% of the steady state wind limit values (e.g., typically at least a 25 kt headwind, 15 kt crosswind, and 10 kt tailwind) that are used in the simulation statistical performance analysis. The simulation is considered validated if at least four landings are accomplished during flight test at no less than 80% of the intended limit steady state wind value, and a best effort has been made to achieve the full steady state wind component values. The landing system must be robust near the desired AFM wind demonstrated values.

5.4.7 Demonstration of Approach and Automatic Landing with an Inoperative Engine.

5.4.7.1 When an applicant demonstrates the low visibility landing system with an inoperative engine, the AFM may state that capability was satisfactorily demonstrated. With the critical engine inoperative, the applicant may demonstrate the capability to “initiate” and complete the approach and landing. Alternatively, the applicant may demonstrate the capability to “continue” the approach and landing following failure of the critical engine at any point above the AH or DH.

5.4.7.2 The applicant should identify the critical engine, if any, considering any steady state or transient effects on performance, handling, loss of systems, 5-43 AC 20-191 and landing mode status (e.g., alignment, flare, rollout). Individual engines may be critical for different reasons.

5.4.7.3 If the aircraft configuration, procedures or operation are the same as those used in section 5.2.9 for all-engine operation performance demonstration, compliance may be demonstrated by 10 to 15 landings. If there are differences in these aircraft configurations, procedures or operations, the number of required landings will be determined by FAA on a case-by-case basis.

5.4.7.4 If the aircraft configuration, procedures or operation is changed significantly from the all-engine operating case, the applicant must demonstrate compliance by statistical analysis or Monte-Carlo simulation results supported by flight test. Any effect on configuration or landing distance must be considered.

5.4.7.5 To aid planning for landing with an inoperative engine or engine failure during approach or go-around, appropriate procedures, performance, and obstacle clearance information should be available to permit an operator to conduct a safe go-around at any point in the approach to touchdown. For the purposes of this performance provision, demonstration or data regarding landing and go-around performance in the event of a second engine failure need not be considered.

5.4.7.6 If compliance for the case of initiation or continuation of an approach with engine failure is intended, a statement must be included in the non-normal procedures or equivalent section of the flight manual.

5.4.7.7 The flight manual should note that approach and automatic landing with an engine inoperative has been satisfactorily demonstrated. The AFM should list the relevant configuration and conditions under which that demonstration was made.

5.4.8 Safety Assessment .

In addition to any specific safety related criteria identified in this chapter, the applicant must conduct a safety assessment of the landing and rollout system, considered separately and in conjunction with other systems, to show compliance with §§ 23.2500, 23.2510, 23.2605, 25.1309, 27.1309, or 29.1309 per the guidance contained in AC 23.1309-1, AC 25.1309-1, AC 27-1, or AC 29-2, as applicable.

5.4.8.1 The applicant must consider the responses to failures of navigation facilities.

The applicant must take into account ICAO and other pertinent State criteria for navigation facilities.

5.4.8.2 Documented conclusions of the safety analysis must include: 5.4.8.2.1 Pursuant to §§ 23.2500, 23.2510 and 23.2605, 25.1309, 27.1309, or 29.1309, an FHA conducted in accordance with 5-44 AC 20-191 AC 23.1309-1, AC 25.1309-1, AC 27-1, or AC 29-2, respectively; a summary of results from the fault tree analysis, demonstrated compliance, and probability determination for significant functional hazards.

5.4.8.2.2 Information regarding "alleviating flight crew actions" that were considered in the safety analysis. This information should list appropriate alleviating actions, if any, and should be consistent with the validation conducted during testing. If alleviating actions are identified, the applicant should describe the alleviating actions in a form suitable to aid in developing, as applicable: • Pertinent provisions of the AFM procedures section(s).

• FCOM provisions, or equivalent.

• Pilot qualification criteria (e.g., training requirements, FSB provisions).

• Any other reference material necessary for an operator or flight crew to safely use the system.

5.4.8.2.3 Information to support preparation of any maintenance procedures necessary for safety such as: • CMRs.

• Periodic checks.

• Other checks, as necessary (e.g., return to service).

5.4.8.2.4 Information applicable to limitations, as necessary.

5.4.8.2.5 Identification of applicable systems, modes, or equipment necessary for use of the landing system. This information may be used to aid in development of flight planning, dispatch criteria, or procedures or checklists for pilot selection of modes or assessment of system status, prior to initiation of approach or during approach.

5.4.8.2.6 Information necessary for development of Non-normal procedures.

5.4.9 Continued Airworthiness.

5.4.9.1 Pursuant to §§ 23.1529, 25.1529, 27.1529, or 29.1529, an applicant must prepare an ICA for use by operators. The applicant must submit to the FAA a program showing how the applicant distributes changes made to the ICAs by the applicant or by the manufacturers of the ILS or GBAS avionics 5-45 AC 20-191 installed in the aircraft. ICAs established during the approval process form the basis for an operator’s maintenance program.

5.4.9.2 Pursuant to 14 CFR §§ 21.3, the applicant must report any failure, malfunctions or defect whose occurrences could impact the safety of the flight crew or the structural integrity of the aircraft itself.

5.5 Aircraft Flight Manual.

Pursuant to 14 CFR §§ 23.2620, 25.1581, 27.1581, or 29.1581, as applicable, an applicant must furnish AFM with each aircraft. The AFM should contain the following information: Upon satisfactory completion of an airworthiness assessment and test program, the FAA-approved AFM or supplement, and any associated markings or placards, if appropriate, should be issued or amended to address the following: 5.5.1 Relevant conditions or constraints applicable to landing or landing and rollout system use regarding the airport or runway conditions. For example: • Runway elevation • Ambient temperature • Approach path slope • Runway slope • Ground profile under the approach path 5.5.2 The criteria and configurations used for the demonstration of the system.

5.5.3 Any constraints or limitations necessary for safe operation.

5.5.4 Acceptable normal and non-normal procedures (including procedures for response to loss of guidance).

5.5.5 The type of navigation facilities used as a basis for demonstration. This should not be taken as a limitation on the use of other facilities. The AFM may contain a statement regarding the type of facilities or condition known to be unacceptable for use (e.g., ILS or GLS systems). The AFM should indicate that operation is predicated upon the use of an ILS (or GLS) facility with performance and integrity equivalent to, or better than, a United States Type II or Type III ILS, GBAS GAST D or equivalent ICAO Annex 10 Facility Performance Category III facility.

5.5.6 Applicable atmospheric conditions under which the system was demonstrated (e.g., headwind, crosswind, tailwind) should be described as follows: 5.5.6.1 In the limitations section, the wind component values used as a basis for statistical analysis, as supported by flight evaluation and validation, which 5-46 AC 20-191 may apply to use of the landing system, such as if credit for use is sought for low visibility operations, 5.5.6.2 In the normal operations section, or equivalent section, maximum wind component values experienced during the flight demonstration, described as "Demonstrated Wind Component(s)," 5.5.6.3 For use of the landing system other than for low visibility credit (e.g., in wind or other conditions where system performance may not necessarily be supported by the statistical analysis), any necessary description of considerations, if other than the maximum demonstrated wind component values for the basic aircraft apply.

Note: The FAA does not apply a "landing system" wind limitation unless unacceptable system characteristics dictate use of a limitation. This is consistent with specification of the demonstrated wind component value for the basic aircraft, which is included in the AFM for information, and is not limiting.

5.5.7 For a landing or landing and rollout system meeting provisions of this chapter, the normal procedures, normal operations, or equivalent section, of the AFM should also contain the following statements: "The airborne system has been demonstrated to meet the airworthiness provisions of AC 20-191 Chapter 5 for [specify the pertinent Landing or Landing and Rollout Capability Section(s) criteria met] when the following equipment is installed and operative: [list pertinent equipment] "This AFM provision does not constitute operational approval for Category III use of this system."

5.5.8 The AFM provisions: • May list the AH demonstrated AH; • Should not include visual segment specifications.

Examples of general AFM considerations, specific AFM provisions, and location of those provisions for applicable landing or landing and rollout systems are in Appendix D.

5-47 AC 20-191 Appendix A APPENDIX A. DEFINITIONS AND ACRONYMS A.1 This appendix contains the acronyms and definition of terms used within this AC. The appendix also contains certain terms that are not used in this AC but are used in related ACs and are included for convenient reference. Certain acronyms and definition of terms are also provided to facilitate common use of this appendix for other related ACs.

Where the definitions or acronyms in this Appendix differ from their definition or meaning in 14 CFR, these definitions or acronyms are for the purposes of, and only applicable to, this AC.

A.1.1 Acronyms.

• AC Advisory Circular • ACJ Advisory Circular Joint (EASA) • ADI Attitude Director Indicator • AFM Aircraft Flight Manual • AH Alert Height • APU Auxiliary Power Unit • ATS Air Traffic Service • AWO All Weather Operations • BITE Built-In Test Equipment • CFR Code of Federal Regulations • CMR Certification Maintenance Requirements • DA Decision Altitude • DA(H) Decision Altitude (Height) • DH Decision Height • DOD Department of Defense • EADI Electronic Attitude Director Indicator • EASA European Union Aviation Safety Agency • EFVS Enhanced Flight Vision System • EMC Electromagnetic Compatibility • EMI Electromagnetic Interference • EVS Enhanced Vision System • FAF Final Approach Fix • FAS Final Approach Segment A-1 AC 20-191 Appendix A • FCOM Flight Crew Operating Manual • FDR Flight Data Recorder • FGS Flight Guidance System • FHA Functional Hazard Assessment • FM Frequency Modulation • FMC Flight Management Computer • FMS Flight Management System • FPAP Flight Path Alignment Point • FPCP Flight Path Control Point • FSB Flight Standardization Board • FTE Flight Technical Error • GAST GBAS Approach Service Type • GBAS Ground Based Augmentation System • GIRP Glidepath Intercept Reference Point • GLS GBAS Landing System • GNSS Global Navigation Satellite System • GPA Glide Path Angle • GPIWP Glide Path Intercept Waypoint • GPS Global Positioning System • HAT Height Above Touchdown • HQRS Handling Quality Rating System • HUD Head Up Display • IAP Instrument Approach Procedure • ICAO International Civil Aviation Organization • ILS Instrument Landing System • IM ILS Inner Marker • IMC Instrument Meteorological Conditions • IRS Inertial Reference System • IRU Inertial Reference Unit • ISA International Standard Atmosphere • LNAV Lateral Navigation A-2 AC 20-191 Appendix A • LOC ILS Localizer • MAP Missed Approach Point • MDA Minimum Descent Altitude • MLS Microwave Landing System • MMR Multi-mode Receiver • MSL Mean Sea Level [altitude reference datum] • NAVAID Navigational Aid • NOTAM Notice to Airmen • PF Pilot Flying • PFD Primary Flight Display • QNH Altimeter Setting referenced to airport ambient local pressure • RDP Runway Datum Point • RMS Root-mean-square • RNAV Area Navigation • RNP Required Navigation Performance • RPDS Reference Path Data Selector • RPI Runway Path Identifier • RVR Runway Visual Range • SARPs Standards and Recommended Practices (ICAO) • STC Supplemental Type Certificate • TC Type Certificate • TSE Total System Error • V The maximum speed in the takeoff at which the pilot must take the first action (e.g., apply brakes, reduce thrust, deploy speed brakes) to stop the airplane within the accelerate-stop distance. V 1 also means the minimum speed in the takeoff, following a failure of the critical engine at V EF , at which the pilot can continue the takeoff and achieve the required height above the takeoff surface within the takeoff distance.

• VDB VHF Data Broadcast • V Speed at which failure occurs FAILURE • VHF Very High Frequency • VMC Visual Meteorological Conditions • V Ground Minimum Control Speed MCG A-3

AC 20-191 Appendix A • VNAV Vertical Navigation • WGS-84 World Geological Survey - 1984 A.2 Definitions of Terms.

Term Definition A measure of the current estimated navigation performance, • Actual excluding Flight Technical Error (FTE). Actual Navigation Navigation Performance is measured in terms of accuracy, integrity, and Performance availability of navigation signals and equipment.

The airborne equipment that senses and computes the aircraft position • Airborne relative to the defined path, and provides information to the displays Navigation and to the flight guidance system. It may include a number of System receivers or system computers such as a Flight Management Computer (FMC) or both and typically provides inputs to the Flight Guidance System.

A height above the runway based on the characteristics of the aircraft • Alert Height and its fail-operational landing system, above which a Category III approach would be discontinued and a missed approach initiated if a failure occurred in one of the redundant parts of the fail operational landing system, or in the relevant ground equipment (Manual for All Weather Operations, ICAO Doc. 9365).

A go-around that is accomplished by an autopilot following pilot • Automatic selection and initiation of the go-Around autopilot mode, when an Go-Around autopilot is engaged in an approach mode.

• Availability An expectation that systems or elements required for an operation will be available to perform their intended functions so that the operation will be accomplished as planned to an acceptable level of probability.

A discontinued landing attempt. This term is often used in • Balked conjunction with aircraft configuration or performance assessment, as Landing in “Balked landing climb gradient,” Also, see “Rejected Landing.” • Category II A precision instrument approach operation with a DH lower than 150 ft (45m) but not lower than 100 ft (30m) and a runway visual range (FAA) not less than 300m (1000 ft).

A-4

AC 20-191 Appendix A Term Definition A Type B instrument approach operation to a DH lower than 60 m • Category II (200 ft), but not lower than 30 m (100 ft) and a runway visual range (ICAO) not less than 300 m (1000 ft).

A precision instrument approach or approach and landing with a • Category III decision height lower than 100 ft (30m), or no decision height, or a (FAA) runway visual range less than 1000ft (300m).

• Category III A Type B instrument approach operation to a DH lower than 30 m (100 ft) or no DH and a runway visual range not less than 1000ft (ICAO) (300m) or no RVR limitations.

The element of the head up display (HUD) in which the pilot • Combiner simultaneously views the external visual scene along with synthetic information provided in symbolic form.

Information that directs the pilot to follow a course of action in a • Command Information specific situation (e.g., information provided by a flight director).

Information that correctly overlays the image of the real world, • Conformal irrespective of the pilot’s viewing position.

Information A runway is considered contaminated when more than 25 % of the • Contaminated runway surface area (within reported length and width being used) is Runway covered by standing water (greater than 1/8 inch or 3 mm), frost, ice, and any depth of snow, slush, or heavy rubber deposits.

A specified altitude in an instrument approach procedure at which the • Decision pilot must decide whether to initiate an immediate missed approach if Altitude (DA) the pilot does not see the required visual reference, or to continue the approach. Decision altitude is expressed in feet above mean sea level.

A-5

AC 20-191 Appendix A Term Definition For Category II and certain Category III procedures (e.g., when using • Decision a Fail Passive autoflight system), the DH (or an equivalent IM Altitude position fix) is the controlling minima, and the altitude value (Height) specified is advisory. The altitude value is available for cross DA(H)) reference. Use of a barometrically referenced DA for Category II is not currently authorized for 14 CFR Parts 121, 129, or 135 operations at U.S. facilities (Adapted from ICAO - IS&RP Annex 6).

A specified height above the ground in an instrument approach • Decision procedure at which the pilot must decide whether to initiate an Height (DH) immediate missed approach if the pilot does not see the required visual reference, or to continue the approach. Decision height is expressed in feet above ground level.

The path that is defined by the path definition function.

• Defined Path The three-dimensional volume in space surrounding the Design Eye • Design Eye Position from which the HUD information can be viewed.

Box The position at each pilot’s station from which a seated pilot achieves • Design Eye the optimum combination of outside visibility and instrument scan.

Position • Desired Path The path the flight crew and air traffic control can expect the aircraft to fly.

An installed aircraft system which uses an electronic means to • Enhanced provide a display of the forward external scene topography (the Flight Vision natural or manmade features of a place or region especially in a way System to show their relative positions and elevation) through the use of imaging sensors, including but not limited to forward-looking infrared, millimeter wave radiometry, millimeter wave radar, or low- light level image intensification. An EFVS includes the display element, sensors, computers and power supplies, indications, and controls.

A-6

AC 20-191 Appendix A Term Definition Information the pilot derives from visual observation of real world • External cues outside the cockpit.

Visual Reference -9 A probability of occurrence of 1 x 10 or less per hour of flight, or • Extremely per event (e.g., takeoff, landing).

Improbable -9 -7 • Extremely A probability of occurrence between 1 x 10 and 1 x 10 per hour of flight, or per event (e.g., takeoff, landing).

Remote A system capable of completing the specified phases of an operation • Fail following the failure of any single system component after passing a Operational point designated by the applicable safety analysis (e.g., Alert Height).

System • Fail Passive A system that, in the event of a failure, causes no significant deviation of aircraft flight path or attitude.

System As applied to a HUD, the angular extent of the display that can be • Field of View seen from within the design eye box.

The final bearing/radial/track of an instrument approach leading to a • Final runway, without regard to distance. For certain previously designed Approach approach procedures that are not aligned with a runway, the FAC Course bearing/radial/track of an instrument approach may lead to the (FAC) extended runway centerline, rather than to alignment with the runway.

The fix from which the final approach to an airport is executed. For • Final standard procedures that do not involve multiple approach segments Approach Fix intercepting the runway centerline near the runway, the FAF typically (FAF) identifies the beginning of the straight-in final approach segment and the point where final segment descent may begin.

A-7

AC 20-191 Appendix A Term Definition The segment of an approach extending from the Glide Path Intercept • Final Waypoint (GPIWP) or Approach Intercept Waypoint (APIWP), Approach whichever occurs later, to the Glide Path Intercept Reference Point Segment (GIRP).

The means available to the flight crew to maneuver the aircraft in a • Flight Guidance specific manner either manually or automatically. It may include a number of components such as the autopilot, flight directors, relevant System display and annunciation elements and it typically accepts inputs from the airborne navigation system.

The FPAP is a point usually at or near the stop end of a runway. The • Flight Path point is used in conjunction with the Runway Datum Point (RDP) and Alignment Point (FPAP) a vector normal to the World Geological Survey – 1984 (WGS-84) ellipsoid at the RDP to define the geodesic plane of a final approach and landing flight path. The FPAP typically may be the RDP for the reciprocal runway.

The Flight Path Control Point (FPCP) is a calculated point located • Flight Path directly above the Runway Datum Point. The FPCP is used to relate Control Point (FPCP) the vertical descent of the final approach flight path to the landing runway.

The accuracy with which the aircraft is controlled as measured by the • Flight indicated aircraft position with respect to the indicated command or Technical desired position. Note: FTE does not include human performance Error (FTE) conceptual errors, typically that may be of large magnitude (e.g., entry of an incorrect waypoint or waypoint position, selection of an incorrect procedure, selection of an incorrect NAVAID frequency, failure to select a proper flight guidance mode).

Occurring more often than 1 in 1000 events or 1000 flight hours.

• Frequent A-8

AC 20-191 Appendix A Term Definition A differential GNSS (e.g., GPS)-based landing system providing both • GBAS vertical and lateral position fixing capability. Note: Term may be Landing applied to any GNSS based differentially corrected landing system System providing lateral and vertical service for approach and landing (GLS) equivalent to or better than that provided by a U.S. Type I ILS, or equivalent ILS specified by ICAO Annex 10.

A descent profile determined for vertical guidance during a final • Glide Path approach.

(GP) The glide path angle is an angle defined at the FPCP that establishes • Glide Path the descent gradient for the final approach flight path of an approach Angle (GPA) procedure. It is measured in the geodesic plane of the approach (defined by the RDP, FPAP, and WGS-84 ellipsoid’s center). The vertical and horizontal references for the GPA are a vector normal to the WGS-84 ellipsoid at the RDP and a plane perpendicular to that vector at the FPCP, respectively.

The point at which the extension of the final approach path intercepts • Glide Path Intercept the runway.

Reference Point (GIRP) The point at which the established glide slope intercept altitude • Glide Path (MSL) meets the Final Approach Segment (FAS), on a standard day, Intercept using a standard altimeter setting (1013.2 HPa or 29.92 in).

Waypoint (GPIWP) Part of the ILS that projects a radio beam upward at an angle of • Glideslope approximately three degrees from the approach end of an instrument (GS) runway. The glideslope (GS) provides vertical guidance to aircraft on the final approach course for the aircraft to follow when making an ILS approach along the Localizer (LOC) path.

A-9

AC 20-191 Appendix A Term Definition A world-wide position, velocity, and time determination system that • Global uses one or more satellite constellations.

Navigation Satellite System (GNSS) The NAVSTAR Global Positioning System operated by the United • Global States Department of Defense (DOD). It is a satellite-based radio Positioning navigation system composed of space, control, and user segments.

System The space segment is composed of satellites. The control segment is (GPS) composed of monitor stations, ground antennas, and a master control station. The user segment consists of antennas and receiver- processors that derive time and compute a position and velocity from the data transmitted from the satellites.

A transition from an approach to a stabilized climb.

• Go-Around Information used during manual control or monitoring of automatic • Guidance control of the aircraft that is of sufficient quality to be used by itself for the intended purpose.

A display with the following characteristics: • Head Up Display • A head-up presentation not requiring the transition of visual (HUD) attention from head down to head up, System • displays imagery and or/symbology conformal (as defined in SAE AS 8055) with the pilot’s external view, • permits simultaneous view of the imagery (if presented), aircraft flight symbology and the external view, and • display characteristics and dynamics are suitable for manual control of the aircraft.

A combination of two, or more, systems of dissimilar design used to • Hybrid perform a particular operation.

System A-10

AC 20-191 Appendix A Term Definition An instrument approach operation to a DH below 75m (250 ft) Type • ICAO Type B instrument approach operations are further categorized as Category B Instrument I, II, and III defined above.

Approach -9 • Improbable A probability of occurrence greater than 1 x 10 but less than or -5 per hour of flight, or per event (e.g., takeoff, equal to 1 x 10 landing).

• Independent A system that is not adversely influenced by the operation, computation, or failure of some other identical, related, or separate Systems system (e.g., two separate ILS receivers).

Occurring less often than 1 in 1000 events or 1000 flight hours.

• Infrequent The angular extent of a HUD display that can be seen from either eye • Instantaneous from a fixed position of the head.

Field of View A measure of the acceptability of a system, or system element, to • Integrity contribute to the required safety of an operation.

For the purpose of this AC, landing begins at 100 ft., the DH or the • Landing AH and ends at the first contact of the wheels for fixed wing aircraft with the runway.

For the purpose of this AC, rollout starts from the first contact of the • Landing wheels with the runway and finishes when the aircraft has slowed to a rollout safe taxi speed (in the order of 30 knots).

The flight path followed by an aircraft after discontinuation of an • Missed approach procedure and initiation of a go-around. Typically, a Approach “missed approach” follows a published missed approach segment of an IAP, or follows radar vectors to a MAP, return to landing, or diversion to an alternate.

A-11

AC 20-191 Appendix A Term Definition A HUD that has internal or external capability to reliably detect • Monitored erroneous sensor inputs or guidance outputs, to assure that a pilot HUD does not receive incorrect or misleading guidance, failure, or status information.

Conditions or configurations of the aircraft that would not normally • Non-Normal Conditions be experienced during routine flight operations usually due to failures (e.g., engine failure, electrical failure, autothrottle/autothrust failure, etc.).

Notice to Airmen - A notice distributed by means of • NOTAM telecommunication containing information concerning the establishment, condition, or change in any aeronautical facility, service, procedure or hazard, the timely knowledge of which is essential to personnel concerned with flight operations. (ICAO - IS&RP Annex 6).

A measure of the accuracy with which an aircraft, a system, or an • Performance element of a system operates compared against specified parameters.

Performance demonstration(s) typically include the component of FTE.

• Rare Normal A condition which must be expected to normally occur, but does so only very infrequently (e.g., unusually strong winds, significant wind Conditions gradients, significant turbulence, significant in-flight icing, significant mountain wave activity).

The presence of more than one independent means for accomplishing • Redundant a given function or flight operation. Each means need not necessarily be identical.

A-12

AC 20-191 Appendix A Term Definition A discontinued landing attempt. A rejected landing is typically • Rejected initiated at low altitude, but prior to touchdown. If from or following Landing an instrument approach, a rejected landing typically is considered to be initiated below DA(H) or MDA(H). A rejected landing may be initiated in either Visual Meteorological Conditions (VMC) or Instrument Meteorological Conditions (IMC). A rejected landing typically leads to or results in a go-around and if following an instrument approach, a “Missed Approach.” If related to consideration of aircraft configuration(s) or performance, it is sometimes referred to as a “Balked Landing.” The term “rejected landing” is used to be consistent with regulatory references such as found in 14 CFR 121, appendix E, and policy references as in FAA Order 8400.10.

-7 A probability of occurrence greater than 1 x 10 but less than or • Remote -5 equal to 1 x 10 per hour of flight, or per event (e.g., takeoff, landing).

• Required That section of the visual aids or of the approach area that should have been in view for sufficient time for the pilot to make an Visual assessment of the aircraft’s position and rate of change of position, in Reference relation to the desired flight path. In Category III operations with a DH, the required visual reference is that specified for the particular procedure and operations (ICAO - IS&RP Annex 6 - DH definition - Note 2).

The RDP is used in conjunction with the FPAP and a vector normal • Runway to the WGS-84 ellipsoid at the RDP. The RDP defines the geodesic Datum Point plane of a final approach flight path to the runway for touchdown and (RDP) rollout. It is a point at the designated lateral center of the landing runway defined by latitude, longitude, and ellipsoidal height. The RDP is typically a surveyed reference point used to connect the approach flight path with the runway. The RDP may or may not The RDP may or may not necessarily be coincident with the designated runway necessarily be coincident with the designated runway threshold.

A-13

AC 20-191 Appendix A Term Definition That segment of an approach from the glidepath intercept reference • Runway point (GIRP) to Flight Path Alignment Point (FPAP).

Segment (RWS) An approach that does not penetrate the Obstacle Limitation Surfaces • Safe for Precision Approach Category II or III as defined by ICAO SARPs Approach Annex 14 Section 4.2.15 and Table 4-1.

Landing in the touchdown landing box which includes longitudinally • Safe Landing between 200 ft and 3000 ft. or the end of the touchdown zone, and laterally from with the outbound landing gear within 70 ft. from the runway centerline.

The speed at which the pilot can safely leave the runway or bring the • Safe Taxi Speed aircraft to a safe stop.

In the context of this section of this AC, is a navigation service • Standard provided by a State that meets internationally accepted performance Landing Aid standards (e.g., ICAO Standards and Recommended Practices (SLA) (SARP’s) or equivalent State standards).

Information provided to the flight crew by instrumentation or • Synthetic electronic displays. May be either command or situation information.

Reference • Synthetic A guidance system which integrates a synthetic vision system scene depiction with additional functionality that includes a flight path Vision vector and flight path angle reference cue, and display elements that Guidance include runway of intended landing to support operations below System standard precision approach operating minima.

(SVGS) • Takeoff Takeoff guidance system includes position sensors, displays, indicators and controls as a minimum. The takeoff guidance system Guidance provides directional command guidance to the pilot during a takeoff, System or takeoff and rejected takeoff phase of flight.

A-14

AC 20-191 Appendix A Term Definition The height of the straight line extension of the glide path above the • Threshold runway at the threshold.

Crossing Height (TCH) The theoretical height above the runway threshold at which the • Threshold aircraft’s glideslope antenna would be if the aircraft maintained the Crossing trajectory established by the mean ILS glideslope or MLS glidepath.

Height (TCH) (Pilots Handbook of Aeronautical Knowledge) • Touchdown The first 3000 ft. of usable runway for landing, unless otherwise specified by the FAA, or other applicable ICAO or State authority Zone (e.g., for Short Take Off and Landing (STOL) aircraft, or in accordance with a Special Federal Aviation Regulation (SFAR)).

A runway surface that is neither dry nor contaminated but has visible • Wet Runway dampness, moisture or water less than 1/8 inch in depth or both. Wet is considered to be any condition “not clear and dry” on any part of the useable area of the runway (useable area does not include edges, sides, melting of ice or snow banks at edges or sides, area beyond the advertised plowed and sanded surface, overruns, etc.).

A-15 AC 20-191 Appendix B APPENDIX B. WIND MODEL FOR APPROACH AND LANDING SIMULATION B.1 Wind Models.

This appendix describes three types of wind models, namely wind model A, B and C. In carrying out the performance analysis, the applicant may use one of the models of wind, turbulence and wind shear. Wind model analysis is required to obtain approval of systems related to CAT III, and the FAA recommends wind model analysis to obtain approval of systems related to Category II. GAST D also must implement a wind model analysis.

B.2 Wind Model A.

B.2.1 Mean Wind.

The mean wind is the steady state wind measured at landing. This mean wind is composed of a downwind component (headwind and tailwind) and a crosswind component. The cumulative probability distributions for these components are provided in Figure B-1 (downwind) and Figure B-2 (crosswind). Alternatively, the mean wind can be defined with magnitude and direction. The cumulative probability for the mean wind magnitude is provided in Figure B-3, and the histogram of the mean wind direction is provided in Figure B-4. The mean wind is measured at a reference altitude of 20 ft. AGL. The models of the wind shear and turbulence given in the following sections assume this reference altitude of 20 ft. AGL is used.

B.2.2 Wind Shear.

The wind shear component is that portion that affects the air mass moving along the ground (i.e., ground friction). The magnitude of the shear is defined by the following expression: h + 0 . 15   V = 0 . 20407 V ln   wref 20   0 . 15 is the mean wind where V is the mean wind speed measured at h ft. and V 20 wref speed (ft/sec) at 20 ft. AGL.

B.2.3 Turbulence.

The turbulence spectra are of the Von Karman form.

B.2.3.1. Vertical Component of Turbulence.

The vertical component of turbulence has a spectrum of the form defined by the following equation: B-1 AC 20-191 Appendix B  2  L  1 + 2 . 67 1 . 339 L Ω  σ

( w )

w w   Ω =

) Φ (

w 2 6   2 π 1 + 1 . 339 L Ω 

( )

w   where: = spectral density in (ft./sec) Φ w σ w = root mean square (rms) turbulence magnitude in ft/sec = 0.1061 V (ft/sec).

Where V 20 is expressed in ft/sec.

L = scale length = h (for h < 1000 ft) w Ω = spatial frequency in radians/ft = ω /V T ω = temporal frequency in radians/sec, and V = aircraft speed in ft./sec.

T B.2.3.2. Horizontal Component of Turbulence: The horizontal component of turbulence consists of a longitudinal component (in the direction of the mean wind) and lateral component (see Figure B-5). The longitudinal and lateral components have spectra of the form defined by the following equations: B.2.3.2.1 Longitudinal Component:

L

σ

u u

Φ Ω =

( )

u 5 2 6

π 1 + 1 . 399 Ω L

( )

( )

u B.2.3.2.2 Lateral Component: L 1 + 2 . 67 1 . 339 L Ω

( )

σ v

v ( ) v

Ω =

Φ ( )

v 2 6

2 + ( π 1 1 . 339 L Ω )

( ) v

B-2 AC 20-191 Appendix B B.2.3.3. Turbulence Intensities and Scale Lengths.

The RMS turbulence intensities are defined as below σ = 0.1061 V (ft/sec) w 20 • When h ≥1,000ft.

σ = σ = σ u v w • When h <1,000ft.

0 . 4     σ = σ = σ   u v w   0 . 177 + 0 . 000823 h   • When h ≤0ft.

0 . 4   σ = σ = σ   u v w 0 . 177   The turbulence scales are defined as below • When h ≥1,000ft.

L = L = L = 1 , 000 u v w • When h <1,000ft L = h w 1.2   L = L = h   u v 0 . 177 + 0 . 000823 h

( )

  • When h ≤0ft.

L = L = L = 0 u v w B-3 AC 20-191 Appendix B Figure B-1 Headwind-Tailwind B-4 AC 20-191 Appendix B Figure B-2 Crosswind B-5 AC 20-191 Appendix B Figure B-3 Annual Percent Probability of Mean Wind Speed Equaling or Exceeding Given Values B-6 AC 20-191 Appendix B Figure B-4 Wind Direction Relative to Runway Heading Wind Direc tion Histog ra m P e r c 6 e n t Wind from the Rig ht Wind from the Left - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 10 20 30 40 50 60 70 80 90 180 190 200 210 220 230 240 250 260 270 280 290 300 310 320 330 340 350 100 110 120 130 140 150 160 170 180 Wind Direction Relative to Runway Heading B-7 AC 20-191 Appendix B Figure B-5 Selected Description for Variances of Horizontal Turbulence Components.

B-8 AC 20-191 Appendix B Figure B-6 Selected Integral Scale Description.

B-9 AC 20-191 Appendix B B.3 Wind Model C.

This wind model is a harmonized derivative of Wind Model A incorporating the changes defined in JAA paper AWOG 904a. The changes are a result of experience from pilot-in-the-loop simulator tests for Category III HUD certification, where the wind shear and turbulence intensities defined in JAA paper AWOG 904a were found to be more representative of nominal wind conditions for Category III approaches and compatible with motion-based, pilot-in-the-loop simulators. Wind Model C is therefore more appropriate for use in Category III HUD certification programs; however, this does not preclude its use for other types of landing system.Wind Shear ( Vwref ).

B.3.2 The Model A equation for the Wind Shear component: h + 0 . 15   V = 0 . 20407 V ln   wref 20   0 . 15 is replaced for Wind Model C with: h + 0.046   V = 0.165 V ln   wref 20 0.046   B.3.3 Root-Mean-Square (RMS) Turbulence Scale ( σ w ).

The Model A equation for the RMS Turbulence Scale: σ = 0.1061 V (ft/sec) is w 20 replaced for Wind Model C with: σ w = 0.0625 V 20 (ft/sec) B.3.4 Turbulence Scale Factor ( Lu ).

The Model A establishes three values for Turbulence Scale Factor L u depending on the altitude h , but for Model C, L u = 600 feet, for all values of h Wind Model B.

B.4 B.4.1 Mean Wind.

It may be assumed that the cumulative probability of reported mean wind speed at landing and the crosswind component of that wind are as shown in Figure B-7.

Normally, the mean wind that is reported to the pilot is measured at a height that may be between 20 ft.(6m) and 33 ft. (10m) above the runway. The models of wind shear and turbulence given in the following paragraphs assume this reference height.

B.4.2 Wind Shear.

Wind shear should be included in each simulated approach and landing unless its effect can be accounted for separately. The magnitude of the shear should be defined by the expression: u = 0.43 U log10 (z) + 0.57 U, for z ≥ 0.05 m u ≅ 0, for z < 0.05m where z is the height in meters u is the mean wind speed at height z (meters) B-10 AC 20-191 Appendix B U is the mean wind speed at 10m (33 ft.).

B.4.3 Abnormal Wind Shear.

The effect of wind shears exceeding those described above should be investigated using known severe wind shear data.

B.4.4 Turbulence.

B.4.4.1. Horizontal Component of Turbulence.

It may be assumed that the longitudinal component (in the direction of mean wind) and lateral component of turbulence may each be represented by a Gaussian process having a spectrum of the form: 2 σ L Φ Ω = •

( )

2 2 π 1 + Ω L where

Φ Ω

( )

= a spectral density in (meters/sec) per (radian/meter).

σ = root mean square (rms) turbulence intensity = 0.15 U L = scale length = 183m (600 ft.)

Ω = spatial frequency in radians/meter.

B.4.4.2. Vertical Component of Turbulence.

It may be assumed that the vertical component of turbulence has a spectrum of the form defined by the equation above for the horizontal component with the following values: σ = 1.5 knots with L = 9.2m (30 ft.), or alternatively σ = 0.09 U with L = 4.6m (15 ft.) when z < 9.2m (30 ft.), and L = 0.5 z when 9.2 < z < 305m (30 < z < 1000 ft.)

B-11 AC 20-191 Appendix B Figure B-7 Cumulative probability of reported Mean Wind, and Head Wind, Tail Wind Cross Wind Components when landing.

99.99 P R O 99.9 B 99.8 A B I L I T Y O F E X C E E D I N Total Wind G G I V Head Wind E Component Cross Wind N Component W I N D S P E E 0.5 Tail Wind D Component 0.2 0.1 0.05 0.01 40 20 30 10 0 WIND SPEED KNOTS Cumulative probability of reported Mean Wind, and Head Wind, Tail Wind Cross Wind Components, when landing.

NOTE: This data is based on world wide in-service operations of UK airlines (sample size about 2000) B-12 AC 20-191 Appendix B B.5 Acronyms and Definitions for the Wind Models.

h Height AGL in ft.

Lu Turbulence scale factor RMS Root Mean Square VT Aircraft speed in ft/sec.

Vwref Mean wind speed measured at h ft V20 Mean Wind speed measured at 20 ft. AGL w Temporal frequency in radians/sec, σ RMS turbulence scale in knots w W Spatial frequency in radians/ft.

Φ w ( Ω ) Spectral density of the vertical component of turbulence in (ft/sec) B-13 AC 20-191 Appendix C APPENDIX C. GBAS PERFORMANCE MODEL FOR APPROACH AND LANDING SIMULATION C.1 GBAS Performance Analysis.

In carrying out the performance analysis the following model of GBAS Performance may be used. The GBAS Performance Model simulates the outputs of a fault-free GBAS airborne receiver when used in conjunction with a GBAS ground station categorized as either Facility Approach Service Type (FAST) C or FAST D.

C.1.1 GBAS Performance Model.

C.1.1.1. The architecture of the GLS Model is illustrated in Figure C-1. The GLS Model includes a Navigation System Error (NSE) Generator which generates NSE representative of a GBAS providing approach service type C or D as defined by the requirements [1, 2, 3]. The Position Calculator adds NSE to the true position of the GLS Reference Point (GRP). The deviation calculator computes the deviations of the GRP given the Final Approach Segment (FAS) data. A latency model is applied to each output of the GLS Model.

C.1.1.2. Development of all components of the GLS Model is documented in [ 4 ,5 ] and [ 6 ]. The NSE Generator and NSE Step Generator are discussed below.

C.1.2 GBAS NSE Generator.

The GBAS NSE Generator produces NSEs in the along-track, cross-track and vertical directions in meters. The block diagram of the GBAS NSE Generator is shown in Figure C-2. The Gaussian White Noise (GWN) Generator produces three independent noise sequences with zero mean and unity variance. Each sequence is filtered by a second-order Butterworth filter. The compensation gain which brings the RMS of the filtered noise back to unity is obtained as: 2 2 G = x ∆ T ω n [1] The filter output is scaled by NSE scale factors K , K , and K . At the beginning of atrk xtrk vert each run, the NSE generator filter must be initialized at a value sampled from a Gaussian distribution consistent with these scale factors.

C-1 AC 20-191 Appendix C Figure C-1 GBAS Signal Model FAS Data, GERP Flag, Dev Scale Flags True Ant Pos Deviations Deviation Latency Calc GRP FAS GAST P (ECEF) GRP NSE Position Generator Seed & ∆ T Calc GRP Pos Latency NSE (LLH) Horiz Dist to LTP Attitudes, Body Latency Rates, GRP Offset, Offset Flag Figure C-2 GLS NSE Generator K atrk K Value K xtrk Model Type (nominal vs. Selector Limit K vert Geometry) GAST NSE Compensation 2nd Order σ =1 atrk X Σ Σ Gain Filter Seq1 GWN Seed , ∆ T NSE xtrk Compensation 2nd Order Seq2 =1 σ X Σ Σ Gain Filter Generator Seq3 Compensation 2nd Order NSE vert =1 σ X Σ Σ Gain Filter Step Function Generator Step Event Time Limit Case Fault Mode Malfunction Event Time Generator C-2 AC 20-191 Appendix C C.1.3 Second-Order Filter of GBAS NSE Generator.

The second order filter to be implemented in the GBAS NSE Generator is characterized by: ω n H ( s ) = [2] 2 2 s + 2 ω s + ω n n where ω n is the natural frequency given by For GAST C: ω = 0.01 rad/sec n For GAST D: ω n = 0.033 rad/sec C.1.4 Noise Scale Factor.

The model accounts for the variation in accuracy due to satellite geometry by setting the noise scale factor to a constant which is sampled from a distribution. For each run, the value of K is first determined by selecting a sample, x, from a uniform distribution vert between 0 and 1. The value of K vert is then given by the following function of x: a [3]

K f ( x ) = = a + a x −

vert 1 2 x − 1 where the parameters of the function are dependent on the GBAS Approach Service Type as given in Table C-1.

Table C-1: GAST Dependent Parameters for K vert Service Type a 1 a 2 a 3 K vert_max GAST C 0.4 0.2 0.006 10/5.762=1.736 GAST D 0.52 0.47 0.005 10/5.762=1.736 C.1.4.1 If the random pick from a distribution between 0 and 1 results in K vert >K vert_max , then the value should be discarded and another sample should be selected from the uniform distribution set to the maximum value from the table . An alternative acceptable means for computing the NSE scale factors is given in section C.2 below.

C.1.4.2 For each run, the value of K xtrk is determined by selecting a sample, x 1 , from a uniform distribution between 0 and 1. For each run, the value of K atrk is determined by selecting a sample, x 2 , from a uniform distribution between 0 and 1. The cross-track and along track scale factors are then computed by: This corresponds to the case where VPL>10m and therefore the system is not available.

C-3 AC 20-191 Appendix C a

K f ( ) = = x a + a x −

[4] xtrk 1 1 2 1 x − 1 a

= ( ) K f x = a + a x −

[5] atrk 2 1 2 2 x − 1 where the parameters of the function are dependent on the GBAS Approach Service Type as given in Table C-2: Table C-2: GAST Dependent Parameters for K and K xtrk atrk Service Type a 1 a 2 a 3 K xtrk_max , K atrk max GAST C 0.2 0.1 0.003 40/5.762=6.942 GAST D 0.21 0.12 0.003 17/5.762=2.951 C.1.4.3. If the random pick from a distribution between 0 and 1 results in K xtrk >K xtrk_max or K axtrk >K axtrk_max , then the value should be discarded and another sample should be selected from the uniform distribution.

C.1.5 NSE Step Generator.

The NSE step generator is illustrated in Figure C-3. Step errors occur when the satellite geometry changes, either due to the removal of an individual satellite from the position solution (e.g. a satellite fails and stops transmitting or the user receiver stops tracking a satellite for any reason) or due to an individual satellite rising or setting. The step generator produces representative NSE step errors in the vertical, along-track and cross- track directions in meters. This is accomplished by scaling a unit step function by factors that are derived from representative statistical distributions. First, three random samples, one for each axis, are selected from a zero mean unit variance normal distribution. Then these samples are multiplied by scale factors that are chosen to simulate the statistical variation in the size of an error that would result from normal variations in the relative geometry between the user and the satellites. Finally, the resultant constant factors are multiplied with a unit step function time sequence.

Injecting one step in each simulated approach at a random time should reasonably model the effects of geometry changes.

C-4 AC 20-191 Appendix C Figure C-3 NSE Step Generator K Step_atrk Uniform Scale Factor K Step_xtrk Random Computation x Seed Number One sample K Step_vert Generator K = f (x) from step Uniform distribution, 0 ≤ x ≤ 1 NSE Step_atrk One sample from normal distribution, μ =0, σ = 1 X X NSE Step_xtrk GWN Seed One sample from normal distribution, μ =0, σ = 1 X X Generator NSE Step_vert One sample from normal distribution, μ =0, σ = 1 X X t = event time Unit Step Function Seq Generator Step Event Time t = event time C.1.6 NSE Step Generator Scale Factor Computation.

For each run, the value of σ step_vert is determined by selecting a sample, x, from a uniform distribution between 0 and 1. The value of σ is then given by the step_vert following function of x: b [6]

( ) σ = f x = b + b x −

step _ vert 1 2 x − 1.01 where the parameters of the function are dependent on the GBAS Approach Service Type as given in Table C-3.

σ step _ vert Table C-3: GAST Dependent Parameters for Service Type b 1 b 2 b 3 σ max _ _ vert step GAST C 0.4 0.8 0.07 FASVAL/2 GAST D 0.5 0.8 0.05 3.5 C.1.6.1. If the random pick from a distribution between 0 and 1 results in σ step_vert > σ step_vert_max , then the value should be discarded and another sample should be selected from the uniform distribution.

C-5 AC 20-191 Appendix C C.1.6.2. For each run, the value of σ step_xtrk is determined by selecting a sample, x 1 , from a uniform distribution between 0 and 1. The value of σ is step_atrk determined by selecting a sample, x , from a uniform distribution between 0 and 1. The cross-track and along track NSE step scale factors are then computed by: b

σ = f ( x ) = b + b x −

[7] step _ xtrk 1 1 2 1 x − 1 b

σ ( ) = f x = b + b x −

[8] step trk _ a 2 1 2 2 x − 1 where the parameters of the function are dependent on the GBAS Approach Service Type as given in Table C-4.

Table C-4: GAST Dependent Parameters for or σ σ step _ xtrk step _ atrk Service Type b b b σ 1 2 3 max _ _ axtrk step GAST C 0.32 0.32 0.05 20m GAST D 0.35 0.35 0.35 5.5m C.1.6.3. If the random pick from a distribution between 0 and 1 results in σ step_xtrk > σ step_xtrk_max , or σ step_ atrk > σ step_axtrk_max , then the value should be discarded and another sample should be selected from the uniform distribution.

C.1.6.4. The scale factor, K step_vert , of the magnitude of the vertical step error is then selected from a normal distribution with 0 mean and a standard deviation of σ step_vert . The scale factor, K step_xtrk , of the cross-track deviation is selected from a normal distribution with 0 mean and a standard deviation of σ step_xtrk .

C.1.7 Latency Model.

The latency of the GLS output should be delayed for 400 msec.

C.1.8 Fault Mode Generator.

The fault mode generator as depicted in Figure C-4 can be used for modeling undetected, non-aircraft system error conditions (monitor “limit” cases) or any worst- case undetected error (monitor “malfunction” cases). The fault mode generator produces a ramp error with characteristics as illustrated in Figure C-5. The effect of a malfunction is modeled as a ramp, with a start time, a ramp rate and a total exposure time, T max . The maximum value of the ramp depends on the ramp rate and time to alert.

The ramp is assumed to increase to the level of the maximum value and then to exceed that value for a period equal to the time-to-detect and mitigate the failure. The erroneous satellite is isolated and the error returns to the nominal value (i.e. the fault error is set to zero). The model may alternatively produce step errors where the C-6 AC 20-191 Appendix C maximum change in error due to the step is specified rather than the ramp rate. (See reference [7] for more details regarding GLS fault modeling).

Figure C-4 Limit or Malfunction Generator or both Limit or Malfunction Axis to Apply K Limit_atrk Uniform Set Limits K Limit_xtrk Random Seed x Number One sample K Limit_vert Generator from K = f (x) other Uniform distribution, 0 ≤ x ≤ 1 NSE LMF_atrk One sample from normal distribution, μ =0, σ = 1 X X NSE LMF_xtrk GWN Seed One sample from normal distribution, μ =0, σ = 1 X X Generator NSE LMF_vert One sample from normal distribution, μ =0, σ = 1 X X e Unit Ramp Ramp Rate Function Seq Ramp Duration Generator Ramp Event Time t = event time From Figure C-5, it can be seen that for the ramp: EffectiveVAL [9] T = TTD + MAX RR E and the Effective VAL depend on the type of malfunction. For Satellite Ranging MAX sources, the Effective VAL is a function of the maximum error allowable with -9 probability greater than 1x10 by the P md performance constraint with conditional probability (ICAO Annex 10 appendix B Section 3.6.7.3.3.3 ), (i.e., 1.6 meters) multiplied by the geometry screening limit.

[10] E = 1.6 ⋅ S MAX vert _ max Where: S is the maximum vertical projection for any satellite allowed by geometry vert _ max

E

screening. This airframer limits the size of by specifying a maximum S for vert MAX satellites used in the position solution as described in reference [8].

C-7 AC 20-191 Appendix C C.1.8.1. For ground segment reference receiver failures, the effective VAL will depend on the geometry screening applied in the airborne equipment. If no additional geometry screening is applied other than VPL<VAL, the maximum effective VAL is 9.35 [m] (see Table C-5). If additional geometry screening is applied, a lower effective VAL may result. Reference [8] explains how to compute the effective VAL given additional geometry screening. Figure C-6 shows a plot of maximum vertical and lateral errors as a function of vertical and lateral Alert Limit screening. The calculations to produce the plot in Figure C-6 are described in detail in Reference [9].

Figure C-5 Malfunction Transient Slope Characterized by Ramp Rate [ft/s] Position Effective E Error on Axis MAX VAL Of Choice time TTD Total Exposure Time - T max C.1.8.2. For ionospheric anomalies, the maximum vertical error E is limited to a max specified maximum allowable position error for the airborne installation for each axis, vertical (maxE V ) and lateral (maxE L ), as a part of the satellite geometry screening in the avionics [10]. These values along with broadcast information provided by the ground station determine the geometry screening.

C.1.8.3. Table C-5 and Table C-6 give the characteristics for transient errors in the vertical and horizontal directions respectively for each of the three major identified fault types.

C-8 AC 20-191 Appendix C Table C-5 Malfunction Transient Characteristics in the Vertical Direction Fault Type Service Ramp Rates Effective VAL E Time to max Type Detect [m/s] [m] [m] (TTD) [s] Ranging GAST C 10 Dependent 6 0 - ∞ Source GAST D Dependent 2.5 0 - ∞ 1.6 × S vert Failures Iono Anomaly GAST C 0 – 4 N/A N/A N/A GAST D 0 – 4 N/A maxE N/A V Single Ref GAST C 0 - ∞ 10 Dependent 6 Receiver GAST D 9.35 Dependent 2.5 0 - ∞ Failure [note] Note: This value is an absolute worst case assuming no additional geometry screening is afforded based on reference receiver fault monitoring using T . Only geometry BAC screening of VPL<VAL=10m is assumed here. Smaller maximum values can be obtained by using additional geometry screening per reference [9].

Table C-6 Malfunction Transient Characteristics in the Lateral Direction Fault Type Service Ramp Rates Effective LAL E Time to max Type Detect [m/s] [m] [m] (TTD) [s] Ranging GAST C 40 Dependent 6 0 - ∞ Source GAST D 0 - ∞ 1.6 × S Dependent 2.5 lat Failures Iono Anomaly GAST C 0 – 4 N/A N/A N/A GAST D 0 – 4 N/A maxE L N/A Single Ref GAST C 40 Dependent 6 0 - ∞ Receiver GAST D 35.9 Dependent 2.5 0 - ∞ Failure [note] Note: This value is an absolute worst case assuming no additional geometry screening is afforded based on reference receiver fault monitoring using T . Only geometry BAC screening of LPL<LAL=40m is assumed here. Smaller maximum values can be obtained by using additional geometry screening per reference [ 9 ].

C-9 AC 20-191 Appendix C Figure C-6 Maximum Error (E) and Monitor Threshold (T ) as a function of Alert BAC Limits for Various Numbers of Ground Reference Receivers (M).

C.1.9 Compatibility with Rare Undetected Non-Aircraft System Error Conditions.

Demonstration of compliance with section 5.2.9.6, of this AC may be done by analysis to show that for all possible sizes of navigation error the joint probability that the error is not detected and that the error results in the aircraft landing outside of the safe -5 landing box as defined in section 5.2.10.1.6 is less than 1x10 . The analysis uses the nominal touchdown distributions (lateral and longitudinal) along with the geometry factors (Svert and Slat), and the maximum allowable P performance of the monitors md for satellite ranging source failures and for the Reference Receiver Fault Monitor (RRFM). The nominal touchdown distribution is used to compute a probability of an unsuccessful landing given a particular size of error PUL|E (E). This probability is then multiplied by the probability of an error not being detected as a function of E, P (E).

md The probability of an unsuccessful landing given an error is the joint probability that the fault that causes an error, E, is not detected and the landing will be unsuccessful given an error, E: − 5 ( ) ( ) ( ) 𝑃𝑃 𝐸𝐸 = 𝑃𝑃 𝐸𝐸 ∙ 𝑃𝑃 𝐸𝐸 < 10 [11] 𝑈𝑈𝑈𝑈 𝑈𝑈𝑈𝑈 | 𝐸𝐸 𝑚𝑚𝑚𝑚 ( ) To form the conditional unsuccessful landing probability , 𝑃𝑃 𝐸𝐸 , a conditional 𝑈𝑈𝑈𝑈 | 𝐸𝐸 touchdown distribution must be used that would result from a constant bias error in C-10 AC 20-191 Appendix C addition to the fault-free NSE and FTE distributions. This must be done for the full range of relevant error sizes to form the total conditional probability of an unsuccessful landing as a function of the error. The conditional unsuccessful landing probability is expressed as follows for the land short and land long cases: LSC ( ) Land Short ∫ 𝑃𝑃 = p x, E dx [12] ( 𝑈𝑈𝑈𝑈 | 𝐸𝐸 )( 𝐸𝐸 ) TSE_LON|E −∞ ∞ Land Long 𝑃𝑃 ( 𝐸𝐸 ) = p ( x, E ) dx [13] ∫ 𝑈𝑈𝑈𝑈 | 𝐸𝐸 TSE_LON|E LLC Land with wheels less than 5 ft from the edge of the runway: ∞ − RWE+GW/2 ( ) ( ) + 𝑃𝑃 𝐸𝐸 = p x, E dx p ( x, E ) dx [14] ∫ ∫ 𝑈𝑈𝑈𝑈 | 𝐸𝐸 TSE_LAT|E TSE_LAT|E RWE − GW/2 −∞ Where: LSC – is the land short criteria of section 5.2.9.6 (i.e. 200 ft) LLC – is the land long criteria of section 5.2.9.6 (i.e. 3000 ft) RWE – is the lateral landing criteria as defined in section 5.2.9.6. (i.e. 70 ft) GW – is the lateral distance between the main landing gear (x, E) p - is the probability density function for the longitudinal touchdown TSE _ LON | E given a bias of magnitude E.

p (x, E) - is the probability density function for the lateral touchdown given a TSE _ LAT | E bias of magnitude E.

Note: Care must be taken to insure consistency of units when making these calculations.

C.1.10 Computing P for Ranging Source Errors.

md A bound on the probability of missed detection for the ranging source error, 𝑷𝑷 ( 𝑬𝑬 ) is 𝒎𝒎𝒎𝒎 𝑹𝑹 defined by the performance constraint region given in Annex 10, appendix B, section 3.6.7.3.3.2. The P md performance must lie below the curve defined by Table B-76A in the SARPs repeated here in Table C-7 for convenience.

Table C-7 P Parameters md_limit Probability of Missed Pseudorange Error (meters) Detection P ≤ 1 0 ≤ |E | < 0.75 md_limit r (-2.56 × |Er| + 1.92) 0.75 ≤ |E | < 2.7 P md_limit ≤ 10 r -5 P md_limit ≤ 10 2.7 ≤ |E r | < ∞ C-11 AC 20-191 Appendix C For example, in the case of the longitudinal touchdown requirement the vertical position error has the largest effect on the touchdown location. The worst-case projection of a range error into vertical error max (|S Apr .i |), may be used to determine the resulting vert limit on P (E ) by substituting E = E /max(|S Apr .i |).

md V R V vert Figure C-7 illustrates the relationship between P and the P ( E ) for md_limit md V max(|S Apr .i| )= 5.

vert Figure C-7 Example of the Satellite Ranging Source Pmd in the Range domain and Position Domain.

C-12 AC 20-191 Appendix C Computing P md for Reference Receiver Fault Monitoring (RRFM).

The P md for the RRFM is given by: T BAC

( ) P E = p ( x , E ) dx

∫ V mdApprox Bmd V [15] Where: T BAC is the maximum threshold for the RRFM monitor given by:  0.0842 × VAL  T = 5.5 ×   + 0.4 Meters [16] BAC m − 1   Where: VAL – is the vertical alert limit that is used by airborne equipment to screen geometry expressed in meters.

And p (x,E ) is the probability density function (pdf) of | B (E ) | in the faulted Bmd V j,vert V circumstance given by:   0.0842 × VAL  dnorm x , E ,   V  M 1 M −     0.0842 × VAL    x ≥ 0; + dnorm  − x , E ,  V

( ) x E = p , [17]

Bmd V  M − 1 M       x < 0; 0  Where dnorm(x, μ , σ ) is the Gaussian pdf ( ) x − μ − 2 σ e [18]

( ) dnorm x , μ , σ =

2 πσ B (E ) is the broadcast difference between the broadcast pseudo-range j,vert V th corrections and the corrections obtained by excluding the j reference receiver measurement projected in the vertical direction across all of the ranging sources used in the position solution. In this case, it is written as a function of the size of the bias in the vertical error, E v, due to the single reference receiver fault / For a derivation of these expressions see Reference [ 9 ].

C-13 AC 20-191 Appendix C C.1.11 Example Assessments.

Figure C-8 illustrates a landing short assessment for a hypothetical aircraft with a nominal longitudinal touchdown point of 1500 ft from the threshold and a dispersion

that can be bounded by a Gaussian distribution with σ =220 ft. Also, a max ( S )

Apr . i vert of 5, VAL of 10 meters and GPA of 3 degrees is used. Rearranging equation [11]: − 5 ( ) 𝑃𝑃 𝐸𝐸 < [19] 𝑈𝑈𝑈𝑈 | 𝐸𝐸 𝑃𝑃 ( 𝐸𝐸 ) 𝑚𝑚𝑚𝑚 Hence by dividing 10-5 by the Pmd curves for satellite ranging sources and RRFM, the grey “keep out regions” shown in Figure C-8 can be obtained. The assessment is then simple. If the curve for 𝑃𝑃 ( 𝐸𝐸 ) does not enter the keep out regions, then the 𝑈𝑈𝑈𝑈 | 𝐸𝐸 −5 requirement that 𝑃𝑃 ( 𝐸𝐸 ) < 10 is met for all values of E .

𝑈𝑈𝑈𝑈 An alternative approach to the analysis is illustrated in Figure C-9 where the probability of an unsuccessful landing is explicitly calculated for both monitor types (ranging sources and RRFM).

Extension of these examples to the land long and lateral cases is straight forward .

Figure C-8 Example Assessment of Landing Short Performance C-14 AC 20-191 Appendix C Figure C-9 Explicit Calculation of PUL for the Land Short Example Above.

C.2 Alternative Method for Calculating and Using NSE Model Scale Factors.

C.2.1 Estimation of 10-pt piecewise linear interpolation of GBAS NSE autoland simulator histograms – GAST D.

An alternative method to use the NSE model is to compute, before launching any run of the Monte-Carlo autoland simulations, the distributions of the scale factors, K vert and K xtrk = K atrk . For these two last quantities, we conservatively allocate the worst horizontal sigma. These distributions have been computed using assumptions described in [11] and [12]. Then for each run of the Monte-Carlo simulations, we draw, from these two distributions, a Sigma_vert= K vert and a worst horizontal sigma for K xtrk and K atrk , at the beginning of the approach which are kept constant during the approach.

In order to facilitate the use of these distributions, the 10 point piecewise linear interpolation of K and K are provided on the histograms and using a vert worst_horizontal_sigma dual entry table X-axis corresponding to sigma_vert or worst_sigma_horizontal in meters.

C-15 AC 20-191 Appendix C C.2.2 Sigma Vert.

Figure C-10 Sigma Vertical Samples 0.05 bins width = 0.01 m 0.045 0.04 0.035 0.03 0.025 0.02 nb of occurrences 0.015 0.01 0.005 0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 sigma vert (meters) Table C-8 Sigma_vert Values and Number of Occurrences Sigma_vert Number of occurrences 0.485000000000000 0.000429191837945 0.543326533206011 0.002257116788039 0.655055242735278 0.045229563598357 0.699018742036146 0.043376936959747 0.731326218889690 0.035448466874264 0.860858976217526 0.008926572687034 1.070145122860493 0.001211926592757 1.409975954322260 0.000073333137778 1.573104102697827 0.000010035060959 1.735000000000000 0.000008491205427 C-16 AC 20-191 Appendix C C.2.3 Worst Horizontal Sigma.

As with the NSE noise scale factors, an alternative way of using the step function is to derive scale factors sigma_step_vert and worst_sigma_step horizontal to take into account steps induced by loss of tracking of satellites by the receiver due to geometry (rise/set of satellites) or due to satellite failures. The distributions and the 10 point piecewise linear interpolations are provided below for these two cases for the two dimensions.

Figure C-11 Worst Horizontal Sigma Samples 0.12 bins width = 0.01 m 0.1 0.08 0.06 nb of occurrences 0.04 0.02 0 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 2 worst horizontal sigma (meters) C-17 AC 20-191 Appendix C Table C-9 Sigma_Worst_Horizontal Values and Number of Occurrences Sigma_worst_horizontal Number of occurrences 0.005000000000000 0 0.257665870406134 0.001235856353506 0.293780182441118 0.021311381766140 0.341769349550846 0.107172907188037 0.398519584681962 0.038574002399152 0.489966724012817 0.005669037514146 0.501954763905412 0.003652762189125 0.733255508608094 0.000223859052165 1.294724573608414 0.000000771927766 1.705000000000000 0.000000771927766 C.2.4 Rise/set Sigma Step Vertical.

Figure C-12 Rise/set Sigma Step Vert. Error Samples 0.035 bins width = 0.01 m 0.03 0.025 0.02 0.015 nb of occurrences 0.01 0.005 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Rise/set - sigma step vert (meters) C-18 AC 20-191 Appendix C Table C-10 Rise/Set Sigma_step_vert and Number of Occurrences Rise/Set Sigma_step_vert Number of occurrences 0.005000000000000 0.000102160167567 0.072435248412769 0.000251314012215 0.173069321361968 0.007640899466239 0.183661728498818 0.014862132304962 0.266851710720950 0.032471159430220 0.360116883106780 0.022183880145120 0.560386526870370 0.010022935263488 0.707103250848933 0.002542678888367 1.168108921989317 0.000590218235325 1.605000000000000 0 C.2.5 Rise/set Worst Sigma Step Horizontal.

Figure C-13 Rise/set Worst Sigma Step-horizontal Error Samples 0.06 bins width = 0.01 m 0.05 0.04 0.03 nb of occurrences 0.02 0.01 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Rise/set - worst sigma step hor (meters) C-19 AC 20-191 Appendix C Table C-11 Rise/Set Worst Sigma_Step_Hor and Number of Occurrences Rise/Set Worst Sigma_Step_Hor Number of occurrences 0.005000000000000 0.000002897188944 0.041875996448845 0.004326488398194 0.054920944044943 0.005392271389607 0.109250543156205 0.058667264538146 0.163832898257929 0.050878995869548 0.205763067528231 0.030017730600579 0.339826367851692 0.005884118967452 0.481495931510671 0.001622467406624 0.537593983881708 0.001038030498786 1.425000000000000 0.000000090537154 C.2.6 Signal Loss Sigma step vertical.

Figure C-14 Signal Loss- Sigma Step Vert Error Samples 0.025 bins width = 0.01 m 0.02 0.015 0.01 nb of occurrences 0.005 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Signal Loss - sigma step vert (meters) C-20 AC 20-191 Appendix C Table C-12 Signal loss Sigma_Step_Vert and Number of Occurrences Signal loss Sigma_Step_Vert Number of occurrences 0.005000000000000 0 0.175788354389016 0.000006172962943 0.341225896607212 0.001849289916083 0.501345966346395 0.016428884464905 0.509272880272156 0.014817130740563 0.585415172749149 0.024277512141267 0.634728223925139 0.019985074857159 0.971964045257760 0.004855442265040 0.993665191757176 0.004618156897366 1.565000000000000 0 C.2.7 Signal Loss Worst Sigma Step Horizontal.

Figure C-15 Signal loss worst sigma step hor. Samples 0.04 bins width = 0.01 m 0.035 0.03 0.025 0.02 nb of occurrences 0.015 0.01 0.005 0 0.5 1 1.5 2 2.5 3 3.5 4 4.5 5 Signal Loss - worst sigma step hor (meters) C-21 AC 20-191 Appendix C Table C-13 Signal Loss Worst Sigma_Step_Hor and Number of Occurrences Signal Loss Worst Number of occurrences Sigma_Step_Hor 0.005000000000000 0.000476007789371 0.115610839554299 0.025790440689983 0.180148721789614 0.034439075056633 0.320833114781513 0.015472307517217 0.586810140697307 0.003675003851236 0.880744610706960 0.000358424380494 3.908283843494504 0.000000000123437 3.975118428756177 0.000000000123437 4.601736622281720 0 4.995000000000000 0.000000016910875 C.3 References for GBAS Performance Model.

• ICAO NSP Mar 2009 WGW/WP 30 " SARPS Support for Airworthiness Assessments GLS Signal Modeling ", presented by Tim Murphy, Bretigny, 17-27 March 2009.

• ICAO NSP May10 WGW/WP16, "Computation of Maximum Undetected Error for RRFM in Support of Airworthiness Assessments".

• ICAO NSP May 2010 WGW WP 19, " SARPS Support for Airworthiness Assessments - More on GLS Signal Modeling" Prepared by Tim Murphy.

• ICAO Paper GNSSP-WP-8, Validation of GBAS CAT I Accuracy: A GLS Model and Autoland Simulations for Boeing Airplanes, presented at the ICAO Global Navigation Satellite Systems Panel, Working Group B Meeting, Seattle, WA, May 29 - June 9, 2000.

• ICAO Standards and Recommended Practices (SARPs) for the Global Navigation Satellite System (GNSS). Annex 10 to the Chicago Convention, Vol 1.

• M. Harris, T. Murphy, " Geometry Screening for GBAS to Meet CAT III Integrity and Continuity Requirements ", Proceedings of the Institute of Navigation International Technical Meeting 2007.

• Neri, P., Macabiau, C., Azoulai, L., " Study of a GBAS Model for CAT II/III Simulations", Proceedings of the 22nd International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS 2009) , Savannah, GA , September 2009.

• RTCA / DO-245, Minimum Aviation System Performance Standards (MASPS) for the Local Area Augmentation System (LAAS).

C-22 AC 20-191 Appendix C • RTCA/DO-253D, "Minimum operational Performance Standards for GPS Local Area Augmentation Airborne Equipment".

• RTCA / DO-253C, Minimum Operational Performance Standards (MOPS) for GPS Local Area Augmentation System (LAAS) Airborne Equipment.

• T. Murphy, M Harris, C. Shively, L. Azoulai , M. Brenner " Fault Modeling for GBAS Airworthiness Assessments ", Proceedings of the Institute of Navigation Global Navigation Satellite System Conference, 2010.

• Use of GNSS signals and their augmentations for civil Aviation Navigation during Approaches with Vertical Guidance and Precision Approaches – PhD Thesis P. Neri – 2011.

C.4 Acronyms and Definitions for GBAS Performance Model.

th • B j,vert Estimate of the vertical error due to a fault of the j reference receiver • ECEF Earth-Centered, Earth Fixed coordinate system • E L Lateral Error • E MAX Peak error magnitude • E Vertical error V • GERP GBAS Elevation Reference Point • GRP GLS Reference Point • GW Lateral distance between the main landing gear • GWN Gaussian White Noise • G x Compensation gain • H(s) Second order Butterworth filter that is implemented in the GBAS NSE generator • K atrk NSE geometry scale factor – along track • K NSE geometry scale factor – vertical track vert • K NSE geometry scale factor – cross-track xtrk • LAL Lateral Alert Limit • LLC Land Long Criteria • LP Lateral Protection Level • LSC Land Short Criteria • LTP Landing Threshold Point • M Number of GNSS reference receivers C-23 AC 20-191 Appendix C • maxE L User specified maximum allowable lateral position error • maxE User specified maximum allowable vertical position error V • P md Probability of missed detection • pTSE_LAT E (x,E) Probability density function for the lateral touchdown given a bias  of magnitude E • pTSE_LON (x,E) Probability density function for the longitudinal touchdown given a  E bias of magnitude E • P md (E) Probability of an error not being detected as a function of E • PU (E) Probability of an unsuccessful landing given an error • PUL E (E) Probability of an unsuccessful landing given a particular size of  error • RMS Root Mean Square • RR Ramp Rate • RRFM Reference Receiver Fault Monitor • RWE Lateral landing criteria • S Projection of the vertical component and translation of the along- Aprvert.i th track components into the vertical for i ranging source • S lat Largest lateral coefficient magnitude for any single satellite • S Largest sum of lateral coefficient magnitudes for any two satellites lat2 • S vert Largest vertical coefficient magnitude for any single satellite • S vert_max Maximum vertical projection for any satellite allowed by geometry screening • S vert2 Largest sum of vertical coefficient magnitudes for any two satellites • TBAC Maximum threshold for the RRFM monitor • TTD Time To Detect • VAL Vertical Alert Limit • VPL Vertical Protection Level • ω n Natural frequency in radians/second C-24 AC 20-191 Appendix D APPENDIX D. AFM PROVISIONS AND EXAMPLE AFM WORDING D.1 Example Provision: AFM "Certificate Limitation" Section.

(With "Type Specific" Example Information and Notes) (List Aircraft Type) AIRPLANE FLIGHT MANUAL Section 1 - CERTIFICATE LIMITATIONS ELECTRONIC SYSTEMS AUTOPILOT/FLIGHT DIRECTOR SYSTEM Automatic Landing Maximum wind component speeds when landing weather minima are predicated on autoland operations: Headwind: 25 knots Tailwind: 15 knots Crosswind: 5 knots The maximum and minimum glideslope angles are 3.25 degrees and 2.5 degrees respectively.

The autoland capability may be used with flaps 20 or 30, with both engines operative or with one engine inoperative. The Autopilot Flight Director System (AFDS) status annunciation must have LAND 2 or LAND 3 displayed and the SLATS DRIVE message must not be present.

Automatic Approach with Flaps 25 Autoland is not approved with flaps 25.

FAA APPROVED (Date) Section 3 Page D-1 AC 20-191 Appendix D D.2 Example Provision - AFM “Normal Procedures” or “Normal Operation” Section.

[Typical Aircraft Type with Fail Operational and Fail Passive FGS Capability] (List Aircraft Type) AIRPLANE FLIGHT MANUAL Section 3 - NORMAL PROCEDURES AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) LOW WEATHER MINIMA - AUTOMATIC LANDING - FAIL-OPERATIONAL The autopilot system has been shown to meet the applicable airworthiness, performance, and integrity criteria applicable to Category III as specified in FAA Advisory Circular AC 20-191 for a fail- operational automatic landing system, with the following functions operative and LAND 3 annunciated: Autoland status annunciation on both PFD’s Autothrottle /autothrust Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting messages are not displayed: SGL SOURCE DISPLAYS SGL SOURCE RAD ALT SINGLE SOURCE ILS LOW WEATHER MINIMA - AUTOMATIC LANDING - FAIL-PASSIVE The autopilot system has been shown to meet the applicable airworthiness, performance, and integrity criteria applicable to Category III as specified in FAA AC 20-191 for a fail-passive automatic landing system, with the following functions operative and LAND 2 annunciated: Autoland status annunciation on both PFD’s Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting messages are not displayed: SGL SOURCE DISPLAYS SGL SOURCE RAD ALT SINGLE SOURCE ILS The demonstration for fail-passive autoland operations with LAND 2 annunciated included a provision for a go-around if a subsequent autopilot system failure were to be detected on approach, if operational credit for use of autoland is required.

CAUTION: If the autopilot disconnects during an engine-out go-around, loss of autopilot rudder control can result in large yaw and roll excursions.

FAA APPROVED (Date) Section 3 Page D-2 AC 20-191 Appendix D Page 2 of Example Provision - AFM “Normal Procedures” or “Normal Operation” Section[Typical Aircraft Type with Fail Operational and Fail Passive FGS Capability] Section 3 - NORMAL PROCEDURES AUTOPILOT - F LIGHT DIRECTOR SYSTEM (AFDS) (Continued) LOW WEATHER MINIMA - AUTOPILOT APPROACH The autopilot system has been shown to meet the applicable airworthiness, performance, and integrity criteria applicable to Category II as specified in FAA AC 20-191 Chapter 4 for automatic approach with the following functions operative and LAND 3 or LAND 2 annunciated: Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting messages are not displayed: SGL SOURCE DISPLAYS SGL SOURCE RAD ALT SINGLE SOURCE ILS LOW WEATHER MINIMA - FLIGHT DIRECTOR The flight director system has been shown to meet the applicable airworthiness, performance, and integrity criteria applicable to Category II as specified in FAA AC 20-191 for manual approach with the following functions operative: Normal flight controls Air Data Inertial Reference Unit Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting messages are not displayed: SGL SOURCE DISPLAYS SGL SOURCE RAD ALT SINGLE SOURCE ILS SINGLE SOURCE F/D FAA APPROVED (Date) Section 3 Page D-3 AC 20-191 Appendix D D.3 Example Provision - AFM “Normal Procedures” or “Normal Operation” Section.

[Typical Aircraft Type with Fail Passive FGS Capability] (List Aircraft Type) AIRPLANE FLIGHT MANUAL Section 3 - NORMAL OPERATIONS AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) The Autopilot-Flight Director System is used as either a single channel autopilot or flight director for en route and single channel approaches. Dual autopilot channels provide fail-passive operation for automatic landing and go-around. Dual flight directors provide for takeoff, approach, and go-around guidance.

The following flight path control functions for automatic (autopilot) and/or manual (flight director) control of the airplane are provided: • Lateral navigation (LNAV) • Vertical navigation (VNAV) • VOR • LOC (Front course only) Approach • Autoland (Dual autopilot only) • Go-around (Dual autopilot and/or flight director only) The following pilot assist functions for automatic (autopilot) and/or manual (flight director) control of the airplane are provided: • Control Wheel Steering (Autopilot only) • Heading select and hold • Vertical speed select and hold • IAS/Mach select and hold (Elevator control of speed in level change) • Altitude Select/Acquire or Capture and Hold • Takeoff (Dual Flight director only) • Go-around, one engine inoperative (Dual Flight director only) The Captain’s and First Officer’s instruments (Display Source, VHF NAV and IRS) must not be on the same source when credit for use of the AFDS is necessary to make lower weather minima approaches.

An interlock is provided with the electrical transfer bus sensing circuit to preclude dual-channel autopilot operation on a single source of power. However, the Auxiliary Power Unit generator may be used as an independent power source.

FAA APPROVED (Date) Section 3 Page ___ D-4 AC 20-191 Appendix D Page 2 of Example Provision - AFM “Normal Procedures” or “Normal Operation” Section [Typical Aircraft Type with Fail Passive FGS Capability] Section 3 - NORMAL OPERATIONS AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued) DEMONSTRATED CONDITIONS The system has been demonstrated both with and without yaw damper and autothrottle/autothrust and with normal landing flaps 30 and 40.

The approach speed selected for automatic approaches using autothrottles /autothrust was V + 5 knots REF (no wind correction).

The approach speed selected for autothrottle/autothrust inoperative was V for calm air conditions and REF VREF + 1/2 (Headwind) + Full Gust for wind conditions.

The automatic landing system has been demonstrated in VMC conditions with the following wind conditions: Headwind - 25 knots Tailwind - 30 knots Crosswind - 24 knots Satisfactory Automatic Landing System performance has been demonstrated on U.S. Type II and Type III ILS ground facilities.

An autopilot minimum engage height of 400 feet after takeoff has been demonstrated to provide satisfactory performance.

Single Engine Approach: The AFDS has demonstrated adequate performance for low visibility approach using a single engine, with flaps 15.

MINIMUM MULTICHANNEL ENGAGE ALTITUDE FOR AUTOLAND On approach for autoland, dual channel operation should be engaged prior to 800 feet AGL. Check FLARE arm annunciation at approximately 500 feet AGL.

FAA APPROVED (Date) Section 3 Page D-5 AC 20-191 Appendix D Page 3 of Example Provision - AFM “Normal Procedures” or “Normal Operation” Section [Typical Aircraft Type with Fail Passive FGS Capability] Section 3 - NORMAL OPERATIONS AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued) AFDS SYSTEM CONFIGURATION The AFDS equipment listings in this section do not necessarily denote all of the systems and equipment required for the types of operation specified. Applicable FAR's and AC’s may prescribe performance provisions for such additional systems such as autothrottle/autothrust, or autobrakes. Operators should determine the total systems requirements for each type of operation prior to requesting OpSpecs authorization.

Demonstrated compliance with the airworthiness performance standards does not constitute approval to conduct operations in lower weather minimums.

DEMONSTRATED ALTITUDE LOSS The demonstrated altitude loss due to a simulated hard-over autopilot malfunction is: Level Flight: Flaps up - 370 feet when recovery was initiated 3 seconds after the recognition point.

Approach: (a) 23 feet with a 1 second time delay between recognition point and initiation of recovery.

(b) Negligible when recovery was initiated without delay after pilot recognition.

Go-Around: The demonstrated altitude loss during an automatic go-around initiated below 100 feet AGL is listed below: GA Altitude (ft AGL) Altitude Loss (ft) 70 to 100 26 60 21 50 20 40 18 30 11 20 3 10 2.5 FAA APPROVED (Date) Section 3 Page D-6 AC 20-191 Appendix D Page 4 of Example Provision - AFM “Normal Procedures” or “Normal Operation” Section [Typical Aircraft Type with Fail Passive FGS Capability] Section 3 - NORMAL OPERATIONS AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued) AUTOPILOT APPROACH/AUTOLAND (FAIL PASSIVE) (Applicable to Category III) The Autopilot System has been shown to meet the applicable airworthiness and performance and reliability criteria of FAA AC 20-191 for automatic approach and landing of the aircraft to touchdown with the following additional equipment operative and FLARE arm annunciated.

• Dual Channel Autopilot engaged • Low Range Radio Altimeter and display for each Pilot • DH Display for each Pilot • Two Digital Air Data Computer Systems • Windshield Wipers for each Pilot • ILS Receiver and display for each Pilot • Flight Mode Annunciator for each Pilot • Two ADIRU's (associated with the engaged autopilots) in NAV mode • Dual Hydraulic Systems • Two sources of electrical power (The APU generator may be used as an independent power source) • Both Engines Operating AUTOPILOT APPROACH (Applicable to Category II) The Autopilot System has been shown to meet the airworthiness, performance, and reliability criteria of FAA AC 20-191, Chapter 4 for Category II, for automatic approach with the following additional listed equipment operative: • Single or Dual channel Autopilot engaged • Low Range Radio Altimeter and display for each Pilot • DH Display for each Pilot • Two Digital Air Data Computer Systems • Windshield Wipers for each Pilot • ILS Receiver and display for each Pilot • Flight Mode Annunciator for each Pilot • Two ADIRU's (associated with the engaged autopilot) in NAV mode • Two sources of electrical power (The APU generator may be used as an independent power source.)

• Both Engines Operating FAA APPROVED (Date) Section 3 Page D-7 AC 20-191 Appendix D Page 5 of Example Provision - AFM “Normal Procedures” or “Normal Operation” Section [Typical Aircraft Type with Fail Passive FGS Capability] Section 3 - NORMAL OPERATIONS AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued) FLIGHT DIRECTOR (F/D) The flight director command may be used as supplemental guidance to the primary speed and attitude indications for takeoff, climb, and descent to acquire and maintain desired altitudes.

All of the autopilot command modes, except "CWS," are also available on the flight directors. An additional takeoff mode exists for the F/D only. One or both F/Ds may be on for all modes, except during T/O or GA that requires dual F/D ON .

FLIGHT DIRECTOR APPROACH (Applicable to Category II) The flight director system has been shown to meet the applicable airworthiness, performance, and reliability criteria of FAA AC 20-191 for manual approach with the following equipment operative: • Both flight directors must be selected • Low Range Radio Altimeter and display for each Pilot • DH Display for each Pilot • Two Digital Air Data Computer Systems • Windshield Wipers for each Pilot • ILS Receiver and display for each Pilot • Flight Mode Annunciator for each Pilot • Two ADIRUs in NAV mode.

• Two sources of electrical power. (The APU generator may be used as an independent power source.)

• Both Engines Operating GO - AROUND When go-around is initiated, the autothrottle/autothrust system (if engaged) advances the thrust levers automatically. Flaps and landing gear must be controlled manually.

An Autothrottle/autothrust, Flight Director and/or Dual Autopilot go-around may be initiated below a radio altitude of 2000 feet by pressing the go-around switches.

When a decision is made to abort an approach, actuate the go-around switches and assure rotation to go-around attitude. Verify thrust lever movement to achieve a nominal rate of climb and retract flaps to flaps 15.

After a positive rate of climb has been established, retract landing gear. Climb to a safe altitude, accelerate and retract remaining flaps according to takeoff flap retraction speed schedule. Monitor rate of climb, attitude, and airspeed.

Full go-around thrust may be obtained, after engine spool up, by reactivating the go-around switch(es). In windshear, the recommended procedure is to delay flap and gear retraction until windshear is no longer a factor.

FAA APPROVED (Date) Section 3 Page D-8 OMB Control Number: 2120-0746 Expiration Date:12/31/2027 Advisory Circular Feedback Form Paperwork Reduction Act Burden Statement: A federal agency may not conduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering, and maintaining the data needed, completing, and reviewing the collection of information. All responses to this collection of information are voluntary. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.

If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to (9-avs-air-directives-management-officer@faa.gov) or (2) faxing it to the attention of the LOB/SO _________N/A____________.

Subject: Date: Please mark all appropriate line items: ☐ An error (procedural or typographical) has been noted in paragraph on page.

☐ Recommend paragraph on page be changed as follows: ☐ In a future change to this AC, please cover the following subject: (Briefly describe what you want added.)

☐ Other comments: ☐ I would like to discuss the above. Please contact me.

Submitted by: Date: FAA Form 1320-73 (01/25) SUPERSEDES PREVIOUS EDITIONS