ED Decision 2022/007/R
(See CS 25.1309 and its AMC, and AMC1 AWO.B.CATIII.121 and AMC2 AWO.B.CATIII.121)
(a) The effects of failures of the flight guidance system including the navigation means (facilities external to the aircraft) shall be considered in accordance with CS 25.1309 and CS 25.1329.
(b) The radio altimeter (or other device capable of providing equivalent performance and integrity level), and excess-deviation alerts shall comply with CS AWO.B.CATII.120 and CS AWO.B.CATII.121 respectively.
[Issue: CS-AWO/2]
AMC1 AWO.B.CATIII.121 Flight demonstrations of failure conditions
ED Decision 2022/007/R
1 Failures
1.1 Indications and alerts
Failure indications and alerts should be demonstrated. (See AMC 25.1309)
1.2 Effects
For compliance with CS 25.1309, the effects of failure conditions will need to be demonstrated including not only failures of the landing system but also failures in other aeroplane equipment which could affect the landing (e.g. engines, reverse thrust, nose‑wheel steering) and failures in the xLS ground facility. Although this demonstration may be done primarily by using a ground simulation, some cases should also be demonstrated in flight to confirm the conclusions of the simulation. (See AMC 25.1309)
2 Crew errors
Individual landings additional to those of AMC AWO.A.ALS.106 paragraph 2.1 should be carried out to demonstrate that errors, which can reasonably be expected to occur, are not hazardous (e.g. asymmetric braking or reverse thrust, incorrect approach speed). (See AMC AWO.A.ALS.106 paragraph 2.2)
[Issue: CS-AWO/2]
AMC2 AWO.B.CATIII.121 Flight crew and maintenance checks
ED Decision 2022/007/R
When exposure times relevant to failure probability calculations are dependent on flight crew and maintenance checks (i.e. preflight, first flight of the day, pre-land, etc.) and/or inspection intervals for dormant (latent) failures, these tasks, time intervals and the recommended component monitoring programme should be specified in the AFM or maintenance manual as appropriate.
[Issue: CS-AWO/2]
CS AWO.B.CATIII.122 Fail-passive automatic landing system (including super fail-passive system)
ED Decision 2022/007/R
(See AMC1 AWO.B.CATIII.122(a) and AMC2 AWO.B.CATIII.122(a))
(a) For a fail-passive automatic landing system, failure conditions resulting in the loss of automatic landing control capability below the DH shall not occur more frequently than once every thousand approaches.
(b) For a fail-passive automatic landing system, any failure condition, which is not extremely remote, shall be automatically detected and neutralised before it has a significant effect on the trim, flight path or attitude.
[Issue: CS-AWO/2]
AMC1 AWO.B.CATIII.122(a) and AWO.B.CATIII.123(a) Loss of system function
ED Decision 2022/007/R
For compliance with CS AWO.B.CATIII.122(a) and CS AWO.B.CATIII.123(a), it may be necessary to measure monitored variables in flight to determine the probability that any monitored variable will reach a warning threshold.
(See AMC AWO.B.CATII.113)
[Issue: CS-AWO/2]
AMC2 AWO.B.CATIII.122(a) Safety of the manual landing and go‑around manoeuvres following a loss of the automatic control capability for fail-passive systems
ED Decision 2022/007/R
1 Reliability
Certification flight test data may need to be supplemented by either in-service data or analysis to establish the required level of reliability.
2 Manual go-around
2.1 Safety considerations
2.1.1 Following a loss of the automatic pilot below the DH, it should be safe to execute and perform a manual go-around from any point on the approach down to touchdown, in all configurations to be certified. The manoeuvre should not require exceptional piloting skill, alertness or strength, and should ensure that the aeroplane remains within the obstacle limitation surface specified in ICAO Annex 14, for a precision approach runway Category II or III.
2.1.2 For aircraft for which a go-around from a very low altitude may result in inadvertent runway contact, the safety of the procedure should be established giving consideration to at least the following:
a. Where the guidance information provided by the go-around mode is retained, it should be shown to have safe and acceptable characteristics throughout the manoeuvre.
b. Other systems (e.g. automatic throttle / thrust, brakes, spoilers and reverse thrust) should not operate in a way that would adversely affect the safety of the go-around manoeuvre.
2.1.3 Non-normal procedures that are applicable following a loss of a fail-passive automatic landing system (see paragraph 3) may require reversion to manual control using primary display information such as attitude and airspeed, to perform a manual go-around. Where applicable, consideration should be given to failure conditions that could result in a loss of both the automatic landing system and the relevant primary display information.
2.2 Performance
The safety of the go-around manoeuvre may be determined by flight-testing (typically 10 go-arounds) supported, where necessary, by simulator testing.
If a loss of the automatic pilot can result in a loss of the flight director guidance, this should be considered during the performance demonstration.
3 Manual landing
Following a loss of the automatic control capability below the DH, a safe landing should be demonstrated in accordance with established procedures.
a. The demonstration should take into account at least the following variables:
i. centre of gravity;
ii. landing weight; and
iii. wind conditions.
b. If the demonstration is to be performed with a simulator, the simulator should be:
a) equipped with a visual system that provides an acceptable representation of the actual visibility conditions for which operational approval is sought; and
b) suitably validated by flight test demonstrations for the landing manoeuvre.
c. The number of manual landings to be performed should be related to the probability of a loss of the automatic landing system below the DH.
4 Consideration of the effects of engine failure
4.1 Where the landing system provides automatic control of the rudder pedals, a demonstration should be made to show that, for automatic approaches initiated with all engines operating:
a. automatic go-around, and
b. automatic landing
can be performed safely following the failure of any single engine at any point during the approach down to touchdown without the pilot needing to intervene and assume control.
4.2 The automatic pilot should remain engaged following the failure of any single engine, taking account of the loss of systems (e.g. electrical and hydraulic systems) associated with the failed engine.
[Issue: CS-AWO/2]
CS AWO.B.CATIII.123 Fail-operational landing system (automatic or hybrid)
ED Decision 2022/007/R
(See AMC2 AWO.B.CATIII.121)
(a) For a fail-operational landing system, the probability of total loss of the landing system below the alert height shall be extremely remote. Demonstration of compliance shall be by means of a suitable analysis programme supported, where necessary, by a simulation and flight test programme (see AMC1 AWO.B.CATIII.122(a) and AMC AWO.B.CATIII.123(a). Special precautions shall be taken to ensure that redundant subsystems are not vulnerable to simultaneous disengagement or failure warning.
(b) A fail-operational landing system shall operate as a fail-passive system following a first failure, which leads to a loss of the fail-operational capability.
(c) A fail-operational automatic throttle/thrust system shall be provided unless the effect of a loss of the automatic speed control is minor.
[Issue: CS-AWO/2]
AMC AWO.B.CATIII.123 Safety of the manual landing and go‑around manoeuvres following a loss of the automatic control capability for fail-operational landing systems (automatic or hybrid)
ED Decision 2022/007/R
1 Reliability
Certification flight test data may need to be supplemented by either in-service data or analysis to establish the required level of reliability.
2 Manual go-around
2.1 Safety considerations
2.1.1 Following a loss of the automatic pilot below the DH, it should be safe to execute and perform a manual go-around from any point on the approach down to touchdown, in all configurations to be certified. The manoeuvre should not require exceptional piloting skill, alertness or strength, and should ensure that the aeroplane remains within the obstacle limitation surface specified in ICAO Annex 14 for a precision approach runway Category II or III.
2.1.2 For aircraft for which a go-around from a very low altitude may result in inadvertent runway contact, the safety of the procedure should be established giving consideration to at least the following:
a. Where the guidance information provided by the go-around mode is retained, it should be shown to have safe and acceptable characteristics throughout the manoeuvre.
b. Other systems (e.g. automatic throttle, brakes, spoilers and reverse thrust) should not operate in a way that would adversely affect the safety of the go-around manoeuvre.
2.1.3 Non-normal procedures that are applicable following a loss of a fail-passive automatic landing system (see paragraph 3) may require the flight crew to revert to manual control using primary display information, such as attitude and airspeed, to perform a manual go-around. Where applicable, consideration should be given to failure conditions that could result in a loss of both the automatic landing system and the relevant primary display information.
2.2 Performance
The safety of the go-around manoeuvre may be determined by flight testing (typically 10 go-arounds) supported, where necessary, by simulator testing.
If a loss of the automatic pilot can result in a loss of the flight director guidance, this should be considered during the performance demonstration.
3 Manual landing
Following a loss of the automatic control capability below the DH, a safe landing should be demonstrated in accordance with established procedures.
a. The demonstration should take into account at least the following variables:
i. centre of gravity (CG),
ii. landing weight, and
iii. wind conditions.
b. If the demonstration is to be performed with a simulator, the simulator should be:
i. equipped with a visual system that provides an acceptable representation of the actual visibility conditions for which operational approval is sought; and
ii. suitably validated by flight test demonstrations for the landing manoeuvre.
c. The number of manual landings to be performed should be related to the probability of a loss of the automatic landing system below the DH.
4 Consideration of the effects of engine failure
4.1 Where the landing system provides automatic control of the rudder pedals, a demonstration should be made to show that, for automatic approaches initiated with all engines operating:
a. automatic go-around, and
b. automatic landing
can be performed safely following the failure of any single engine at any point during the approach down to touchdown without the pilot needing to intervene and assume control.
4.2 The automatic pilot should remain engaged following the failure of any single engine, taking account of the loss of systems (e.g. electrical and hydraulic systems) associated with the failed engine.
CS AWO.B.CATIII.124 Head-up display (or other form of guidance display) fail-operational hybrid landing system
ED Decision 2022/007/R
(See AMC1 AWO.B.CATIII.121 and AMC2 AWO.B.CATIII.121)
Where a HUDLS is fitted for use in the event of automatic landing system failure, the combination of the two systems shall comply with CS AWO.A.ALS.111 and CS AWO.A.ALS.112. In addition, the failure modes of the display shall not lead a pilot to disengage a satisfactorily functioning autopilot and obey the malfunctioning display.
[Issue: CS-AWO/2]
CS AWO.B.CATIII.125 Nose-wheel steering
ED Decision 2022/007/R
(See AMC1 AWO.B.CATIII.121 and AMC2 AWO.B.CATIII.121)
In showing that the nose-wheel steering system complies with CS 25.745(c), account shall be taken of the effect of the visibility conditions on the ability of the pilot to detect steering faults and to take over control.
[Issue: CS-AWO/2]
CS AWO.B.CATIII.126 Automatic go-around
ED Decision 2022/007/R
Total failure (shutdown) of the xLS facility shall not result in a loss of the automatic go-around capability.
[Issue: CS-AWO/2]