07/13/99 AC 120-28D

Page i

List of Appendices

Appendix 1. - DEFINITIONS AND ACRONYMS

Appendix 2. - AIRWORTHINESS APPROVAL OF AIRBORNE SYSTEMS USED

DURING A TAKEOFF IN LOW VISIBILITY WEATHER CONDITIONS

Appendix 3. - AIRWORTHINESS APPROVAL FOR AIRBORNE SYSTEMS USED

TO LAND AND ROLLOUT IN LOW VISIBILITY CONDITIONS

Appendix 4. - WIND MODEL FOR APPROACH AND LANDING SIMULATION

Appendix 5. - AIRWORTHINESS DEMONSTRATION OF DECELERATION &

BRAKING SYSTEMS OR DISPLAYS - [RESERVED]

Appendix 6. - AFM PROVISIONS AND EXAMPLE AFM WORDING

Appendix 7. - STANDARD OPERATIONS SPECIFICATIONS

Appendix 8. - IRREGULAR TERRAIN ASSESSMENT

Appendix 9. - TAKEOFF SYSTEM PERFORMANCE AFTER LIFTOFF

AC 120-28D

07/13/99 Appendix 1

Page 1

APPENDIX 1

DEFINITIONS AND ACRONYMS

This Appendix contains the definition of terms and acronyms used within this Advisory Circular (AC). The

appendix also contains certain terms that are not used in this AC but are used in related AC’s and are

included for convenient reference. Certain definition of terms and acronyms are also provided to facilitate

common use of this Appendix for other related AC’s.

Definitions.

Actual Navigation

Performance

A measure of the current estimated navigation performance, excluding Flight

Technical Error (FTE).

Actual Navigation Performance is measured in terms of accuracy, integrity,

and availability of navigation signals and equipment.

Note: Also see Estimated Position Uncertainty [EPU].

Aeronautical Chart Critical

data

Data for Aeronautical charts determined in accordance with RTCA or ICAO

Annex 4 criteria considered to have a very low probability of significant error

and very high probability of validity

[e.g., Perror per unit data element <1 X 10-8 ]

Aeronautical Chart Essential

data

Data for Aeronautical charts determined in accordance with RTCA or ICAO

Annex 4 criteria considered to have a low probability of significant error and

high probability of validity [e.g., Perror per unit data element <1 X 10-5 ]

Aeronautical Chart Routine

data

Data for Aeronautical charts determined in accordance with RTCA or ICAO

Annex 4 criteria considered to have a routine possibility of significant error

and routine validity [e.g., Perror per unit data element <1 X 10-3]

Approach Intercept Waypoint

(APIWP)

Variable waypoint used only when intercepting the Final Approach Segment

(FAS).

Automatic Dependent

Surveillance (ADS)

A surveillance technique in which aircraft automatically provide, via data

link, data derived from on-board navigation and position fixing systems,

including aircraft identification, four dimensional position and additional

data as appropriate (ICAO - IS&RP Annex 6).

Alert Height A height above the runway based on the characteristics of the aircraft and its

fail-operational landing system, above which a Category III approach would

be discontinued and a missed approach initiated if a failure occurred in one of

the redundant parts of the fail operational landing system, or in the relevant

ground equipment. (ICAO - IS&RP Annex 6).

Airborne Navigation system The airborne equipment that senses and computes the aircraft position relative

to the defined path, and provides information to the displays and to the flight

guidance system. It may include a number of receivers and/or system

computers such as a Flight Management Computer and typically provides

inputs to the Flight Guidance System.
AC 120-28D

Appendix 1 07/13/99

Page 2

Automatic Go-Around A Go-Around which is accomplished by an autopilot following pilot selection

and initiation of the "Go-Around" autopilot mode, when an autopilot is

engaged in an "approach mode."

Availability An expectation that systems or elements required for an operations will be

available to perform their intended functions so that the operation will be

accomplished as planned to an acceptable level of probability.

Balked Landing A discontinued landing attempt. Term is often used in conjunction with

aircraft configuration or performance assessment, as in "Balked landing climb

gradient," Also see "Rejected Landing."

Catastrophic Failure

Condition

Failure Condition which would result in multiple fatalities, usually with the

loss of the airplane.

Category I A precision instrument approach and landing with a decision height not lower

than 60m (200 ft) and with either a visibility not less than 800m

(2400 ft), or a runway visual range not less than 550m (1800 ft).

(ICAO - IS&RP Annex 6).

Category II A precision instrument approach and landing with a decision height lower

than 60m (200 ft) but not lower than 30m (100 ft) and a runway visual range

not less than 350m (1200 ft). (ICAO - IS&RP Annex 6).

Category IIIa A precision instrument approach and landing with a decision height lower

than 30m (100 ft), or no decision height and a runway visual range not less

than 200m (700 ft). (ICAO - IS&RP Annex 6).

Category IIIb A precision instrument approach and landing with a decision height lower

than 15m (50 ft), or no decision height and a runway visual range less than

200m (700 ft) but not less than 50m (150 ft). (ICAO - IS&RP Annex 6).

FAA Note - the United States does not use Decision Heights for Category IIIb.

Category IIIc A precision instrument approach and landing with no decision height and no

runway visual range limitations. (ICAO - IS&RP Annex 6).

Class I Navigation Navigation within the Service Volume of an ICAO Standard NAVAID.

Class II Navigation A flight operation or portion of a flight operation (irrespective of the means of

navigation) which takes place outside (beyond) the designated Operational

Service Volume of an ICAO standard airway navigation facility or NAVAID

(e.g., VOR, VOR/DME, NDB).

Combiner The element of the head-up- display (HUD) in which the pilot simultaneously

views the external visual scene along with synthetic information provided in

symbolic form.

Command Information Information that directs the pilot to follow a course of action in a specific

situation (e.g., Flight Director).
AC 120-28D

07/13/99 Appendix 1

Page 3

Conformal Information Information which correctly overlays the image of the real world, irrespective

of the pilots viewing position.

Datum Crossing Height

[DCH]

The height (in feet or meters) of the Flight Path Control Point above the

Runway Datum Point.

Decision Altitude (DA) A specified altitude in the precision approach at which a missed approach

must be initiated if the required visual reference to continue the approach has

not been established. (Adapted from ICAO - IS&RP Annex 6).

Decision Altitude (Height)

DA(H)

For Category I, a specified minimum altitude in an approach by which a

missed approach must be initiated if the required visual reference to continue

the approach has not been established. The "Altitude" value is typically

measured by a barometric altimeter or equivalent (e.g., Inner Marker) and is

the determining factor for minima for Category I Instrument Approach

Procedures. The "Height" value specified in parenthesis is typically a radio

altitude equivalent height above the touchdown zone (HAT) used only for

advisory reference and does not necessarily reflect actual height above

underlying terrain.

For Category II and certain Category III procedures (e.g., when using a FailPassive autoflight system) the Decision Height (or an equivalent IM position

fix) is the controlling minima, and the altitude value specified is advisory.

The altitude value is available for cross reference. Use of a barometrically

referenced DA for Category II is not currently authorized for 14 CFR

part 121, 129 or 135 operations at U.S. facilities (Adapted from ICAO -

IS&RP Annex 6).

Decision Height (DH) A specified height in the precision approach at which a missed approach must

be initiated if the required visual reference to continue the approach has not

been established (Adapted from ICAO - IS&RP Annex 6).

Design Eye Box The three dimensional volume in space surrounding the Design Eye Position

from which the HUD information can be viewed.

Design Eye Position The position at each pilot's station from which a seated pilot achieves the

optimum combination of outside visibility and instrument scan.

Defined Path The path that is defined by the path definition function.

Desired Path The path that the flightcrew and air traffic control can expect the aircraft to

fly.

Enhanced Vision System An electronic means to provide the flightcrew with a synthetic image of the

external scene.

Estimate of Position

Uncertainty [EPU], or

Estimated Position Error [EPE]

A measure based on a scale which conveys the current position estimation

performance - Also called Estimated Position Error (EPE)
AC 120-28D

Appendix 1 07/13/99

Page 4

Extended Final Approach

Segment (EFAS)

That segment of an approach, co-linear with the Final Approach Segment, but

which extends beyond the Glidepath Intercept Waypoint (GPIWP) or

Approach Intercept Waypoint (APIWP).

External Visual Reference Information the pilot derives from visual observation of real world cues

outside the cockpit.

Extremely Improbable A probability of occurrence on the order of 1 x 10-9 or less per hour of flight,

or per event (e.g., takeoff, landing).

Extremely Remote A probability of occurrence between the orders of 1 x 10-9 and 1 x 10-7

per hour of flight, or per event (e.g., takeoff, landing).

Fail Operational System A system capable of completing the specified phases of an operation

following the failure of any single system component after passing a point

designated by the applicable safety analysis (e.g., Alert Height).

Fail Passive System A system which, in the event of a failure, causes no significant deviation of

aircraft flight path or attitude.

Field of View As applied to a Head Up Display - the angular extent of the display that can

be seen from within the design eye box.

Frequent Occurring more often than 1 in 1000 events or 1000 flight hours.

Final Approach Course (FAC) The final bearing/radial/track of an instrument approach leading to a runway,

without regard to distance. For certain previously designed approach

procedures that are not aligned with a runway, the FAC bearing/radial/track of

an instrument approach may lead to the extended runway centerline, rather

than to alignment with the runway.

Final Approach Fix (FAF) The fix from which the final approach to an airport is executed. For standard

procedures that do not involve multiple approaches segments intercepting the

runway centerline near the runway, the FAF typically identifies the beginning

of the straight-in final approach segment.

Final Approach Point (FAP) The point applicable to instrument approaches other than ILS, MLS or GLS,

with no depicted FAF (e.g., only applies to approaches such as an on-airport

VOR or NDB), where the aircraft is established inbound on the final approach

course from a procedure turn, and where descent to the next procedurally

specified altitude, or to minimum altitude, may be commenced.

Final Approach Segment

(FAS)

The segment of an approach extending from the Glidepath Intercept Waypoint

(GPIWP) or Approach Intercept Waypoint (APIWP), whichever occurs later,

to the Glidepath Intercept Reference Point (GIRP).

Flight Guidance System The means available to the flightcrew to maneuver the aircraft in a specific

manner either manually or automatically. It may include a number of

components such as the autopilot, flight directors, relevant display and

annunciation elements and it typically accepts inputs from the airborne

navigation system.
AC 120-28D

07/13/99 Appendix 1

Page 5

Flight Path Alignment Point

(FPAP)

The FPAP is a point, usually at or near the stop end of a runway, used in

conjunction with the RDP and a vector normal to the WGS-84 ellipsoid at the

RDP to define the geodesic plane of a final approach and landing flight path.

The FPAP typically may be the RDP for the reciprocal runway.

Flight Path Control Point

(FPCP)

The Flight Path Control Point (FPCP) is a calculated point located directly

above the Runway Datum Point. The FPCP is used to relate the vertical

descent of the final approach flight path to the landing runway.

Flight Technical Error (FTE) The accuracy with which the aircraft is controlled as measured by the

indicated aircraft position with respect to the indicated command or desired

position. Note: FTE does not include human performance conceptual errors,

typically which may be of large magnitude (e.g., entry of an incorrect waypoint or waypoint position, selection of an incorrect procedure, selection of an

incorrect NAVAID frequency, failure to select a proper flight guidance

mode).

Glide Path Angle [GPA] The glide path angle is an angle, defined at the FPCP, that establishes the

descent gradient for the final approach flight path of an approach procedure.

It is measured in the geodesic plane of the approach (defined by the RDP,

FPAP, and WGS-84 ellipsoid’s center). The vertical and horizontal

references for the GPA are a vector normal to the WGS-84 ellipsoid at the

RDP and a plane perpendicular to that vector at the FPCP, respectively.

Glide Path Intercept

Waypoint (GPIWP)

The point at which the established glide slope intercept altitude (MSL) meets

the Final Approach Segment (FAS), on a standard day, using a standard

altimeter setting (1013.2 HPa or 29.92 in).

Glidepath Intercept Reference

Point [GIRP]

The Glidepath Intercept Reference Point is the point at which the extension of

the final approach path intercepts the runway.

GNSS Landing System (GLS) A differential GNSS (e.g., GPS) based landing system providing both vertical

and lateral position fixing capability. Note: Term may be applied to any GNSS

based differentially corrected landing system providing lateral and vertical

service for approach and landing equivalent to or better than that provided by a

U.S. Type I ILS, or equivalent ILS specified by ICAO Annex 10.

Global Positioning System

[GPS]

The NAVSTAR Global Positioning System operated by the United States

Department of Defense. It is a satellite -based radio navigation system

composed of space, control and user segments. The space segment is

composed of satellites. The control segment is composed of monitor stations,

ground antennas and a master control station. The user segment consists of

antennas and receiver-processors that derive time and compute a position and

velocity from the data transmitted from the satellites.

Global Navigation Satellite

System [GNSS]

A world wide position, velocity and time determination system that uses one

or more satellite constellations.

Guidance Information used during manual control or monitoring of automatic control of

the aircraft that is of sufficient quality to be used by itself for the intended

purpose.
AC 120-28D

Appendix 1 07/13/99

Page 6

Go-around A transition from an approach to a stabilized climb.

Hazardous Failure Condition Failure Conditions which would reduce the capability of the airplane or the

ability of the crew to cope with adverse operating conditions to the extent that

there would be:

(i) A large reduction in safety margins or functional capabilities;

(ii) Physical distress or higher workload such that the flightcrew cannot

be relied upon to perform their tasks accurately or completely; or

(iii) Serious or fatal injury to a relatively small number of the occupants.

Head Up Display System An aircraft system which provides head-up guidance to the pilot during flight.

It includes the display element, sensors, computers and power supplies,

indications and controls. It may receive inputs from an airborne navigation

system or flight guidance system.

Hybrid System A combination of two, or more, systems of dissimilar design used to perform a

particular operation.

Improbable A probability of occurrence greater than 1 x 10-9 but less than or equal to

1 x 10-5 per hour of flight, or per event (e.g., takeoff, landing).

Independent Systems A system that is not adversely influenced by the operation, computation, or

failure of some other identical, related, or separate system (e.g., two separate

ILS receivers).

Infrequent Occurring less often than 1 in 1000 events or 1000 flight hours.

Initial Missed Approach

(IMAWP)

Waypoint used to define the Missed Approach Point (MAP).

Initial Missed Approach

Segment

That segment of an approach from the Glide Path Intercept Waypoint

(GPIWP) to the Initial Missed Approach Waypoint (IMAWP).

Instantaneous Field of View The angular extent of a HUD display which can be seen from either eye from

a fixed position of the head.

Integrity A measure of the acceptability of a system, or system element, to contribute to

the required safety of an operation.

Landing For the purpose of this AC, landing will begin at 100 ft., the DH or the AH to

the first contact of the wheels with the runway.

Landing rollout For the purpose of this AC, rollout starts from the first contact of the wheels

with the runway and finishes when the airplane has slowed to a safe taxi speed

(in the order of 30 knots).

Major Failure Condition Failure Condition which would reduce the capability of the airplane or the

ability of the crew to cope with adverse operating conditions to the extent
AC 120-28D

07/13/99 Appendix 1

Page 7

that there would be, for example, a significant reduction in safety margins

or functional capabilities, a significant increase in crew workload or in

conditions impairing crew efficiency, or discomfort to occupants,

possibly including injuries.

Minimum Descent

Altitude(Height) [MDA(H)]

See individual definitions below for MDA and MDH.

Minimum Descent Altitude

(MDA)

A specified altitude in a non-precision approach or circling approach below

which descent must not be made without the required visual reference.

Minimum Descent Altitude (MDA) is referenced to mean sea level.

(ICAO - IS&RP Annex 6).

Minimum Descent Height

(MDH)

A specified height in a non-precision approach or circling approach below

which descent must not be made without the required visual reference.

Minimum Descent Height (MDH) is referenced to aerodrome elevation or to

the threshold if that is more than 7 ft. (2m) below the aerodrome elevation.

A MDH for a circling approach is referenced to the aerodrome elevation.

(ICAO - IS&RP Annex 6).

FAA Note - The United States does not use Minimum Descent Heights.

Minimum Use Height

(MUH)

A height specified during airworthiness demonstration or review above which,

under standard or specified conditions, a probable failures of a system is not

likely to cause a significant path displacement unacceptably reducing flight

path clearance from specified reference surfaces (e.g., airport elevation) or

specified obstacle clearance surfaces.

Minor Failure Condition Failure Condition which would not significantly reduce airplane safety and

which involve crew actions that are well within their capabilities. Minor

Failure Conditions may include, for example, a slight reduction in safety

margins or functional capabilities, a slight increase in crew workload, such as

routine flight plan changes, or some inconvenience to occupants.

Missed Approach The flight path followed by an aircraft after discontinuation of an approach

procedure and initiation of a go-around. Typically a “missed approach”

follows a published missed approach segment of an instrument approach

procedure, or follows radar vectors to a missed approach point, return to

landing, or diversion to an alternate.

Monitored HUD A HUD which has internal or external capability to reliably detect erroneous

sensor inputs or guidance outputs, to assure that a pilot does not receive

incorrect or misleading guidance, failure, or status information.

Non-Normal Means of

Navigation

A means of navigation which does not satisfy one or more of the necessary

levels of accuracy, integrity, and availability for a particular area, route,

procedure or operation, and which may require use of a pilot's "emergency

authority" to continue navigation.

NOTAM Notice to Airmen - A notice distributed by means of telecommunication

containing information concerning the establishment, condition or change in
AC 120-28D

Appendix 1 07/13/99

Page 8

any aeronautical facility, service, procedure or hazard, the timely knowledge

of which is essential to personnel concerned with flight operations. (ICAO -

IS&RP Annex 6).

Performance A measure of the accuracy with which an aircraft, a system, or an element of a

system operates compared against specified parameters. Performance

demonstration(s) typically include the component of Flight Technical Error (FTE).

Primary Means of Navigation A means of navigation which satisfies the necessary levels of accuracy and

integrity for a particular area, route, procedure or operation. The failure of a

"Primary Means" of navigation may result in, or require reversion to a "nonnormal" means of navigation, or an alternate level of RNP.

NOTE: Qualification as a "primary means" of navigation typically requires

that ANP/EPU be less than RNP for 99.99% of the time.

Redundant The presence of more than one independent means for accomplishing a given

function or flight operation. Each means need not necessarily be identical.

Rejected Landing A discontinued landing attempt. A rejected landing typically is initiated at

low altitude, but prior to touchdown. If from or following an instrument

approach it typically is considered to be initiated below DA(H) or MDA(H).

A rejected landing may be initiated in either VMC or IMC. A rejected

landing typically leads to or results in a "go around," and if following an

instrument approach, a "Missed Approach." If related to consideration of

aircraft configuration(s) or performance it is sometime referred to as a

"Balked Landing." The term "rejected landing is used to be consistent with

regulatory references such as found in FAR121 Appendix E, and policy

references as in FAA Order 8400.10.

Remote A probability of occurrence greater than 1 x 10-7 but less than or equal to

1 x 10-5 per hour of flight, or per event (e.g., takeoff, landing).

Required Navigation

Performance (RNP)

A statement of the navigation performance necessary for operation within a

defined airspace (Adapted from ICAO - IS&RP Annex 6).

NOTE: Required Navigation Performance is specified in terms of accuracy,

integrity, and availability of navigation signals and equipment for a particular

airspace, route, procedure or operation.

Required Navigation

Performance Containment

(RNP Containment)

RNP Containment represents a bound of the rare-normal performance and

specified non-normal performance of a system, typically expressed as 2*RNP(X).

When RNP represents Gaussian statistical performance at a level of two sigma (2

x standard deviation), then containment represents a nominal performance bound

specified at the level of four sigma (4 x standard deviation). Note: RNP

containment use may vary with intended operational applications.

Required Navigation

Performance Level or Type

(RNP Level or RNP Type)

A value typically expressed as a distance in nautical miles from the intended

position within which an aircraft would be for at least 95 percent of the total

flying time (Adapted from ICAO - IS&RP Annex 6).
AC 120-28D

07/13/99 Appendix 1

Page 9

NOTE: Applications of RNP to terminal area and other operations may also

include a vertical and/or longitudinal component. ICAO may use the term

RNP Type, while certain other States, aircraft manuals, procedures, and

operators may use the term RNP Level.

Example - RNP 4 represents a navigation lateral accuracy of plus or minus

4 nm (7.4 km) on a 95% basis. RNP is typically defined in terms of its lateral

accuracy, and has an associated lateral containment boundary.

Required Visual Reference That section of the visual aids or of the approach area which should have been

in view for sufficient time for the pilots to have made an assessment of the

aircraft's position and rate of change of position, in relation to the desired

flight path. In Category III operations with a decision height, the required

visual reference is that specified for the particular procedure and operations

(ICAO - IS&RP Annex 6 - Decision Height definition - Note 2).

Runway Datum Point (RDP) The RDP is used in conjunction with the FPAP and a vector normal to the

WGS-84 ellipsoid at the RDP to define the geodesic plane of a final approach

flight path to the runway for touchdown and rollout. It is a point at the

designated lateral center of the landing runway defined by latitude, longitude,

and ellipsoidal height. The RDP is typically a surveyed reference point used

to connect the approach flight path with the runway. The RDP may or may

not necessarily be coincident with the designated runway threshold

Runway Segment (RWS) That segment of an approach from the glidepath intercept reference point

(GIRP) to Flight Path Alignment Point (FPAP).

Situation Information Information that directly informs the pilot about the status of the aircraft

system operation or specific flight parameters including flight path.

Standard Landing Aid (SLA) In the context of this section of this AC, is a navigation service provided by a

State which meets internationally accepted performance standards (e.g., ICAO

Standards and Recommended Practices (SARP’s) or equivalent State standards).

Supplementary Means of

Navigation

A means of navigation which satisfies one or more of the necessary levels of

accuracy, integrity, or availability for a particular area, route, procedure or

operation. The failure of a "Supplementary Means" of navigation may result

in, or require reversion to another alternate "normal" means of navigation for

the intended route, procedure or operation.

NOTE: Qualification as a "supplementary means" of navigation typically

requires that ANP/EPU be less than RNP for 99% of the time.

Synthetic Reference Information provided to the crew by instrumentation or electronic displays.

May be either command or situation information.

Synthetic Vision System A system used to create a synthetic image representing the environment

external to the airplane.

Take off Guidance System A system which provides directional command guidance to the pilot during a

takeoff, or takeoff and aborted takeoff. It includes sensors, computers and

power supplies, indications and controls.
AC 120-28D

Appendix 1 07/13/99

Page 10

Total Field of View The maximum angular extent of the display that can be seen with either eye,

allowing head motion within the design eye box.

Touch Down Zone (TDZ) The first 3000 ft. of usable runway for landing, unless otherwise specified by

the FAA, or other applicable ICAO or State authority (e.g., for STOL aircraft,

or in accordance with an SFAR).

Visual Guidance Visual information the pilot derives from the observation of real world cues,

outside the cockpit and uses as the primary reference for aircraft control or

flight path assessment.
AC 120-28D

07/13/99 Appendix 1

Page 11

Acronyms.

ACRONYM EXPANSION

ABAS Aircraft Based Augmentation System

AC Advisory Circular

ACI Adjacent Channel Interface

ADF Automatic Direction Finder

ADI Attitude Director Indicator

ADS Automatic Dependent Surveillance

AFCS Autopilot Flight Control System

AFDS Autopilot Flight Director System

AFGS Automatic Flight Guidance System

AFM Airplane Flight Manual

AH Alert Height

AHI All-Weather Harmonization Items

AIP Aeronautical Information Publication

ALS Approach Light System

ANP Actual Navigation Performance

APIWP Approach Intercept Waypoint

APM Aircrew Program Manager

APU Auxiliary Power Unit

AQP Advanced Qualification Program

ARA Airborne Radar Approach

ASR Airport Surveillance Radar

ATC Air Traffic Control

ATIS Automatic Terminal Information Service

ATOGW Allowable Takeoff Gross Weight

ATPC Airline Transport Pilot Certificate

ATS Air Traffic Service

AWO All Weather Operations

BARO [Abbreviation for "Barometric"]

BC Back Course (e.g., ILS Back Course)

BITE Built-In Test Equipment

CAA Civil Aviation Authority

CDL Configuration Deviation List

CFR Code of Federal Regulations

CFR Crash Fire Rescue
AC 120-28D

Appendix 1 07/13/99

Page 12

CHDO Certificate Holding District Office

CMO [FAA] Certificate Management Office

CMU [FAA] Certificate Management Unit

CL Centerline Lights

CNS Communication, Navigation and Surveillance

CRM Collision Risk Model

CRM Cockpit Resource Management

CVR Cockpit Voice Recorder

DA Decision Altitude

DA(H) Decision Altitude(Height)

DCH Datum Crossing Height

DD DME-DME updating

DDM Difference of Depth Modulation

DEP Design Eye Position

DGNSS Differential Global Navigation Satellite System

DH Decision Height

DME Distance Measuring Equipment

DOD [U.S.] Department of Defense

DOT [U.S.] Department of Transportation

DP Departure Procedure

EADI Electronic Attitude Director Indicator

ECEF Earth Centered Earth Fixed

EFAS Extended Final Approach Segment

EGPWS Enhanced Ground Proximity Warning System

EHSI Electronic Horizontal Situation Indicator

EPE Estimated Position Error

EPU Estimated Position Uncertainty

EROPS Extended Range Operations (any number of engines)

ET Elapsed Time

ET Error Term [FMS use]

ETOPS Extended Range Operations with Two-Engine Airplanes

EVS Enhanced Vision System

FAF Final Approach Fix

FAP Final Approach Point

FAR Federal Aviation Regulation

FAS Final Approach Segment
AC 120-28D

07/13/99 Appendix 1

Page 13

FBS Fixed Base Simulator

FBW Fly-by-wire

FCOM Flight Crew Operating Manual

FDR Flight Data Recorder

FGS Flight Guidance System

FHA Functional Hazard Assessment

FLIR Forward Looking Infrared Sensor

FM Frequency Modulation

FM Fan Marker

FMC Flight Management Computer

FMS Flight Management System

FPAP Flight Path Alignment Point

FPA Flight Path Angle

FPCP Flight Path Control Point

FSB Flight Standardization Board

FSDO [FAA] Flight Standards District Office

FSS [FAA] Flight Service Station

FTE Flight Technical Error

GA Go-Around

GBAS Ground Based Augmentation System

GCA Ground Controlled Approach

GIRP Glidepath Intercept Reference Point

GLS GPS (or GNSS) Landing System

GNSS Global Navigation Satellite System

GPA Glide Path Angle

GPIWP Glide Path Intercept Waypoint

GPWS Ground Proximity Warning System

GPS Global Positioning System

HAA Height Above Airport

HAT Height above Touchdown

HDG Heading

HQRS Handling Quality Rating System (see AC 25-7A, as amended)

HUD Head Up Display

IAP Instrument Approach Procedure

IAW In Accordance With

ICAO International Civil Aviation Organization
AC 120-28D

Appendix 1 07/13/99

Page 14

IFR Instrument Flight Rules

IM Inner Marker

IMAS Initial Missed Approach Segment

IMAWP Initial Missed Approach Waypoint

IMC Instrument Meteorological Conditions

ILS Instrument Landing System

INAS International Airspace System

IOE Initial Operating Experience

IRS Inertial Reference System

IRU Inertial Reference Unit

JAA Joint Aviation Authority

JAR AWO Joint Aviation Regulations – All Weather Operations

KRM [Type of Landing system used in certain foreign States]

LAAS Local Area Augmentation System

LAD Local Area Differential

LAHSO Land And Hold Short Operation

LDA Localizer Descent Aid [approach type]

LLM Lower Landing Minima

LMM Compass Locator Middle Marker

LLTV Low Light Level TV

LNAV Lateral Navigation

LOC [ILS] Localizer

LOE Line operational evaluation

LOFT Line oriented flight training

LOM Compass Locator Outer Marker

LOS Line oriented simulation

MAP Mode Annunciator Panel

MAP Missed Approach Point

MASPS Minimum Aviation System Performance Standards

MB Marker Beacon

MCP Mode Control Panel

MDA Minimum Descent Altitude

MDA(H) Minimum Descent Altitude(Height)

MDH Minimum Descent Height - NOTE: MDH is not used for U.S. Operations

MEH Minimum Engage Height

MEL Minimum Equipment List
AC 120-28D

07/13/99 Appendix 1

Page 15

METAR ICAO Routine Aviation Weather Report

MLS Microwave Landing System

MM Middle Marker

MMEL Master Minimum Equipment List

MMR Multi-mode Receiver

MOT Ministry of Transport

MRB Maintenance Review Board

MSL Mean Sea Level [altitude reference datum]

MUH Minimum Use Height

MVA Minimum Vectoring Altitude

NA Not Authorized or Not Applicable

NAS National Airspace System

NAVAID Navigational Aid

ND Navigation Display

NDB Navigation Data Base

NDB Non-directional Beacon

NOTAM Notice to Airman

NRS National Resource Specialist

OCA Obstacle Clearance Altitude

OCH Obstacle Clearance Height

OCL Obstacle Clearance Limit

OIS Obstacle Identification Surface

OM Outer Marker

OSAP Offshore Standard Approach Procedure

PAI Principal Avionics Inspector

PAR Precision Approach Radar

PC/PT Proficiency Check/Proficiency Training

PF Pilot Flying

PFC Porous Friction Coarse [runway surface]

PIC Pilot in Command

PIREP Pilot Weather Report

PNF Pilot Not Flying

POC Proof of Concept

POI Principal Operations Inspector

PMI Principal Maintenance Inspector

PRD Progressive Re-Dispatch
AC 120-28D

Appendix 1 07/13/99

Page 16

PRM Precision Radar Monitor

PTS Practical Test Standard

QFE Altimeter Setting referenced to airport field elevation

QNE Altimeter Setting referenced to standard pressure (1013.2HPa or 29.92")

QNH Altimeter Setting referenced to airport ambient local pressure

QRH Quick Reference Handbook

RA Radio Altitude or Radar Altimeter

RAIL Runway Alignment Indicator Light System

RCLM Runway Center Line Markings

RDMI Radio Direction Magnetic Indicator

RDP Runway Datum Point

REIL Runway End Identification Lights

RII Required Inspection Item

RMI Radio Magnetic Indicator

RMS Root-mean-square

RNAV Area Navigation

RNP Required Navigation Performance

RNPx2 RNP Containment Limit (2 times RNP value)

RTCA Radio Technical Commission for Aeronautics

RTS Return to Service

RTO Rejected Takeoff

RVR Runway Visual Range

RVV Runway Visibility Value

RWS Runway Segment

RWY Runway

SA Selective Availability

SARPS ICAO Standards and Recommended Practices

SBAS Space Based Augmentation System

SDF Simplified Directional Facility

SFL Sequence Flasher Lights

SIAP Standard Instrument Approach Procedure

SID Standard Instrument Departure

SLA Standard Landing Aid

SLF Supervised Line Flying

SMGC Surface Movement Guidance and Control

SMGCP Surface Movement Guidance and Control Plan
AC 120-28D

07/13/99 Appendix 1

Page 17

SMGCS Surface Movement Guidance and Control System

STAR Standard Terminal Arrival Route

STC Supplemental Type Certificate

STOL Short Takeoff and Landing

SRE [Type of Landing system used in certain foreign States]

SV Space Vehicle

TACAN Tactical Air Navigation system [NAVAID]

TAF Terminal Aviation Forecast

TC Type Certificate

TDZ Touchdown Zone

TERPS [U.S.] Standard for Terminal Instrument Procedures

TLS Target Level of Safety

TOGA Takeoff or Go-Around [FGS Mode]

TSE Total system error

ua micro amps

VASI Visual Approach Slope Indicator

VDP Visual Descent Point

VFR Visual Flight Rules

VHF Very High Frequency

VIS Visibility

VOR VHF Omni-directional Radio Range

VORTAC Co-located VOR and TACAN

VMC Visual Meteorological Conditions

VNAV Vertical Navigation

V1 Takeoff Decision Speed

Vef Engine Failure Speed

Vfailure Speed at which a failure occurs

Vlof Liftoff Speed

Vmcg Ground Minimum Control Speed

WAAS Wide area augmentation system

WAD Wide Area Differential

WAT Weight, Altitude and Temperature

WGS World Geological Survey

WGS-84 World Geological Survey - 1984

WP Waypoint

xLS [Generic term used to denote any one or more of the following

NAVAID’s: ILS, MLS, or GLS]

AC 120-28D

07/13/99 Appendix 2

Page 1

APPENDIX 2

AIRWORTHINESS APPROVAL OF AIRBORNE SYSTEMS USED DURING A

TAKEOFF IN LOW VISIBILITY WEATHER CONDITIONS

Mandatory terms used in this AC such as “shall” or “must” are used only in the sense of

ensuring applicability of these particular methods of compliance when the acceptable

means of compliance described herein is used. This AC does not change, add or delete

regulatory requirements or authorize deviations from regulatory requirements.

1. PURPOSE. This appendix contains criteria for the approval of aircraft equipment and installations used

during Takeoff in low visibility conditions (see section 4.2 Takeoff).

2. GENERAL. The type certification approval for the equipment, system installations and test methods should

be based upon a consideration of factors such as the intended function of the installed system, its accuracy,

reliability, and fail-safe features, as well as the operational concepts contained in the body of this AC. The

guidelines and procedures contained herein are considered to be acceptable methods of determining

airworthiness for a transport category airplane intended to conduct a takeoff in low visibility weather conditions.

The overall performance and safety of an operation should be assessed considering principle elements of the

system, including aircraft, crew and facilities.

3. INTRODUCTION. This appendix provides airworthiness criteria for airplane systems that are required by

section 4.2 Takeoff of this AC. These systems are required when visibility conditions, alone, may be

inadequate for safe takeoff operation. This Appendix does not address all possible combinations of systems

that might be proposed. This appendix provides criteria which represents an acceptable means of compliance

with performance, integrity and availability requirements for takeoff in low visibility conditions. Alternative

criteria may be proposed by an applicant.

Operations using non-ground based facilities, or evolving ground facilities (e.g., local or wide area augmented

GNSS), and the use of some new aircraft equipment require Proof of Concept testing to establish appropriate

Criteria for operational approval and system certification. The need for a Proof of Concept program is

identified with this AC by a [PoC] designator.

The airworthiness criteria contained in this appendix for the takeoff system provides the requirements to track

and maintain the runway centerline during a takeoff from brake release on the runway to liftoff and climb to

35 ft. AGL, and from brake release through deceleration to a stop for a rejected takeoff.

It is important to emphasize that the entire takeoff operation, through completion of the en route climb

configuration, (see section 25.111), is considered to be an intensive phase of flight from an airworthiness

perspective. The use of the takeoff system must not require exceptional skill, workload or pilot compensation.

The takeoff system must provide an appropriate transition from lateral takeoff guidance (i.e., at about 35 ft.

AGL) through transition to en route climb for a takeoff, and from brake release through deceleration to a stop

for a rejected takeoff. Requirements for the airborne portion of the takeoff (i.e., above 35 ft. AGL) are

provided in Appendix 9.

The takeoff system shall be shown to be satisfactory with and without the use of any outside visual references,

except that outside visual references will not be considered when assessing lateral tracking performance. The

airworthiness evaluation will also determine whether the combination of takeoff guidance and outside visual
AC 120-28D

Appendix 2 07/13/99

Page 2

references would unacceptably degrade task performance, or require exceptional workload and pilot

compensation, during normal operations and non-normal operations with system and airplane failure conditions.

For the purpose of the airworthiness demonstration, the operational concept for coping with the loss of takeoff

guidance is based upon availability of some other method for the flightcrew to safely continue or reject the

takeoff, if necessary.

Additional proof of concept demonstration may be appropriate for any operational concept that is not based

on the presence of adequate outside visual references to safely continue or reject the takeoff, following loss

of takeoff guidance. [PoC]

The minimum visibility required for safe operations will be specified by FAA Flight Standards in the

operational authorization.

The intended takeoff path is along the axis of the runway centerline. This path must be established as a

reference for takeoff in restricted visibility conditions. A means must be provided to track the reference path

for the length of the runway in order to accommodate both a normal takeoff and a rejected takeoff.

The intended lateral path may be established in a number of ways. For systems addressed by this appendix,

the required lateral path may be established by a navigation aid (e.g., ILS, MLS). Other methods may be

acceptable if shown to be feasible by a PoC. Methods requiring PoC include, but are not limited to:

• the use of ground surveyed waypoints, either stored in an on-board data base or provided by data

link to the airplane, with path definition by the airborne system,

• the use of inertial information following initial alignment,

• sensing of the runway surface, lighting and/or markings with a vision enhancement system

(Indications of the airplane position with respect to the intended lateral path can be provided to the

pilot in a number of ways.),

• deviation displays with reference to navigation source (e.g., ILS receiver, MLS receiver),

• on-board navigation system computations with corresponding displays of position and reference path, or

• by a vision enhancement system.

In addition to indications of the airplane position, the takeoff system should also compute and display

command information (i.e., flight director), as lateral guidance, to the pilot, accounting for a number of

parameters including airplane position, deviation from the reference path, and deviation rate. Takeoff system

designs which provide only situational information, in lieu of command information, might be found

acceptable, but would require a Proof of Concept demonstration. [PoC]

On-board navigation systems used for takeoff may have a number of possible navigation aid sensor elements by

which to determine the position of an airplane including ILS, MLS, Global Navigation Satellite System (GNSS),

Local Area Differential GNSS, Pseudolites, or inertial information, etc. Each of these elements has limitations

with regard to accuracy, integrity and availability and should be used within their appropriate capability.

New Takeoff System designs may be developed which employ various combinations of aircraft systems,

sensors and system architecture, and use ground and space based navigation sources. Such new systems may

be approved if suitably demonstrated. [PoC]
AC 120-28D

07/13/99 Appendix 2

Page 3

4. TYPES OF TAKEOFF OPERATIONS. The operational concept and intended function of a takeoff

system are important factors for its airworthiness approval. Section 4.2 Takeoff of the AC describes a variety

of low visibility concepts and intended functions for takeoff systems which vary according to the degree of

reliance on the system to accomplish the takeoff, climb, and as necessary, the aborted takeoff.

Takeoff under low visibility conditions may be conducted as follows:

1) Based on authorizations in standard OpSpecs to visibility values not requiring takeoff guidance, or

2) Based on authorizations requiring takeoff guidance.

The airworthiness criteria for takeoff systems are based on item 2) above. These systems should provide the

required performance of the intended function, with acceptable levels of workload and pilot compensation to

achieve the required level of safety.

5. TYPES OF TAKEOFF SERVICES. There are a number of navigation aids which may support aircraft

systems in providing guidance to the flightcrew during takeoff in low visibility conditions. The required flight

path is inherent in the design of some systems (e.g., ILS and MLS) but some systems require the flight path to

be defined either in the airplane or provided to the airplane by datalink.

The accuracy, integrity and continuity of service of these external facilities, when used to support the takeoff

system, will affect the overall safety of the operation (see Section 4.3.10). Criteria for ILS and MLS navigation

aids for takeoff systems are the same as for landing systems.

5.1. ILS. The ILS is supported by established international standards for ground station operation

(ICAO Annex 10, or State equivalent). Ground facility provisions are stated in Section 8.1 of this AC. These

standards should be considered when demonstrating aircraft system operation.

5.2. MLS. The MLS is supported by established international standards for ground station operation

(ICAO Annex 10, or State equivalent). Ground facility provisions are stated in Section 8.2 of this AC. These

standards should be considered when demonstrating aircraft system operation.

5.3. GLS/GNSS [PoC]. This appendix section is not intended to provide a comprehensive acceptable means

of compliance for airworthiness approval of GLS or GNSS based systems, but it does address key issues

pertinent to any applicant who may seek early approval of a GLS (or GNSS based) system. Currently approved

systems are ILS or MLS based. The application of new technologies and systems such as GLS requires an

overall assessment of the integration of the airplane components with other navigation and related elements

(e.g., new ground based elements, satellite elements) to ensure that the overall safety of the use of the system is

acceptable. This GNSS section is also included to show the inherent differences between conventional

ILS/MLS based systems and GLS (or GNSS) based systems that affect criteria development.

The performance, integrity and availability of any ground station elements, any data links to the airplane, any

satellite elements and any data base considerations, when combined with the performance, integrity and

availability of the airplane system, should be at least equivalent to the overall performance, integrity and

availability provided by ILS to support low visibility operations.

5.3.1. GLS/GNSS Flight Path Definition. The required lateral path for the takeoff is key to the safety of the

operation. The required path has to be established to ensure that the airplane stays within the confines of the runway.

In a GLS/GNSS based Takeoff System, the required lateral path is established by data, rather than the physical

location of an RF signal in space. Earth referenced waypoints define the required path, which is coincident
AC 120-28D

Appendix 2 07/13/99

Page 4

with the runway centerline. The airplane navigation and flight guidance system will require that the

appropriate waypoints be provided either from an onboard database or via a datalink.

Certain "special waypoint" definitions, and other criteria are necessary to effectively implement takeoff

operations using satellite systems and other integrated multi-sensor navigation systems. See Section 4.6 of this

AC, Flight Path Definition, which shows the minimum set of "special waypoints" considered necessary to

conduct takeoff operations in air carrier operations.

The required path may be stored in an airplane database for recall and use by the takeoff guidance and/or

control system when required to conduct the operation.

The definition, resolution and maintenance of the waypoints which define the required path and flight segments

is key to the integrity of this type of takeoff operation.

A mechanism should be established to ensure the continued integrity of the waypoints.

The integrity of any data base used to define flight critical path waypoints for a Takeoff System should be

addressed as part of the certification process. The flightcrew should not be able to modify information in the

data base which relates to the definition of the required flight path.

5.3.2. GLS/GNSS Airplane Position Determination. The safety of a low visibility takeoff operation is, in

part, predicated on knowing where the airplane is positioned relative to the required path. Navigation satellite

systems exist which can provide position information to specified levels of accuracy, integrity and availability.

The accuracy, integrity and availability can be enhanced by additional space and ground based elements. These

systems provide certain levels of capability to support present low visibility operations and are planned to have

additional future capability.

Satellite systems have the potential to provide positioning information necessary to guide the airplane during

the takeoff operations. If operational credit is sought for these operations, the performance, integrity and

availability must be established to support that operation. Ground based aids such as differential position

receivers, pseudolites etc., and a data link to the airplane may be required to achieve the accuracy, integrity or

availability for certain types of operation.

An equivalent level of safety to current ILS based low visibility takeoff operations should be established.

The role of the satellite based elements in the takeoff system should be addressed as part of the airplane system

certification process until such time as an acceptable national, or international standards, for satellite based

systems are established.

Basic GNSS (Un-augmented).

This is the basic navigation service provided by a satellite system. No additional elements are used to enhance

accuracy or integrity of the operation.

Differential Augmentation.

If a ground based GNSS receiver is used to provide differential pseudo-range corrections, or other data to an

airplane to support low visibility operations, the overall integrity of that operation will have to be established.
AC 120-28D

07/13/99 Appendix 2

Page 5

The role of the differential station in the takeoff system will have to be addressed as part of the airplane system

certification process until such time as an acceptable national, or international standard, for the ground

reference system is established.

Local Area Differential Augmentation.

Local Area Differential (LAD) augmentation consists of a set of ground based GNSS receivers that are used to

derive pseudorange corrections and integrity data referenced to a point on or near the airport. This

augmentation data is then provided to the airplane via a local, ground based data broadcast signal.

5.4. Other.

5.4.1. Datalink. A data link may be used to provide data to the airplane to provide the accuracy necessary to

support certain operations (e.g., navigation way points, differential corrections for GNSS). The integrity,

availability and continuity of service of the data link should be commensurate with the operation.

The role of the data link in the takeoff system must be addressed as part of the airplane system certification

process until such time as an acceptable national, or international standard, for the ground system is established.

6. AIRWORTHINESS.

6.1. General Takeoff System. The following sections identify the performance and workload requirements

for the takeoff roll, through liftoff and for the rejected takeoff. These requirements apply for takeoff systems

that are intended for use in low visibility conditions below the floor for visual operations.

The airplane elements of the Takeoff System must be shown to meet the performance, integrity and reliability

requirements identified for the type(s) of operation for which approval is sought. The relationship and

interaction of the aircraft elements with non-aircraft elements must be established and understood.

The performance of the aircraft elements may be established with reference to an approved flight path

(e.g., localizer) provided the overall performance is not compromised by budgeting between aircraft and

non-aircraft elements.

When international standards exist for the performance and integrity aspects of any non-aircraft elements of the

Takeoff System, the applicant can assume these standards will be applied by member States of ICAO.

When international standards do not exist for the performance and integrity aspects of any non-aircraft

elements of the Takeoff System, the applicant must address these considerations as part of the airworthiness

process. A means must be provided to inform the operator of the limitations and assumptions necessary to

ensure a safe operation. It will be the responsibility of the operator and associated State regulatory authorities

to ensure that appropriate criteria and standards are applied.

6.1.1. Takeoff Performance Prior to 35 Ft. AGL. The takeoff system is intended to provide a means for the

pilot to track and maintain the runway centerline during a takeoff from brake release on the runway to liftoff to

35 ft. AGL, and during a rejected takeoff. Systems should ensure that a takeoff, or a rejected takeoff, can be

safely completed on the designated runway, runway with clearway or runway with stopway, as applicable.

The system performance must be satisfactory, even in "non-visual conditions," for normal operations, aircraft

failure cases (e.g., engine failure) and recovery from displacements from non-normal events. The system
AC 120-28D

Appendix 2 07/13/99

Page 6

should be easy to follow and not increase workload significantly compared to the basic airplane. Consideration

should not be given for performance improvements resulting from available visual cues.

The system should not require unusual skill, effort or excessive workload by the pilot to acquire and maintain

the desired takeoff path. The display should be easy to interpret in all situations. Cockpit integration issues

should be evaluated to ensure consistent operations and pilot response in all situations.

The continued takeoff or rejected takeoff operation should consider the effects of all reasonable events which

would lead a flightcrew to make a continued takeoff or a rejected takeoff decision.

The airplane must not deviate significantly from the runway centerline during takeoff while the takeoff system

is being used within the limitations established for it. The reference path of the system is usually defined by

the ILS localizer, or other approved approach navigation aid, which normally coincides with the runway

centerline. The performance of the system must account for differences, if any, between the runway centerline

and the intended lateral path. Compliance may be demonstrated by flight test, or by a combination of flight test

and simulation. Flight testing must cover those factors affecting the behavior of the airplane (e.g., wind

conditions, ILS characteristics, weight, center of gravity). Specific takeoff system demonstration requirements

are found in Section 7.1 of this appendix.

In the event that the airplane is displaced from the runway centerline at any point during the takeoff or rejected

takeoff, the system must provide sufficient lateral guidance to enable the "pilot flying" to control the airplane

smoothly back to the intended path in a controlled and predictable manner without significant overshoot or any

sustained nuisance or divergent oscillations. Minor overshoot or oscillations around the centerline are

permissible when not leading to unacceptable crew workload.

The performance envelope and conditions for evaluating takeoff systems for the following scenarios are

described in Section 5.1.3 of this AC (Figure 5.1.3-1) for at least the following conditions:

a) Takeoff with all engines operating

b) Engine Failure at Vef - continued takeoff*

c) Engine Failure just prior to V1 - rejected takeoff *

d) Engine Failure at a critical speed prior to Vmcg - rejected takeoff *

* Wind and runway conditions consistent with basic aircraft takeoff performance demonstrations.

Figure 5.1.3-1 should not be interpreted to mean that the airplane can begin the takeoff roll up to 7m from the

centerline. The pilot is expected to position and align the airplane on, or near, the runway centerline. While

the pilot is positioning and aligning the airplane on the runway, the takeoff guidance system should provide an

indication such that the flightcrew can confirm its proper operation.

For the rejected takeoff, the actual performance should reflect the effects of a dynamic engine failure, a short

term increase in lateral deviation, and then converge toward the centerline during the deceleration to a full stop.

6.1.1.1. ILS. The aircraft system response to permanent loss of the localizer signal shall be established, and

the loss of the localizer signal must be appropriately annunciated to the crew.

The aircraft system response during a switchover from an active localizer transmitter to a backup transmitter

shall be established (Reference ICAO Annex 10).
AC 120-28D

07/13/99 Appendix 2

Page 7

6.1.1.2. MLS. The aircraft system response to the loss of the MLS signal shall be established, and

appropriately annunciated to the crew.

The aircraft system response during a switchover from an active azimuth transmitter to a backup transmitter

shall be established (reference ICAO Annex 10).

6.1.2. Workload Criteria. The workload associated with the use of the takeoff system shall be Satisfactory

in accordance with the HQRS criteria of AC 25-7A, as amended, or equivalent. The takeoff system should

provide required tracking performance with Satisfactory workload and pilot compensation, under foreseeable

normal conditions. It may be assumed that the operational authorizations process will address any visual

cues needed for the required task performance with satisfactory workload and pilot compensation.

The system should not require unusual skill, effort or excessive workload by the pilot to acquire and

maintain the desired takeoff path. The display should be easy to interpret in all situations. Cockpit

integration issues should be evaluated to ensure consistent operations and pilot response in all situations.

6.2. Takeoff System Integrity. The takeoff system shall provide command information, as lateral

guidance, which, if followed by the pilot, will maintain the airplane on the runway during the takeoff roll

through acceleration to liftoff or, if necessary, during a deceleration to a stop during a rejected takeoff.

The onboard components of the low visibility takeoff system and associated components, considered separately

and in relation to other systems, should be designed to meet the requirements of Title 14 of the code of Federal

Regulations (14 CFR) part 25, section 25.1309, in addition to any specific safety related criteria identified in this

appendix. The elements not on the airplane should not reduce the overall safety of the operation to unacceptable

levels. The following criteria is provided for the application of section 25.1309 to Takeoff Systems:

The system design should not possess characteristics, in normal operation or when failed, which would degrade

takeoff safety, or lead to a hazardous condition. Any single failure of the airplane which could disturb the

take-off path (e.g., engine failure, single electrical generator or bus failure, single IRU failure) must not cause

loss of guidance information or give incorrect guidance information.

To the maximum extent possible, failures that would result in the airplane violating the lateral confines of the

runway while on the ground should be detected by the takeoff system and promptly annunciated to the pilot.

If pitch and/or speed guidance is also provided, failures that would result in rotation at an unsafe speed, pitch

rate or pitch angle should be detected by the takeoff system and promptly annunciated to the pilot.

However, there may be failures, which result in misleading guidance, but cannot be annunciated. For these

failures, outside visual references or other available information, that the pilot is expected to monitor, would be

used by the pilot to detect the failures and mitigate their effects. These failures must be identified, and the

ability of the pilot to detect them and mitigate their effects must be verified by analysis, flight test or both.

Whenever the takeoff system does not provide valid guidance appropriate for the takeoff operation, it must be

clearly annunciated to the crew, and the guidance must be removed. The removal of guidance, alone, is not

adequate annunciation. The annunciation must be located to ensure rapid recognition, and must not distract the

pilot making the takeoff or significantly degrade the forward view.

The probability of the takeoff system generating misleading information that could lead to an unsafe condition

shall be Improbable when the flightcrew is alerted to the condition by suitable fault annunciation or by
AC 120-28D

Appendix 2 07/13/99

Page 8

information from other independent sources available within the pilot's primary field of view. For airworthiness,

the effectiveness of the fault annunciation or information from other independent sources must be demonstrated.

The probability of the takeoff system generating misleading information that would be unsafe to follow, must

be Extremely Improbable, if:

1. no means are available for the takeoff system to detect and annunciate the failure, and

2. no information is provided to the pilot to immediately detect the malfunction and take corrective action.

In the event of a probable failure (e.g., engine failure, electrical source failure) if the pilot follows the

takeoff display and disregards external visual reference, the airplane performance must meet the

requirements illustrated in figure 5.1.3-1.

In showing compliance with the performance and failure requirements, the probabilities of performance or

failure effects may not be factored by the proportion of takeoffs which are made in low visibility.

Loss of any single source of electrical power or transient condition on any single source of electrical

power should not cause loss of guidance to the pilot flying (PF), or loss of information that is required to

monitor the takeoff to the pilot not flying (PNF).

Takeoff systems that use navigation aids other than ILS and MLS require an overall assessment of the

integration of the airplane components with other elements (e.g., ground based aids, satellite systems) to

ensure that the overall safety of the use of these takeoff systems is acceptable [PoC].

6.3. Takeoff System Availability. When the Takeoff operation is predicated on the use of the Takeoff

system, the probability of a system loss should be Remote (10-5/flight hour).

6.4. Flight Deck Information, Annunciation and Alerting. This section identifies information,

annunciations, and alerting requirements for the takeoff system on the flight deck. The controls,

indicators, and alerts must be designed to minimize crew errors which could cause a hazard. Mode and

system malfunction indications must be presented in a manner compatible with the procedures and

assigned tasks of the flightcrew. The indications must be grouped in a logical and consistent manner and

be visible under all expected normal lighting conditions.

6.4.1. Flight Deck Information. System design or use should not degrade the flightcrews ability to otherwise

adequately monitor takeoff performance or stopping performance.

The system shall be demonstrated to have no display or failure characteristics that lead to degradation of

the crews ability to adequately monitor takeoff performance (e.g., acceleration, engine performance,

takeoff speed callouts, attitude, and airspeed), conduct the entire takeoff, and make an appropriate

transition to en route climb speed and configuration, for all normal, abnormal and emergency situations.

6.4.2. Annunciation. Prior to takeoff initiation and during takeoff, positive, continuous and

unambiguous indications of the following information about the takeoff system must be provided and

made readily evident to both pilots:

• system status
AC 120-28D

07/13/99 Appendix 2

Page 9

• modes of engagement and operation, as applicable

• guidance source

6.4.3. Alerting. The takeoff system must alert the flightcrew whenever the system suffers a failure or any

condition which prevents the system from meeting the takeoff system performance requirements (see 6.1.1

of this appendix).

Alerts shall be timely, unambiguous, readily evident to each crewmember, and compatible with the

alerting philosophy of the airplane. Annunciations must be located to ensure rapid recognition, and must

not distract the pilot making the takeoff or significantly degrade the forward view.

6.4.3.1. Warnings. Warnings shall be provided for conditions that require immediate pilot awareness and

action. Warnings are required for the following conditions:

a) Loss of takeoff guidance

b) Invalid takeoff guidance

c) Failures of the guidance system that require immediate pilot awareness and compensation

During takeoff, whenever the takeoff system does not provide valid guidance appropriate for the takeoff

operation, it must be clearly annunciated to the crew, and the guidance must be removed. The removal of

guidance, alone, is not adequate annunciation. The annunciation must be located to ensure rapid

recognition, and must not distract the pilot making the takeoff or significantly degrade the forward view.

6.4.3.2. Cautions. Cautions shall be provided for conditions that require immediate pilot awareness and

possible subsequent pilot action. These alerts need not generate a Master Caution light, which would be

contrary to the takeoff alert inhibit philosophy. Cautions should be carefully generated so as not to cause

flightcrew distraction during takeoff roll.

6.4.3.3. Advisories. Advisories shall be provided for conditions that require pilot awareness in a timely

manner. Advisories should not be generated after takeoff has commenced.

6.4.3.4. System Status. Status of takeoff guidance system shall be provided (e.g., status of BITE/self-test).

7. Takeoff System Evaluation.

An applicant shall provide a certification plan which provides a description of the airplane systems, the

basis for certification, the certification methods and compliance documentation. The certification plan

should also describe how any non-airplane elements of the Takeoff System relate to the operation of

airplane systems from a performance, integrity and availability perspective.

The certification plan shall identify the assumptions and considerations for the non-airplane elements of the

system, and describe how the performance, integrity and availability ‘requirements’ of these elements are met.

For ILS and MLS based system elements, satisfaction of these requirements can be predicated upon

compliance with either the ICAO SARP’s, equivalent state standard, or by reference to an acceptable

standard for performance of any navigation service.
AC 120-28D

Appendix 2 07/13/99

Page 10

For the use of systems other than ILS or MLS for ‘path in space’ guidance, the assumptions and

considerations for the non-airplane elements of the system may be different than applicable to ILS or

MLS. If different than ILS or MLS, the applicant shall address these differences and how they relate to

the airplane system certification plan.

As applicable, the plan for certification shall describe any new or novel system concepts or operational

philosophy to allow the regulatory authority to determine whether criteria and requirements in excess of

that contained in this appendix are necessary.

7.1. Performance Evaluation. For new systems and any significant changes to an existing system, the

performance of the airplane and its systems must typically be demonstrated by flight test. Flight testing

must include a sufficient number of normal and non-normal operations conducted in conditions which are

reasonably representative of actual expected conditions and must cover the range of parameters affecting

the behavior of the airplane (e.g., wind speed, ILS characteristics, airplane configurations, weight, center

of gravity, and non-normal events).

The performance evaluation must verify that the Takeoff System meets the centerline tracking performance

requirements and limits of section 6.1.1. of this appendix.

The system performance must be demonstrated in "non-visual conditions" for:

a) normal operations,

b) engine failure cases and,

c) recovery from displacements from non-normal events.

This performance shall be demonstrated to have a satisfactory level of workload and pilot compensation,

such as defined by the FAA Handling Quality Rating System (HQRS) found in AC 25-7A, as amended,

or equivalent.

The takeoff system shall be shown to be satisfactory with and without the use of any outside visual

references, except that outside visual references will not be considered in assessing lateral tracking

performance. The airworthiness evaluation will also determine whether the combination of takeoff

guidance and outside visual references would unacceptably degrade task performance, require excessive

pilot compensation or workload during normal and non-normal operations.

For the purpose of the airworthiness demonstration, the operational concept for coping with the loss of

takeoff guidance is based upon availability of some other method for the flightcrew to safely continue or

reject the takeoff. The airworthiness demonstration may include a loss of takeoff guidance.

The demonstration of system performance should comprise at least the following, (though more

demonstrations may be needed, depending on the airplane characteristics and system design, and any

difficulties encountered during testing):

• 20 normal, all-engine takeoffs.

• 10 completed takeoffs, with simulated engine failure at or after the appropriate Vef for the

minimum V1 for the airplane. All critical cases must be considered.

• 10 rejected takeoffs, some with simulated engine failure just prior to V1, and at least one run with

simulated engine failure at a critical speed less than Vmcg.
AC 120-28D

07/13/99 Appendix 2

Page 11

For modified systems, credit may be permitted for earlier demonstration(s), but testing up to that necessary

for a new system may be required if credit for similarity of design or performance is not appropriate.

Engine failures should be assessed with respect to workload and pilot compensation throughout the entire

takeoff phase. In cases where the dynamics of retarding the throttle to idle do not adequately simulate

the dynamics of an engine failure, the certifying authorities may require an actual engine shutdown for

these demonstrations.

Demonstrated winds, during normal all engine takeoff, should be at least the headwinds for which credit

is sought, and at least 150% of the cross winds and tailwinds for which credit is sought, but not less than

15 knots of headwind or crosswind.

The applicant shall demonstrate that operation of the takeoff system does not exhibit any guidance or control

characteristics during the operation which would cause the flightcrew to react in an inappropriate manner.

The system shall be demonstrated to have no display or failure characteristics that lead to degradation of

the crew’s ability to adequately monitor takeoff performance (e.g., acceleration, engine performance,

takeoff speed callouts), and conduct the entire takeoff, and make an appropriate transition to en route

climb speed and configuration, for all normal, abnormal and emergency situations.

The system must be evaluated and demonstrated to meet the integrity and failure annunciation

requirements of section 6.2, 6.4, and sub-sections of this appendix, as well as the pilot's ability to

immediately detect and mitigate non-annunciated failures, as described in section 6.2.

For takeoff systems that use an ILS localizer signal, the airplane system response to loss of the localizer

signal shall be demonstrated, and appropriately annunciated to the crew. The airplane system response

during a switchover from an active localizer transmitter to a backup transmitter shall be demonstrated

(Reference ICAO Annex 10).

For takeoff systems that use MLS, the airplane system response to the loss of the MLS signal shall be

demonstrated, and appropriately annunciated to the crew. The airplane system response during a

switchover from an active azimuth transmitter to a backup transmitter shall be demonstrated

(Reference ICAO Annex 10).

For the evaluation of takeoff systems, the set of subject pilots provided by the applicant should have

relevant variability of experience (e.g., experience with or without head-up- display (HUD), Captain or

First Officer (F/O) crew position experience as applicable, experience in type). Subject pilots must not

typically have special experience that invalidates the test (e.g., pilot's should not have special recent

training to cope with HUD failures, beyond what a line pilot would be expected to have for routine

operation). The set of pilots provided by the certifying authorities may have experience as specified by

the authority appropriate to the test(s) to be conducted. The experience noted above for authority subject

pilots or evaluation pilots may or may not be applicable or appropriate for the tests to be conducted.

Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.

7.2. Safety Assessment. In addition to any specific safety related criteria identified in this appendix, a

safety assessment of all airplane components of the takeoff system and associated components,

considered separately, shall be conducted in accordance with AC 25.1309 to meet the requirements of

section 25.1309.
AC 120-28D

Appendix 2 07/13/99

Page 12

In showing compliance with airplane system performance and failure requirements, the probabilities of

performance or failure effects may not be factored by the proportion of takeoffs which are made in low

visibility conditions.

The responses of the takeoff system to failures of navigation facilities must be considered, taking into

account ICAO and other pertinent State criteria for navigation facilities, (for more information see

Section 8 of this AC).

Documented conclusions of the safety analysis shall include:

a. A functional hazard assessment (FHA) conducted in accordance with section 25.1309 and a summary

of results from the fault tree analysis, demonstrated compliance, and probability requirements for

significant functional hazards.

b. Information regarding "alleviating flightcrew actions" that were considered in the safety analysis.

This information should list appropriate alleviating actions, if any, and should be consistent with the

validation conducted during testing. If alleviating actions are identified, the alleviating actions should be

described in a form suitable to aid in developing, as applicable:

1) Pertinent provisions of the airplane flight manual procedures section(s), or

2) Flight Crew Operating Manual (FCOM) provisions, or equivalent, or

3) Pilot qualification criteria (e.g., training requirements, FSB provisions), or

4) Any other reference material necessary for an operator or flightcrew to safely use the system.

c. Information to support preparation of any maintenance procedures necessary for safety, such as:

1) Certification maintenance requirements (CMR),

2) Periodic checks, or

3) Other checks, as necessary (e.g., return to service).

d. Information applicable to limitations, as necessary.

e. Identification of applicable systems, modes or equipment necessary for use of the takeoff system, to

aid in development of flight planning or dispatch criteria, or to aid in development of procedures or

checklists for pilot selection of takeoff mode or assessment of system status, prior to initiation of takeoff.

f. Information necessary for development of Non-normal procedures.

8. AIRBORNE SYSTEM.

8.1. General. All general takeoff system requirements are found in section 6.1 of this appendix.

8.2. Peripheral Vision Guidance Systems [PoC]. Peripheral vision systems have not been shown to

be suitable as primary means of takeoff guidance. Such systems may be used as a supplemental means of

takeoff guidance only if a suitable minimum visual segment is available. A Proof of Concept evaluation

program is necessary for Peripheral Vision Guidance systems intended for use as primary means of
AC 120-28D

07/13/99 Appendix 2

Page 13

takeoff guidance or as supplemental means with visual segments less than the minimum required for

un-aided operation.

8.3. Head Up Display Takeoff System. The following criteria is applicable to head up display takeoff

systems:

a) The workload associated with use of the HUD must be considered in showing compliance with

14 CFR part 25, section 25.1523.

b) The HUD installation and display presentation must not significantly obscure the pilot's outside view.

c) The entire takeoff operation, through completion of the en route climb configuration, (see section 25.111),

is considered to be an intensive phase of flight during which unnecessary pilot workload and compensation

should be avoided. Appropriate transition from lateral takeoff guidance (i.e., at about 35 ft. AGL) through

transition to en route climb for a takeoff, and from brake release through deceleration to a stop for an aborted

takeoff should be ensured. For the entire takeoff and for all normal, and non-normal situations, except loss of

the HUD itself, it must not be necessary for the "pilot flying (PF)" to make any immediate change of primary

display reference for continued safe flight.

d) Control of Takeoff Flight Path. For the entire takeoff path and for all normal and non-normal conditions,

except loss of the HUD itself, the HUD takeoff system must provide acceptable guidance and flight

information to enable the PF to complete the takeoff, or abort the takeoff, if required. Use of the HUD

takeoff system should not require excessive workload, exceptional skill, or excessive reference to other

cockpit displays.

e) The HUD shall provide information suitable for the PF to perform the intended operation. The current

mode of the HUD system itself, as well as the flight guidance/automatic flight control system, shall be clearly

annunciated in the HUD, unless they can be acceptably displayed elsewhere.

f) Systems which display only lateral deviation as a cue for centerline tracking have not been shown to

provide adequate information for the PF to determine the magnitude of the required directional

correction. Consequently, with such displays workload and pilot compensation are considered excessive.

A proposed system which displays situation information, in lieu of command information, requires a

successful proof of concept evaluation. [PoC]

g) If the system is designed as a single HUD configuration, then the HUD shall be installed for the Captain’s

(pilot in command) crew station.

h) Associated cockpit information must be provided to the pilot not flying (PNF) to monitor the PF

performance, and perform other assigned duties.

8.4. Satellite Based Systems [PoC]. Currently approved systems are ILS or MLS based. The

application of new technologies and systems such as GLS/GNSS requires an overall assessment of the

integration of the airplane components with other elements to ensure that the overall safety of the use of

these systems is acceptable.

The performance, integrity and availability of any ground station elements, any data links to the airplane,

any satellite elements and any data base considerations, when combined with the performance, integrity

and availability of the airplane system, should be at least equal to the overall performance, integrity and

availability provided by ILS to support equivalent low visibility operations.
AC 120-28D

Appendix 2 07/13/99

Page 14

The role of the satellite based elements in the takeoff system should be addressed as part of the airplane

system certification process until such time as an acceptable national, or international standard, for the

satellite based system is established.

8.4.1. Flight Path Definition. For Flight Path Definition considerations refer to Section 4.6 of the AC.

8.4.2. On Board Database. Unless there is a means to upload the path definition data via datalink, the

required lateral ground path should be stored in an on board database for recall and incorporation into the

guidance/control system when required to conduct the takeoff.

The definition, resolution and maintenance of the waypoints which define the required takeoff path

should be consistent with the takeoff operation. A mechanism should be established to ensure the

continued integrity of the takeoff path designators.

Corruption of the information contained in the on board data base used to define the reference flight path

is considered Hazardous. Failures which result in hazardous unannunciated changes to the on board data

base must be Extremely Remote.

The flightcrew should not be able to intentionally or inadvertently modify information in the on board

data base which relates to the definition of the required flight path.

The integrity of any on board data base used to define takeoff path waypoints for a Takeoff System

should be addressed as part of the certification process.

8.4.3. Datalink. Data may be sent to the airplane, via data link, so that the takeoff flight path can be

defined with the required accuracy. The required takeoff path may be stored in a ground station database

which is uplinked to an airplane, either on request or through continuous transmission. The airplane

guidance and control system may incorporate such information to conduct the takeoff.

The integrity of the data link should be commensurate with the integrity required for the operation. The

role of the data link in the takeoff system must be addressed as part of the airplane system certification

process unless acceptable FAA, or international standards, for the ground system are established. The

following items shall be addressed as part of the Takeoff System assessment:

a) Satellite systems used during takeoff must support the required performance, integrity and availability.

This should include the assessment of satellite vehicle failures and the effect of satellite vehicle geometry

on the required performance, integrity and availability.

b) The capability of the Takeoff System failure detection and annunciation mechanism to preclude an

undetected failure, or combination of failures which are not Extremely Remote, from producing a

hazardous condition. This assessment should include failure mode detection coverage and adequacy of

monitors and associated alarm times.

c) The effect of airplane maneuvers on the reception of signals necessary to maintain the necessary

performance, integrity and availability. Loss and re-acquisition of signals should be considered.

8.5. Enhanced Vision Systems [PoC]. Enhanced Vision Systems which penetrate visibility restrictions

to provide the flightcrew with an enhanced view of the scene outside the airplane (e.g., radar) may be

considered for airworthiness installation and demonstration. However, this Appendix does not

comprehensively address a means of compliance for airworthiness installation approval of such
AC 120-28D

07/13/99 Appendix 2

Page 15

Enhanced Vision Systems. Performance must be demonstrated to be acceptable to the FAA through

proof of concept testing, during which specific airworthiness and operational criteria may be developed.

Criteria for approval of the enhanced vision system must match its intended use. The fidelity, alignment

and real time response of the enhanced view must be shown to be appropriate for the intended

application. Enhanced Vision Systems also must not significantly degrade the pilot's normal view, when

visual reference is available.

9. Airplane Flight Manual. Upon satisfactory completion of an airworthiness assessment and test

program, the FAA-approved airplane flight manual or supplement, and any associated markings or

placards, if appropriate, should be issued or amended to address the following:

1) Relevant conditions or constraints applicable to takeoff system use regarding the airport or runway

conditions (e.g., elevation, ambient temperature, runway slope).

2) The criteria used for the demonstration of the system, acceptable normal and non-normal procedures

(including procedures for response to loss of guidance), the demonstrated configurations, and any

constraints or limitations necessary for safe operation.

3) The type of navigation aids used as a basis for demonstration. This should not be taken as a limitation

on the use of other facilities. The AFM may contain a statement regarding the type of facilities or

condition known to be unacceptable for use (e.g., For ILS or MLS) based systems, the AFM shall

indicate that operation is predicated upon the use of an ILS (or MLS) facility with performance and

integrity equivalent to, or better than, a United States Type II or Type III ILS, or equivalent ICAO Annex

10 Facility Performance Category III facility).

4) Applicable atmospheric conditions under which the system was demonstrated (e.g., demonstrated

headwind, crosswind, tailwind),

5) For a Takeoff system meeting provisions of Appendix 2, the AFM (Section 3, Normal Procedures)

should also contain the following statements:

"The airborne system has been demonstrated to meet the airworthiness requirements of AC 120-28D

Appendix 2 for Takeoff when the following equipment is installed and operative:

<list pertinent equipment>"

"This AFM provision does not constitute operational approval or credit for use of the takeoff system."

Examples of general AFM considerations and specific AFM provisions are provided in Appendix 6.

AC 120-28D

07/13/99 Appendix 3

Page 1

APPENDIX 3

AIRWORTHINESS APPROVAL FOR AIRBORNE SYSTEMS

USED TO LAND AND ROLLOUT IN LOW VISIBILITY CONDITIONS

Mandatory terms used in this AC such as “shall” or “must” are used only in the sense of

ensuring applicability of these particular methods of compliance when the acceptable

means of compliance described herein is used. This AC does not change, add or delete

regulatory requirements or authorize deviations from regulatory requirements.

1. PURPOSE. This appendix contains criteria for the approval of aircraft equipment and installations

used for Landing and Rollout in low visibility conditions.

2. GENERAL. The type certification approval for the equipment, system installations and test methods

should be based upon a consideration of factors such as the intended function of the installed system, its

accuracy, reliability, and fail-safe features, as well as the operational concepts contained in the body of

this AC. The guidelines and procedures contained herein are considered to be acceptable methods of

determining airworthiness for a transport category airplane intended to conduct a landing and rollout in

low visibility conditions.

In addition to the criteria found in this appendix, equipment and installation must also meet the criteria

contained in AC 120-29, as amended, an equivalent foreign standard acceptable to the Administrator, or

any other criteria acceptable to the Administrator.

The overall assurance of performance and safety of an operation can only be assessed when all elements

of the system are considered.

3. INTRODUCTION. This appendix addresses the final approach, landing and the rollout phase of

flight. Landing and Rollout Systems may combine various combinations of airplane sensors and system

architecture with various combinations of ground and space based elements. This appendix provides

criteria which represents an acceptable means of compliance with performance, integrity and availability

requirements for low visibility approach, landing and rollout systems to accomplish a landing and rollout

in low visibility conditions. Alternative criteria may be proposed by an applicant. With new emerging

technologies, there is a potential for many ways of conducting low visibility landings. This appendix does

not attempt to provide criteria for each potential combination of airborne and non-airborne elements.

Operations utilizing current ILS or MLS ground based facilities and airborne elements are in use, and the

certification criteria for approval of these airborne systems are established. Other operations, using nonground based facilities or evolving ground facilities (e.g., local or wide area augmented GNSS), and the

use of some new aircraft equipment require Proof of Concept testing to establish appropriate criteria for

operational approval and system certification. The need for a Proof of Concept program is identified in

this AC with a [PoC] designator. This appendix provides some general guidelines, but not

comprehensive criteria for airplane systems that require a Proof of Concept.

The low visibility landing system is intended to guide the airplane down the final approach segment to a

touch down in the prescribed touch down zone, with an appropriate sink rate and attitude without

exceeding prescribed load limits of the airplane. The rollout system is intended to guide the airplane to

converge on and track the runway centerline, from the point of touch down to a safe taxi speed.
AC 120-28D

Appendix 3 07/13/99

Page 2

The low visibility landing system shall be shown to be satisfactory with and without the use of any

outside visual references, except that outside visual references will not be considered when assessing

lateral tracking performance. The airworthiness evaluation will also determine whether the combination

of guidance and outside visual references would unacceptably degrade task performance, or require

exceptional workload and pilot compensation, during normal operations and non-normal operations with

system and airplane failure conditions.

For the purpose of the airworthiness demonstration, the operational concept for coping with the loss of

guidance is based upon the availability of some other method to accomplish a go-around, landing, or

rollout, if necessary. The airworthiness demonstration may include a loss of guidance.

The minimum visibility required for safe operations with such systems and backup means will be

specified by FAA Flight Standards in the operational authorization.

The intended flight path may be established in a number of ways. For systems addressed by this appendix,

the reference path may be established by a navigation aid (e.g., ILS, MLS). Other methods may be

acceptable if shown feasible by a Proof of Concept [PoC]. Methods requiring PoC include, but are not

limited to:

• the use of ground surveyed waypoints, either stored in an on-board data base or provided by data

link to the airplane, with path definition by the airborne system,

• sensing of the runway environment (e.g., surface, lighting and/or markings) with a vision

enhancement system.

On-board navigation systems may have various sensor elements by which to determine airplane position.

The sensor elements may include ILS, MLS, Inertial information, GLS, other Global Navigation Satellite

System (GNSS) elements, Local Area Differential GNSS, or GNSS related Pseudolites. Each of these sensor

elements should be used within appropriate limitations with regard to accuracy, integrity and availability.

Indications of the airplane position with respect to the intended lateral path can be provided to the pilot in

a number of ways.

• deviation displays with reference to navigation source (e.g., ILS receiver, MLS receiver), or

• on-board navigation system computations with corresponding displays of position and reference path

4. TYPES OF LANDING AND ROLLOUT OPERATIONS. The following types of Category III

operations typically may be considered:

(1) Fail-operational landing with fail-operational rollout

(2) Fail-operational landing with fail-passive rollout

(3) Fail-passive landing with fail-passive rollout

(4) Fail-passive landing without rollout system capability

(5) The following engine inoperative capabilities may optionally* be demonstrated, for each or any

of the cases listed above:
AC 120-28D

07/13/99 Appendix 3

Page 3

a) Landing with engine failure prior to initiation of the approach

b) Landing and rollout with engine failure after initiation of the approach, but prior to DA(H) or

AH, as applicable.

*NOTE: The case of engine failure after passing AH (or DA(H)) through touchdown, or

through touchdown and rollout as applicable, is typically addressed as a basic consideration

for any system demonstration intended for Category III.

The following definitions may be used for the operations described above.

Landing - for the purpose of this appendix, landing begins at 100 ft., the DH or the AH, to the first

contact of the wheels with the runway.

Rollout - for the purpose of this Appendix, rollout starts from the first contact of a wheel(s) with the

runway and finishes when the airplane has slowed to a safe taxi speed.

Safe Taxi Speed is the speed at which the pilot can safely taxi off the runway using typical exits, or bring

the airplane expeditiously to a safe stop. The safe taxi speed may vary with visibility conditions, airplane

characteristics, and means of lateral control.

5. TYPES OF LANDING AND ROLLOUT SERVICES.

5.1. ILS. The ILS is supported by established international standards for ground station operation.

These standards should be used in demonstrating airplane system operation.

The airplane system response during a switchover from an active localizer transmitter to a backup

transmitter shall be established. For procedures which do not use a localizer for missed approach, total

failure (shutdown) of the ILS ground station may not significantly adversely effect go-around capability.

The Airplane Flight Manual shall indicate that operation is predicated upon the use of an ILS facility

with performance and integrity equivalent to, or better than, an ICAO Annex 10 Facility Performance

Category III ILS, a United States Type II or Type III ILS, or equivalent.

5.1.1. ILS Flight Path Definition. The required lateral flight path is inherent in the design of the ILS.

Acceptable performance and integrity standards have been established for ILS (see section 8.1 of the AC).

5.1.2. ILS Airplane Position Determination. The airplane lateral position relative to the desired flight

path is accomplished by an airplane ILS receiver which provides deviation from the extended runway

centerline path when in the coverage area.

5.2. MLS. The MLS is supported by established ICAO Annex 10 international standards for ground

station operation. These standards should be used in demonstrating airplane system operation.

The airplane system response during a switchover from an active azimuth transmitter to a backup transmitter

shall be established. Total failure (shutdown) of the MLS ground station may not significantly adversely

affect go-around capability.
AC 120-28D

Appendix 3 07/13/99

Page 4

The Airplane Flight Manual shall indicate that operation is predicated upon the use of an MLS facility

with performance and integrity equivalent to, or better than, an ICAO Annex 10 Facility Performance

Category III MLS, or equivalent.

5.2.1. MLS Flight Path Definition. The lateral required flight path is inherent in the design of the MLS.

Acceptable performance and integrity standards have been established for MLS (see section 8.1 of the AC).

5.2.2. MLS Airplane Position Determination. The airplane lateral position relative to the desired

flight path is accomplished by an airplane MLS receiver which provides deviation from the extended

runway centerline path when in the coverage area.

5.3. GLS/GNSS [PoC]. This appendix section is not intended to provide a comprehensive acceptable

means of compliance for airworthiness approval of GLS or GNSS based systems, but it does address key

issues pertinent to any applicant who may seek early approval of a GLS (or GNSS based) system. Currently

approved systems are ILS or MLS based. The application of new technologies and systems requires an

overall assessment of the integration of the airplane components with other elements (e.g., new ground

based aids, satellite elements) to ensure that the overall safety of the use of these systems for Category III.

This GLS/GNSS section is also included to identify important differences between conventional ILS/MLS

based systems and GLS/GNSS based systems that may affect GNSS or GLS criteria development.

The performance, integrity and availability of any ground station elements, any data links to the airplane,

any satellite elements and any data base considerations, when combined with the performance, integrity

and availability of the airplane system, should be at least equivalent to the overall performance, integrity

and availability provided by ILS to support Category III operations.

5.3.1. GLS/GNSS Flight Path Definition. Appropriate identification of the required flight path for the

landing and rollout is necessary to ensure safety of the operation. The required flight path should be

established to provide adequate clearance between the airplane and fixed obstacles on the ground, between

airplane on adjacent approaches, and to ensure that the airplane stays within the confines of the runway.

The effect of the navigation reference point on the airplane on flight path and wheel to threshold crossing

height must be addressed.

In a GNSS based Landing and Rollout System, the required lateral path is established by data, rather than

the physical location of an RF signal in space. Earth referenced waypoints define the required path,

which is coincident with the runway centerline. The airplane navigation and flight guidance system will

require that the appropriate waypoints be provided either from an onboard database or via a datalink.

Certain "special waypoint" definitions, "leg types," and other criteria are necessary to safely implement

landing and rollout operations using satellite systems and other integrated multi-sensor navigation

systems. Figure 4.6-1 of the AC shows the minimum set of "special waypoints" and "special leg types"

considered necessary to conduct landing and rollout operations in air carrier operations.

The required flight path may be stored in an airplane database for recall and use by the command

guidance and/or control system when required to conduct the landing and rollout.

The definition, resolution and maintenance of the waypoints which define the required flight path and

flight segments is key to the integrity of this type of landing and rollout operation.

A mechanism should be established to ensure the continued integrity of the flight path designators.
AC 120-28D

07/13/99 Appendix 3

Page 5

The integrity of any data base used to define flight critical path waypoints for a Landing and Rollout

System should be addressed as part of the certification process. The flightcrew shall not be able to

modify information in the data base which relates to the definition of the required flight path for the

critical portion of final approach through rollout.

5.3.2. GLS/GNSS Airplane Position Determination.

The safety of a low visibility landing and rollout operation is, in part, predicated on knowing where the

airplane is positioned relative to the required flight path. Navigation satellite systems exist which can

provide position information to specified levels of accuracy, integrity and availability. The accuracy,

integrity and availability can be enhanced by additional space and ground based elements. These systems

provide certain levels of capability to support present low visibility operations and are planned to have

additional future capability.

Satellite systems have the potential to provide positioning information necessary to guide the airplane

during landing and rollout. If operational credit is sought for these operations, the performance, integrity

and availability must be established to support that operation. Ground based aids such as differential

position receivers, pseudolites etc., and a data link to the airplane, may be required to achieve the

accuracy, integrity or availability for certain types of operation.

An equivalent level of safety to current ILS based Category III operations should be established.

The role of the satellite based elements in the landing system should be addressed as part of the airplane

system certification process until such time as an acceptable national, or international standards, for

satellite based systems are established.

Basic GNSS (Unaugmented). This is the basic navigation service provided by a satellite system. No

additional elements are used to enhance accuracy or integrity of the operation.

Differential Augmentation. The role of the differential station in the landing system should be addressed

as part of the airplane system certification process, unless an acceptable national, or international

standard, for the ground reference system is established.

Local Area Differential Augmentation. Local Area Differential (LAD) augmentation consists of a set of

ground based GNSS receivers that are used to derive pseudo-range corrections and integrity data

referenced to a point on or near the airport. This augmentation data is then provided to the airplane via a

local, ground based data broadcast signal.

Wide Area Differential Augmentation. Wide Area Differential (WAD) augmentation is not applicable to

Category III, except where used in conjunction with other sensors (e.g., to substitute for DME with ILS).

Typically only LAD systems provide a basis for establishing the necessary position fixing accuracy,

integrity and availability for the final portion of a final approach segment or rollout. Unaugmented

GNSS or WAD are typically only suited for support of initial or intermediate segments of an approach,

final approach to restricted DA(H)s, or missed approach. GNSS or WAD may however be used in

conjunction with Category III procedures for applications such as equivalent DME distance, or marker

beacon position determination, when authorized by the operating rules.
AC 120-28D

Appendix 3 07/13/99

Page 6

5.3.3. Datalink. A data link may be used to provide data to the airplane to provide the accuracy

necessary to support certain operations (e.g., navigation way points, differential corrections for GNSS).

The integrity of the data link should be commensurate with the integrity required for the operation.

The role of the data link in the landing system will have to be addressed as part of the airplane system

certification process until such time as an acceptable U.S., or international standards for data link ground

systems are established.

6. AIRWORTHINESS. This section identifies airworthiness requirements including those for

performance, integrity, and availability which apply to all types of airplane systems, independent of the

type of landing/navigation system used. The definitions of Performance, Integrity and Availability are

found in Appendix 1.

The basic airworthiness criteria are intended to be independent of the specific implementation in the airplane

or the type of Landing and Rollout system being used. Requirements for touch down performance, landing

sink rates and attitudes, etc. (see section 6.3.1. below) are the same for landing systems with automatic flight

control, and systems for manual flight control with command information (i.e., flight director) as guidance.

Criteria may be expanded further in later sections of this appendix as it applies to a particular airplane

system or architecture.

The types of landing or landing and rollout systems which may be approved are listed in Appendix 3

section 4.

6.1. General. An applicant shall provide a certification plan which describes how any non-aircraft

elements of the Landing and Rollout System relate to the aircraft system from a performance, integrity and

availability perspective.

The plan for certification shall describe the system concepts and operational philosophy to allow the

regulatory authority to determine whether criteria and requirements other than those contained in this

appendix are necessary.

The applicant shall apply criteria contained in AC 120-29, as amended, an equivalent foreign standard

acceptable to the Administrator, or any other criteria acceptable to the Administrator for the system

during approach to at least 100 ft. HAT.

The safety level for automatic landing and rollout, or manual landing and rollout using command

information as guidance, may not be less than that achieved by a conventional unguided manual landing

using visual reference. In showing compliance with the performance and failure requirements, the

probabilities of performance or failure effects may not be factored by the proportion of landings made

with the landing and rollout system.

The landing and rollout system performance should be established considering the environmental and

deterministic effects which may reasonably be experienced for the type of operation for which

certification and operational approval will be sought.

Command information provided as guidance during the landing and rollout should be consistent with a

pilot’s manual technique and not require excessive skill or crew workload to accomplish the operation.
AC 120-28D

07/13/99 Appendix 3

Page 7

For those segments of the flight path where credit is taken for non-automatic systems, acceptable

performance of those systems for landing and rollout shall be shown by reference to instruments alone

without requiring the use of external visual reference. This requirement is appropriate because the

landing rollout may begin off centerline and at higher speed.

Where reliance is placed on the pilot to detect a failure of engagement of a mode when it is selected, and

the pilot cannot reliably detect this failure by other means, an appropriate indication or warning must be

given.

The transition from automatic control to manual control may not require exceptional piloting skill, alertness or

strength.

In the absence of failure or extreme conditions, the behavior of the landing system, and the resulting airplane

flight path, shall not be so unusual as to cause a pilot to inappropriately intervene and assume control.

The effect of the failures of the navigation facilities must be considered taking into account ICAO and

other pertinent State criteria.

6.2. Approach Systems. The applicant shall establish acceptable approach performance to the criteria

contained in AC 120-29, as amended, an equivalent foreign standard acceptable to the Administrator, or

any other criteria acceptable to the Administrator.

6.3. Landing and Rollout System Performance. The stable approach (i.e., “normal maneuvering”

without excessive attitudes, sink rates, path deviations or speed deviations) should be conducted to the

point where a smooth transition is made to the landing.

If the landing system is designed to perform an alignment function prior to touch down, to correct for

crosswind effects, it should operate in a manner consistent with a pilot's manual technique for crosswind

landings for the aircraft type, typically using the wing low side slip procedure. Non-availability of the

alignment mode, or failure of the alignment mode to perform its intended function must be easily

detectable, or be suitably annunciated, so that the flightcrew can take appropriate action.

The landing system "landing flare to touch down" maneuver should reduce the airplane sink rate to a

value and in a manner that is compatible with a normal flightcrew landing maneuver.

The automatic flight control system should provide de-rotation, consistent with a pilot’s manual technique.

Systems which provide rollout guidance for manually controlled rollout are not required to provide derotation. Systems which provide de-rotation, automatically or with guidance for manual control, must

avoid any objectionable oscillatory motion or nose wheel touch downs, pitch up or other adverse behavior

as a result of ground spoiler deployment or reverse thrust operation.

Automatic control during the landing and rollout should not result in any airplane maneuvers which would

cause the flightcrew to intervene unnecessarily.

Guidance provided during the landing and rollout should be consistent with a pilot’s manual technique,

and not require excessive skill or crew workload to accomplish the operation.

6.3.1. Landing System Performance. All types of low visibility landings systems, including automatic

flight control, guidance for manual control, and hybrid, shall be demonstrated to achieve the performance
AC 120-28D

Appendix 3 07/13/99

Page 8

accuracy with the probabilities prescribed in this section. The performance values may vary where

justified by the characteristics of the airplane.

The performance criteria and probabilities are as follows:

(a) Longitudinal touch down earlier than a point on the runway 200 ft. (60m) from the threshold to a

probability of 1 x 10-6;

(b) Longitudinal touch down beyond 2700 ft.(823m) from threshold to a probability of 1 x 10-6;

(c) Lateral touch down with the outboard landing gear more than 70 ft. (21.3m) from runway centerline

to a probability of 1 x 10-6.

(d) Structural limit load, to a probability of 1 x 10-6. An acceptable means of establishing that the

structural limit load is not exceeded is to show separately and independently that:

(i) The limit load that results from a sink rate at touch down not greater than 10 f.p.s. or the limit

rate of descent used for certification under 14 CFR part 25 subpart C (see section 25.473), whichever is

the greater.

(ii) The lateral side load does not exceed the limit value determined for the lateral drift landing

condition defined in part 25, section 25.479(d)(2).

(e) Bank angle resulting in hazard to the airplane to a probability of 1 x 10-7. A hazard to the

airplane is interpreted to mean a bank angle resulting in any part of the wing, high lift device, or engine

nacelle touching the ground.

6.3.2. Speed Control Performance. Airspeed must be controllable to within +/- five knots of the

approach speed*, except for momentary gusts, up to the point where the throttles are retarded to idle for

landing. For operations flown with manual control of approach speed, the flightcrew must be able to

control speed to within +/- five knots of the approach speed.

*NOTE: This criteria is not specific to low visibility systems, but must be met by low visibility systems.

6.3.3. Rollout System Performance.

The rollout system, if included, should control the airplane, in the case of an automatic flight control system,

or provide command information as guidance to the pilot, for manual control, from the point of landing to a

safe taxi speed. The loss of rudder effectiveness, as the airplane speed is reduced, could be a factor in the

level of approval which is granted to a system. The applicant should describe the system concept for rollout

control so that the absence of low speed control, such as a nose wheel steering system, can be assessed.

Safe Taxi Speed is the speed at which the pilot can safely leave the runway or bring the airplane to a safe

stop. The safe taxi speed may vary with visibility conditions, airplane characteristics, and means of

lateral control. The performance criteria in this section assume a 150 ft. (45.7m) runway width. The

rollout performance limit may be appropriately increased if operation is limited to wider runways.
AC 120-28D

07/13/99 Appendix 3

Page 9

The rollout system performance is referenced to the centerline of the runway. The intended path for the

rollout system is usually defined by an ILS localizer, or other approved approach navigation system,

which normally coincides with the runway centerline.

The rollout system should be demonstrated to:

(a) Not cause the outboard tire(s) to deviate from the runway centerline by more than 70 ft. (21.3m)*,

starting from the point at which touch down occurs and continuing to a point at which a safe taxi speed is

reached, to a probability of 1 x 10-6.

(b) Capture the intended path or converge on the intended path (e.g., localizer centerline) in a smooth,

timely and predictable manner. While a critically damped response is desired, minor overshoots are

considered acceptable. Sustained or divergent oscillations or unnecessarily aggressive responses are

unsatisfactory.

(c) Promptly correct any lateral movement away from the runway centerline in a positive manner.

(d) Following touchdown, if not already on a converging path, cause the airplane to initially turn and

track a path to intercept the runway centerline at a point far enough in front of the airplane that it is obvious

to the flightcrew that the rollout system is performing properly. Also, the rollout system should intercept

the centerline sufficiently before the stop end of the runway, and before the point at which taxi speed is

reached.

*NOTE: 70 ft.(21.3m) deviation from centerline is equivalent to outboard tire(s) at 5 ft. (1.5m)

within the edge of a 150 ft. (45.7m) wide runway.

6.3.4. Variables Affecting Performance. This section identifies the variables to be considered when

establishing landing and rollout performance.

The performance assessment shall take into account at least the following variables with the variables

being applied based upon their expected distribution:

(a) Configurations of the airplane (e.g., flap/slat settings);

(b) Center of gravity;

(c) Landing gross weight;

(d) Conditions of headwind, tailwind, crosswind, turbulence and wind shear (see Appendix 4 for

acceptable wind models);

(e) Characteristics of applicable navigation systems and aid, variations in flight path definitions

(ILS, MLS, GLS - ground, airplane and space elements etc.)

(f) Approach airspeed and variations in approach airspeed.

(g) Airport conditions (elevation, runway slope, runway condition).

(h) Individual pilot performance, for systems with manual control.

(i) Any other parameter which may affect system performance.
AC 120-28D

Appendix 3 07/13/99

Page 10

6.3.5. Irregular Approach Terrain. Approach terrain may affect the performance and pilot acceptance

of the Approach and Landing system.

The information on the nominal characteristics of an airport is contained in ICAO Annex 14. This

information can be used to characterize the airport environment for nominal performance assessment.

However, the system shall be evaluated to determine the performance characteristics in the presence of

significant approach terrain variations. At a minimum the following profiles should be examined:

a. Sloping runway - slopes of 0.8%.

b. Hilltop runway - 12.5% slope up to a point 60m prior to the threshold; or

c. Sea-wall - 6m (20 ft.) step up to threshold elevation at a point 60m prior to the threshold.

NOTE: In addition to the profiles described above, examination of the profiles of

known airports with significant irregular approach terrain, at which operations are

intended, is recommended (see section 5.18 of the AC).

6.3.6. Approach and Automatic Landing with an Inoperative Engine. For demonstration of engine

inoperative capabilities, where the approach is initiated, and the landing made, with an inoperative

engine, the landing system must be shown to perform a safe landing and, where applicable, safe rollout in

this non-normal aircraft condition taking account the factors described in 5.17 and the following:

a. Failure of the critical engine, and for propeller, where applicable, accounting for feathering of the

propeller following failure of the critical engine;

b. Appropriate landing flap configurations;

c. Loss of any systems associated with the inoperative engine, e.g., electrical and hydraulic power;

d. Crosswinds in each direction of at least 10 knots;

e. Weight of aircraft.

Whether or not engine out landing approval is sought, the go-around from any point on the approach to touch

down must not require exceptional piloting skill, alertness or strength and must ensure that sufficient

information is available to determine that the airplane can remain clear of obstacles (see section 6.3.7 below).

6.3.7. Inoperative Engine Information. Information for an operator to assure a successful go-around

with an inoperative engine should be provided. The information may be in a form as requested by the

operator, or as determined appropriate by the manufacturer. The information may or may not be provided

to the operator as part of the AFM. Examples of acceptable information would include the following:

a. Information on height loss as a function of go-around initiation altitude, and

b. Performance information allowing the operator to determine that safe obstacle clearance can be

maintained during a go around with an engine failure, or

c. A method to assess and extend applicability of engine inoperative takeoff performance obstacle

clearance determinations for a balked landing or go-around event.
AC 120-28D

07/13/99 Appendix 3

Page 11

6.4. Landing and Rollout System Integrity. The applicant shall provide the certification authority

with an overall operational safety assessment plan for the use of systems other than ILS or MLS for "path

in space" guidance. This plan shall identify the assumptions and considerations for the non-aircraft

elements of the system and how these assumptions and considerations relate to the airplane system

certification plan.

The effect of the navigation reference point on the airplane on flight path and wheel to threshold crossing

height shall be assessed.

6.4.1. Landing System Integrity. The onboard components of the landing system, considered separately

and in relation to other associated onboard systems, should be designed to meet the requirements of

section 25.1309, in addition to any specific safety related criteria identified in this appendix.

The following criteria is provided for the application of FAR § 25.1309 to Landing Systems:

Any single malfunction or any combination of malfunctions of the landing system that could prevent a

safe landing or go around must be Extremely Improbable, unless it can be detected and annunciated, as a

warning to allow pilot intervention to avoid catastrophic results, and shown to be Extremely Remote.

Failure to detect and annunciate malfunctions that could prevent a safe landing or go around must be

Extremely Improbable.

The exposure time for assessing failure probabilities for Fail Passive landing systems is the average time

required to descend from 100 feet HAT or higher to touchdown, and for Fail Operational landing systems

the average time to descend from 200 feet HAT or higher to touchdown.

For a Fail Passive automatic landing system, a single malfunction or any combination of malfunctions

must not cause a significant deviation of the flight path or attitude (e.g., hardover) following a system

disengagement. The airplane must be safely trimmed, when the system disengages, to prevent these

significant deviations.

A Fail Operational automatic landing system, following a single malfunction, must not lose the capability

to perform lateral and vertical path tracking, alignment with runway heading (e.g., decrab), flare and

touchdown within the safe landing requirements listed below.

Malfunction cases may be considered under nominal environmental conditions.

For the purpose of analysis, a safe landing may be assumed if the following requirements are achieved:

(a) Longitudinal touch down no earlier than a point on the runway 200 ft. (60m) from the threshold,

(b) Longitudinal touch down no further than 3000 ft. (1000m) from the threshold e.g., not beyond

the end of the touch down zone lighting,

(c) Lateral touch down with the outboard landing gear within 70 ft. (21m) from runway centerline.

(These values assume a 150 ft. (45m) runway. The lateral touch down performance limit may be

appropriately increased if operation is limited to wider runways),

(d) Structural limit load. An acceptable means of establishing that the structural limit load is not

exceeded is to show separately and independently that:
AC 120-28D

Appendix 3 07/13/99

Page 12

(i) The limit load that results from a sink rate at touch down not greater than 10 f.p.s. or the limit

rate of descent used for certification under part 25 Subpart C (see section 25.473), whichever is the greater.

(ii) The lateral side load does not exceed the limit value determined for the lateral drift landing

condition defined in section 25.479(d)(2).

(e) Bank angle resulting in hazard to the airplane such that any part of the wing or engine nacelle

touches the ground.

6.4.2. Rollout System Integrity. The rollout system, if provided shall provide automatic control, or

guidance for manual control, to maintain the airplane on the runway to a safe taxi speed on the runway.

The onboard components of the rollout system, considered separately and in relation to other associated

onboard systems, should be designed to meet the requirements of section 25.1309, in addition to any

specific safety related criteria identified in this appendix.

The following criteria is provided for the application of FAR section 25.1309 to Rollout Systems:

a. A Fail Operational rollout system must meet the safe rollout performance requirements of

Appendix 3 section 6.3.3 (i.e., no lateral deviation greater than 70 ft. (21.3m) from centerline) after any

single malfunction, or after any combination of malfunctions not shown to be Extremely Remote.

Malfunction cases may be considered under nominal environmental conditions.

b. For any rollout system, below 200 ft. HAT, unannunciated malfunctions that would prevent a safe

rollout must be shown to be Extremely Improbable.

c. For a fail passive rollout system, the loss of a fail passive automatic rollout function after

touchdown shall cause the automatic flight control system to disconnect. The loss of a Fail Passive

rollout system after touchdown shall be Improbable. Whenever a fail passive guidance system for

manual rollout does not provide valid guidance, an annunciation should be provided to both pilots, and

the guidance removed. The removal of guidance, alone, is not adequate annunciation, unless independent

information available within the pilot’s primary field of view positively indicates the failure. The

annunciation must be located to ensure rapid recognition, and must not distract the pilot flying or

significantly degrade the forward view.

d. For any rollout system, for malfunctions that only affect low speed directional control (speeds below

which rudder is ineffective for steering), rollout system performance should not cause the airplane wheels to

exceed the lateral confines of the runway, from the point of touch down to the point at which a safe taxi

speed is reached, more often than once in ten million landings. A safe taxi speed is considered to be a speed

at which the pilot can resume manual control to safely exit the runway or expeditiously bring the airplane to a

safe stop. A safe taxi speed may vary with airplane characteristics and available means of lateral control.

6.4.3. On Board Database Integrity [PoC]. The definition, resolution and maintenance of the

waypoints which define the required flight path and flight segments is key to the integrity of this type of

landing and rollout operation.

When the required flight path is defined by an on-board database, a mechanism should be established to

ensure the continued integrity of the flight path designators.
AC 120-28D

07/13/99 Appendix 3

Page 13

The integrity of any on board data base used to define flight critical path waypoints for an Landing and

Rollout System should be addressed as part of the certification process.

6.5. Landing and Rollout System Availability.

6.5.1. Landing System Availability. Below 500 ft. on approach, the probability of a successful landing

should be at least 95% for approach demonstrations conducted in the airplane (i.e., no more than 5% of

the approaches result in a go-around, due to the combination of failures in the landing system and the

incidence of unsatisfactory performance). Compliance with this requirement typically should be

established during flight test, with approximately 100 approaches.

For an airplane equipped with a Fail Passive landing system, the need to initiate a go-around below 100 ft.

HAT on approach due to an airplane failure condition should be infrequent (i.e., typically fewer than 1 per

1000 approaches).

For a Fail Operational system, below 200 ft. HAT on approach, the probability of total loss of the landing

system (even though appropriate annunciation of system loss is provided) must be Extremely Remote. For

any annunciation that is provided, that annunciation must enable a pilot to intervene in a timely manner to

avoid a catastrophic result. Total loss of the system without annunciation shall be Extremely Improbable.

6.5.2. Rollout System Availability. For a Fail Passive rollout system, from 200 ft. HAT through

landing and rollout to a safe taxi speed, the probability of a successful rollout should be at least 95%,

considering loss or failure of the rollout system.

For a Fail Operational rollout system, during the period in which the aircraft descends below 200 ft. HAT

to a safe taxi speed, the probability of degradation from Fail Operational to Fail Passive should be

infrequent (i.e., fewer than 1 degradation per 1000 approaches), and the probability of total loss of rollout

capability should be Extremely Remote, considering loss or failure of the rollout system.

After touch down, complete loss of the Fail Operational automatic rollout function, or any other unsafe

malfunction or condition, shall cause the automatic flight control system to disconnect. The loss of a Fail

Operational rollout system after touch down shall be Extremely Remote.

6.6. Go-Around. The aircraft must be capable of safely executing a go-around from any point on the

approach to touch down in all configurations to be certificated. The maneuver may not require

exceptional piloting skill, alertness or strength.

a. A go-around from a low altitude may result in inadvertent runway contact, therefore the safety of

the procedure should be established giving consideration to at least the following:

1) The automatic control and guidance produced by the go-around mode, if such a mode is provided,

should be retained and be shown to have safe and acceptable characteristics throughout the maneuver,

2) Other systems (e.g., automatic throttle, brakes, spoilers and reverse thrust) should not operate

in a way that would adversely affect the safety of the go-around maneuver.

b. Inadvertent selection of go-around mode after touch down should have no adverse effect on the

ability of the aircraft to safely roll out and stop.
AC 120-28D

Appendix 3 07/13/99

Page 14

c. Height loss should be assessed to assure expeditious go-around from a range of altitudes during

the approach and flare when under automatic control and when using the landing guidance system, as

appropriate, and as follows:

1) Height loss may be assessed by flight testing (typically 10 go-arounds) supported by simulation.

2) The simulation should evaluate the effects of variation in parameters, such as weight, center

of gravity, configuration and wind, and show correlation with the flight test results.

3) Normal procedures for a go-around for the applicable configuration should be followed. If

engine-inoperative capability is sought, and use of the go-around mode is applicable to those operations,

an assessment of the engine-inoperative go-around is necessary.

6.7. Automatic Braking System. If automatic braking is used for credit under section 5.16 of this AC, then

the following apply:

a. The automatic braking system should allow anti-skid protection and have manual reversion

capability. An automatic braking system should provide smooth and continuous deceleration from touch

down until the airplane comes to a complete stop on the runway and provide:

1) Disconnect of the autobrake system must not create unacceptable additional crew workload or

crew distraction from normal rollout braking.

2) Normal operation of the automatic braking system should not interfere with the rollout control

system. Manual override of the automatic braking system must be possible without excessive brake pedal

forces or interference with the rollout control system. The system should not be susceptible to inadvertent

disconnect.

3) A positive indication of system disengagement and a conspicuous indication of system failure

should be provided.

4) No malfunction of the automatic braking system should interfere with either pilots use of the

manual braking system.

b. The demonstrated wet and dry runway braking distances, for each mode of the automatic braking

system, should be determined in a manner consistent with part 121, section 121.195 (d) of 14 CFR and

presented in the airplane flight manual as performance information.

6.8. Flight Deck Information, Annunciation and Alerting. This section identifies information,

annunciations and alerting requirements for the flight deck.

The controls, indicators and warnings must be designed to minimize crew errors which could create a

hazard. Mode and system malfunction indications must be presented in a manner compatible with the

procedures and assigned tasks of the flightcrew. The indications must be grouped in a logical and

consistent manner and be visible under all expected normal lighting conditions.

6.8.1. Flight Deck Information. This section identifies requirements for basic situation and command

information.
AC 120-28D

07/13/99 Appendix 3

Page 15

For manual control of approach, landing and rollout flight path, the primary flight display(s), whether

head down or head up, must provide sufficient information to enable a suitably trained pilot to maintain

the approach path, to make the alignment with the runway, flare and land the airplane within the

prescribed limits or to make a go-around without excessive reference to other cockpit displays.

Sufficient information should be provided in the flight deck to allow the pilots to monitor the progress

and safety of the landing and rollout operation, using the information identified above and any additional

information necessary to the design of the system.

Required in flight performance monitoring capability includes at least the following:

1) Unambiguous identification of the intended path for the approach, landing and rollout,

(e.g., ILS/MLS/GLS approach identifier/frequency, and selected navigation source)

2) Indication of the position of the aircraft with respect to the intended path (e.g., situation

information localizer and glide path, or equivalent).

6.8.2. Annunciation. A positive, continuous and unambiguous indication must be provided of the

modes actually in operation, as well as those which are armed for engagement. In addition, where

engagement of a mode is automatic (e.g., localizer and glide path acquisition), clear indication must be

given when the mode has been armed by either action of a member of the flightcrew, or automatically by

the system (e.g., a pre-land test - LAND 3).

6.8.3. Alerting. Alerting requirements are intended to address the need for warning, caution and

advisory information for the flightcrew.

6.8.3.1. Warnings. FAR/JAR 25.1309 requires that information must be provided to alert the crew to

unsafe system operating conditions to enable the crew to take appropriate corrective action. A warning

indication must be provided if immediate corrective action is required. An analysis should be performed

to consider crew alerting cues, corrective action required, and the capability of detecting faults.

Warnings must be given without delay, be distinct from all other cockpit warnings and provide

unmistakable indication of the need for the flightcrew to take immediate corrective action. Aural

warnings must be audible to both pilots under typically assumed worst case ambient noise conditions, but

not so loud and intrusive as to interfere with the crew taking the required corrective action or readily

accomplishing crew coordination. Visual warnings, such as lights or alphanumeric messages, must be

distinct and conspicuously located in the primary field of view for both pilots.

After beginning final approach (e.g., typically prior to reaching 1000' HAT), the loss of a Fail Passive or

Fail Operational system, shall be annunciated. Whenever a Fail Passive system, for manual control, does

not provide valid guidance, it shall be indicated by a positive and unmistakable warning to both pilots,

and the guidance removed. The removal of guidance, alone, is not adequate annunciation. The

annunciation must be located to ensure rapid recognition, and must not distract the pilot flying or

significantly degrade the forward view.

6.8.3.2. Cautions. A caution is required whenever immediate crew awareness is required and timely

subsequent crew action may be required. A means shall be provided to advise the flightcrew of failed

airplane system elements that affect the decision to continue or discontinue the approach.
AC 120-28D

Appendix 3 07/13/99

Page 16

a. After initiation of final approach (which typically occurs at or above 1000' HAT), a Fail Passive

landing system, or landing and rollout system, shall alert the flightcrew to any malfunction or condition

that would adversely affect the ability of the system to safely operate or continue the approach or landing.

b. After initiation of final approach (which typically occurs at or above 1000' HAT), a Fail Passive

command guidance system (e.g., head-up- display (HUD) guidance), shall provide a clear, distinct and

unmistakable indication to alert each pilot to any malfunction or condition that would adversely affect

the ability of the system to safely operate or continue the approach or landing.

c. After initiation of final approach (which typically occurs at or above 1000' HAT), but above the

airworthiness demonstrated Alert Height, a Fail Operational landing system or landing and rollout system

(with either Fail Operational or Fail Passive rollout) shall alert the flightcrew to:

1) Any malfunction or condition that would adversely affect the ability of the system to safely

operate or continue the approach or landing, and

2) Any malfunction that degrades the landing system from a Fail Operational to a Fail Passive

landing system.

d. Below the airworthiness demonstrated Alert Height and throughout rollout, a Fail Operational

landing systems shall inhibit alerts for malfunctions that degrade landing system capability from Fail

Operational to Fail Passive status.

e. Deviation alerting - The FAA expects the flightcrew to monitor flight path deviations as indicated

on the primary flight instruments, and does not require automatic alerting of excessive deviation.

Nonetheless, FAA may approve systems which meet alternate appropriate criteria for deviation alerting

(e.g., JAR/AWO). If a method is provided to detect excessive deviation of the airplane, laterally and

vertically during approach to touch down and laterally after touch down, then it should not require

excessive workload or undue attention. This provision does not require a specified deviation alerting

method or annunciation, but may be addressed by parameters displayed on the ADI, EADI, HUD, or PFD.

When a dedicated deviation alerting method is provided, its use must not cause excessive nuisance alerts.

f. For systems demonstrated to meet JAA criteria, compliance with the following criteria, from JARAWO 236, is an acceptable means of compliance, but is not a required means of compliance:

1) For systems meeting the JAR-AWO 236 criteria, excess-deviation alerts should operate when

the deviation from the ILS, MLS, or GLS glide path or localizer centerline exceeds a value from which a

safe landing can be made from offset positions equivalent to the excess-deviation alert, without

exceptional piloting skill and with the visual references assumed to be available in these conditions.

2) For systems meeting the JAR-AWO 236 criteria, excess-deviation alerts should be set to operate

with a delay of not more than one (1) second from the time that the deviation thresholds are exceeded.

3) For systems meeting the JAR-AWO 236 criteria, excess-deviation alerts should typically be

active at least from 300 ft. (90m) HAT to 50 ft. HAT, but the glide path deviation alert may be discontinued

below 100 ft. (30m) HAT.

6.8.3.3. Advisories. A means shall be provided to inform the flightcrew when the airplane has reached

the operational Alert Height or Decision Height, as applicable.
AC 120-28D

07/13/99 Appendix 3

Page 17

6.8.3.4. System Status. A means should be provided for the operator and flightcrew to determine prior

to departure and the flightcrew to determine after departure, the capability of the airplane elements to

accomplish the intended low visibility operations. While en route, the failure of each airplane

component adversely affecting the capability to conduct the intended landing operation should be

indicated to the flightcrew as an advisory.

A means should be provided to advise the flightcrew of failed airplane system elements relating to

landing system capability which otherwise could adversely affect a flightcrew's decision to use particular

landing minima (e.g., adversely affect a decision to continue to a destination or divert to an alternate).

If multiple landing system capability is installed (e.g., MMR), then during approach, an indication of a

failure in each non-selected airplane landing system element (e.g., an MLS or GLS receiver failure

during conduct of an ILS approach) should be made available to the flightcrew as an indication of system

status. Such failures or non-availability, however, should not produce a caution or warning if they are

not relevant to the system in use.

System Status indications should be typically identified by names that are different than operational

authorization categories (e.g., annunciations such as "LAND 3," or "DUAL" may be used). System or

configuration status annunciations which may change over time as operational criteria change, or could be

confusing or ambiguous if the flightcrew, operator, operation, runway or aircraft are otherwise constrained or

found eligible for a particular minima or operation, should typically not be used (e.g., system or configuration

annunciations such as "CAT I", "CAT II", or "CAT III" should typically not be used for new designs).

6.9. Multiple Landing Systems. International agreements have established a number of landing

systems as being acceptable means to conduct instrument approach and landing. This section identifies

requirements which relate to airplane systems which provide the capability to conduct approach and

landing operations using these multiple landing systems (e.g., ILS, MLS, GLS).

6.9.1. General. Where practicable, the flight deck approach procedure should be the same irrespective

of the navigation source being used.

A means (for example the current ILS facility identification) should be provided to confirm that the

intended approach aid(s) has been correctly selected;

6.9.2. Indications. The following criteria apply to indications in the flight deck for the use of a multimode landing system:

The primary flight display shall indicate deviation data for the selected landing system.

The loss of deviation data shall be indicated on the display. It is acceptable to have a single failure

indication for each axis common to all navigation sources.

6.9.3. Annunciations. The following criteria applies to annunciations in the flight deck when using a

multi-mode landing system.

The navigation source (e.g., ILS, MLS, GLS, FMS) selected for the approach shall be positively indicated

in the primary field of view at each pilot station;

The data designating the approach (e.g., ILS frequency, MLS channel, GLS 'channel') shall be

unambiguously indicated in a position readily accessible and visible to each pilot;
AC 120-28D

Appendix 3 07/13/99

Page 18

A common set of ARM and ACTIVE mode indications (e.g., LOC and GS) is preferred for ILS, MLS

and GLS operations;

A means must be provided for the crew to determine a failure of the non-selected navigation receiver

function, in addition to the selected navigation receiver function. When considering equipment failures,

the failure indications must not mislead through incorrect association with navigation source. For

example, it would not be acceptable for the annunciation "ILS FAIL" to be displayed when the selected

navigation source is MLS and the failure actually affects the MLS receiver;

6.9.4. Alerting. Flight operations may require planning to alternate destination runways or alternate

airports for takeoff, en route diversion and landing. Various runways at these airports may have different

landing systems. Thus, flight operations may be planned, released and conducted on the basis of using

one or more landing systems.

Accordingly, the ability to determine the capability of each element of a multi-mode landing system

should be available to the flightcrew to support flight planning.

A failure of a non-selected landing mode (i.e., ILS, MLS, GLS) shall be indicated to the flightcrew as an

advisory if it has been determined that the mode is not available or will not be available for use during

the next approach and landing.

A failure of the active element of a multi-mode landing system during an approach shall be accompanied

by a warning, caution, or advisory, as appropriate.

An indication of a failure in each non-selected element a multi-mode landing system shall be available to

the flightcrew as an advisory but should not produce a caution or warning. Such advisories may be

inhibited during takeoff, below Alert Height, and at other times as determined necessary or appropriate

for the alerting system and flight deck design philosophy of the aircraft type.

7. Landing and Rollout System Evaluation. An evaluation should be conducted to verify that the

pertinent systems as installed in the airplane meet the airworthiness requirements of section 6 of this

appendix. The evaluation should include verification of landing and rollout system performance

requirements and a safety assessment for verification of the integrity and availability requirements.

Engine failure cases and other selected failure conditions identified by the safety assessment should be

demonstrated by simulator and /or flight tests.

An applicant shall provide a certification plan which describes:

a) The means proposed to show compliance with the requirements of section 6 of this appendix, with

particular attention to methods which differ significantly from those described in this appendix.

b) How any non-airplane elements of the Landing and Rollout System relate to the airplane system

from a performance, integrity and availability perspective.

c) The assumptions on how the performance, integrity and availability requirements of the nonairplane elements will be ensured.

d) The system concepts and operational philosophy to allow the regulatory authority to determine

whether criteria and requirements in excess of that contained in this appendix are necessary.
AC 120-28D

07/13/99 Appendix 3

Page 19

Early agreement between the applicant and the FAA should be reached on the proposed certification

plan. Upon completion of an FAA engineering design review and supporting simulation studies, a type

inspection authorization (TIA) should be issued to determine if the complete installation of the

equipment associated with Category III operations meets the criteria of this appendix.

7.1. Performance Evaluation. The performance of the airplane and its systems must be demonstrated

by either flight test or by analysis and simulator tests supported by flight test. Flight testing must include

a sufficient number of normal and non-normal approaches conducted in conditions which are reasonably

representative of actual expected conditions and must cover the range of parameters affecting the

behavior of the airplane (e.g., wind speed, NAVAID (e.g., ILS) characteristics, airplane configurations,

weight, center of gravity, non-normal events).

The performance evaluation must verify that the Landing and Rollout System meets the performance

requirements of sections 6.1, 6.2, and 6.3 and sub-sections of this appendix. The tests must cover the

range of parameters affecting the behavior of the airplane (e.g., airplane configurations, weight, center of

gravity, non-normal events) when the airplane encounters the winds described by either of the models in

Appendix 4, or other model found acceptable by the Administrator, and the variations in flight path

determination associated with the sensors used by the Landing and Rollout system. Flight testing must

include a sufficient number of normal and non-normal approaches conducted in conditions which are

reasonably representative of actual expected conditions.

The reference speed used as the basis for certification should be identified. The applicant should

demonstrate acceptable performance within a speed range of -5 to +10 knots with respect to the reference

speed, unless otherwise agreed by the FAA and the applicant. The reference speed used as the basis for

certification should be the same as the speed used for normal landing operations, including wind and

other environmental conditions.

The applicant shall demonstrate that the landing and rollout system does not exhibit any guidance system

or control characteristics during the transition to rollout which would cause the flightcrew to react in an

inappropriate manner (e.g., during nose wheel touch down, spoiler extension, initiation of reverse thrust).

Landing systems for manual control with guidance must meet the same requirements for touch down

footprints, sink rates and attitude as automatic landing systems.

The landing and rollout system shall be shown to be satisfactory with and without the use of any outside

visual references, except that outside visual references will not be considered in assessing path tracking

and touch down performance. The airworthiness evaluation will also determine whether the combination

of guidance and outside visual references would unacceptably degrade task performance, require

excessive pilot compensation or workload during normal and non-normal operations.

For the purpose of the airworthiness demonstration, the operational concept for coping with the loss of

guidance may assume the presence of adequate outside visual references for the flightcrew to safely

continue the operation. The airworthiness demonstration should include the loss of guidance to show

there are otherwise no adverse system effects.

For rollout systems for manual rollout with guidance, it shall be demonstrated that a safe rollout can be

achieved with a Satisfactory level of workload and pilot compensation following a failure. Workload and

task compensation may be assessed using the FAA Handling Quality Rating System (HQRS) found in

AC 25-7A, as amended, or equivalent, with and without external visual reference. Rollout guidance must

be demonstrated without external visual reference to show that a pilot can satisfactorily perform the
AC 120-28D

Appendix 3 07/13/99

Page 20

lateral tracking task with the guidance alone. Rollout guidance must also be demonstrated with external

visual reference to show that the combination of guidance and visual reference is compatible and does

not unacceptably degrade task performance, require excessive pilot compensation or workload during

normal and non-normal operations.

For the evaluation of low visibility systems for manual control with guidance for landing or rollout, the set

of subject pilots provided by the applicant should have relevant variability of experience (e.g., experience

with or without HUD, Captain or First Officer (F/O) crew position experience as applicable, and experience

in type). Subject pilots must not typically have special experience that invalidates the test (e.g., pilot's

should not have special recent training to cope with HUD failures, beyond that which a line pilot would be

expected to have for routine operation). The set of pilots provided by the certifying authorities may have

experience as specified by the authority appropriate to the test(s) to be conducted. The experience noted

above for authority subject pilots or evaluation pilots may or may not be applicable or appropriate for the

tests to be conducted.

Failure cases should typically be spontaneous and unpredictable on the subject's or evaluation pilot's part.

For the initial certification of a landing and rollout system for manual control with guidance (e.g., HUD

guidance system) in a new type airplane or new type HUD installation, at least 1,000 simulated landings

and at least 100 actual aircraft landings is typically necessary. For evaluation of these systems, individual

pilot performance should also be considered as a variable affecting performance, see section 6.3.4. As

described in the paragraph above, subject pilots of varying background and experience level should be used

in the flight and simulation programs. Subject pilots should have appropriate qualifications and, when

applicable, be trained in the use of the landing system in a manner equivalent to that expected for pilots

who will use the system in operational service.

For data collection tests, after a significant number of consecutive approaches (e.g., 10 approaches),

subject pilots should be afforded the opportunity for an appropriate rest break.

7.1.1. High Altitude Automatic Landing System Demonstration.

The following describes an acceptable means to demonstrate performance of automatic landing systems at

high altitude with a combination of flight test results and validated simulation. The airport elevation at

which satisfactory performance of an automatic landing system has been demonstrated by this method, may

then be documented in the Airplane Flight Manual (AFM). The flight test demonstration is considered the

primary source of data, which can then be supplemented with data from a validated simulation.

The minimum required altitude or elevation for the flight test which is used to demonstrate a desired

AFM Elevation Value, by this method, is shown in Figure 7.1.1-1 and the accompanying table, below.

For example, the applicant may document an AFM Elevation Value of 8,000 ft., by a successful flight

demonstration at 8,000 ft., or by a flight demonstration at a minimum elevation of 5,000 ft. with a

simulation to the desired 8,000 ft. Note, the lines in Figure 7.1.1-1 converge at 11,000 ft, which indicates

that credit for simulation is not available at 11,000 ft or above.

The atmospheric temperature and pressure during the flight test, for either method, should not be more

favorable than International Standard Atmosphere (ISA) conditions, to ensure that the density altitude is

not less than the airport elevation. When the density altitude value of the flight test is less than the

airport elevation, then the density altitude value should be used as the effective Flight Test Demonstrated

Elevation, and this will decrease the maximum AFM Elevation Value.
AC 120-28D

07/13/99 Appendix 3

Page 21

Assuring acceptable autoland performance at high altitude by using a flight test validated simulation

requires a sufficient quantity of flight test data. Flight test data should be obtained from approximately

10-15 landings at a Flight Test Demonstrated Elevation shown in Figure 7.1.1-1. For flight validation,

the test airplane should be equipped with instrumentation to measure and record:

1) The airplane's trajectory, using an acceptably accurate method, such as by a differential global

positioning system (DGPS) receiver, a laser optical tracker, a calibrated camera, or other equivalent

method.

2) Touchdown vertical velocity and runway touchdown point, expressed in suitable units and

coordinates.

3) Glideslope and Localizer signal deviations.

4) Airplane state parameters as necessary, including relevant powerplant and flight control,

information.

5) Relevant Autopilot, autothrottle, and/or HUD guidance system parameters and performance.

6) Atmospheric conditions at the airport at the time of each approach, including temperature,

barometric pressure (QNH), mean wind velocity and direction.

The simulation should be validated through comparison of simulation data with quantitative flight test

measurements. Time histories of the airplane and systems performance in the approach, flare,

touchdown, rollout and go-around flight phases, for flight tests at the Flight Test Demonstration

Elevation should be compared with corresponding simulation results. The comparison between the flight

test data and the simulation data should show that the two are consistent at corresponding altitudes.

Acceptable autoland performance at the selected AFM Elevation may then be based on validated

simulation results, within the acceptable extrapolation range for flight test data shown in Figure 7.1.1-1.

To assure acceptable autoland performance in a range of altitudes and atmospheric conditions up to and

including the selected AFM Elevation, the simulation should include variation in atmospheric conditions

at least as listed below. A sensitivity analysis should be conducted to assure that performance is not

unsafe near any limits.

Unless otherwise found acceptable to the FAA, simulation cases should typically include the following:

a) Temperatures ranging from International Standard Atmosphere (ISA) value to ISA +40C.

b) Barometric pressure ranging from ISA value for that elevation to ISA -50 hPa.

c) Mean wind variations, including:

- headwinds to at least 25 knots

- crosswinds to at least 15 knots

- tailwinds to at least 10 knots
AC 120-28D

Appendix 3 07/13/99

Page 22

0

2000

4000

6000

8000

10000

12000

14000

0 2000 4000 6000 8000 10000 12000 14000

Flight Test Demonstrated Elevation

AFM Elevation Value

AFM Elevation Value

Flight Test Demonstrated Elevation

FIGURE 7.1.1-1: AFM ELEVATION VALUE FROM FLIGHT TEST AND VALIDATED SIMULATION

TABLE 7.1.1-1: EXAMPLE AFM ELEVATION VALUES

Flight Test Demonstration Airport Elevation

(feet above mean sea level)

Airport Elevation Value

Which May Be Listed in the AFM

(feet above mean sea level)

1,000 6,000

2,000 6,500

3,000 7,000

5,000 8,000

7,000 9,000

9,000 10,000

11,000 11,000

7.1.2. Validation of Simulators for Pilot-in-the-Loop Systems. The certification process for a "Pilotin-the-Loop" system intended for Category III typically requires use of a high fidelity, engineering

quality simulation.

Advisory Circular (AC) 120-40B (7/29/91) Airplane Simulator Qualification, as amended, provides a

means to qualify simulators for qualification of pilots. Meeting these requirements provides a known

basis for acceptance of simulation capability, and is desirable, but may not necessarily be sufficient to

meet the requirements of an engineering simulation to demonstrate landing system performance.
AC 120-28D

07/13/99 Appendix 3

Page 23

Training simulators may not have suitable fidelity in each relevant area, and may not be acceptable for

use without modification. For purposes of system airworthiness demonstration, meeting the requirements

of AC 120-40B is optional. Meeting the criteria of this AC provides an acceptable basis for establishing

certification simulation capability.

When simulation is used for demonstration of manual "pilot-in-the-loop" systems with guidance, suitable

simulation fidelity should be addressed for at least each critical characteristic affecting the validity of the

simulation. An acceptable simulation should typically be capable of varying one parameter at a time, and

be able to facilitate examination of the effects of specific wind, wind gradient, and turbulence conditions

on approach and landing performance.

Factors of the simulation to be considered include the following:

• Guidance and control system interfaces

• motion base suitability

• "ground effect" aerodynamic characteristics

• wind/turbulence model suitability and adequacy of interface with the simulation

• suitability of landing gear and ground handling dynamics

• adequacy of stability derivative estimates used

• adequacy of any simplification assumptions used for the equations of motion;

• fidelity of flight controls and consequent simulated aircraft response to control inputs

• fidelity of the simulation of aircraft performance

• suitability of the simulation for alignment, flare, and rollout control tasks for any normal or nonnormal configurations or disturbance conditions to be assessed

• adequacy of flight deck instruments and displays

• adequacy of simulator and display transient response to disturbances or failures (e.g., engine

failure, autofeather, electrical bus switching)

• visual reference availability, fidelity, and delays

• suitability of visibility restriction models such as appropriate calibration of visual references for

the tests to be performed for day, night, and dusk conditions as necessary

• ability to simulate flight deck visual cutoff angles

• ability to simulate fog, rain, snow or patchy or intermittent conditions or external visual runway,

lighting, marking or nearby terrain scenes as necessary, or

• fidelity of any other significant factor or limitation relevant to the validity of the simulation.
AC 120-28D

Appendix 3 07/13/99

Page 24

For airworthiness certification credit, a review of the simulation, on a case by case basis, must address at

least the following factors:

1) Simulation fidelity relevant to landing system assessment,

2) Stability derivatives, equation of motion assumptions, and relevant ground effect and air and

ground dynamic models used,

3) Adequacy of the source of aerodynamic performance and handling quality data used,

4) Visual system fidelity and configuration,

5) Environmental models and methods of model input to the equations of motion, including suitable

incorporation of altitude and atmospheric temperature effects,

6) Adequacy of adverse weather models (e.g., visual reference models, runway friction), and

7) Adequacy of irregular terrain models.

A suitably high degree of fidelity is required in each relevant component part of the simulation including:

longitudinal, lateral and directional stability (static and dynamic), ground effect during takeoff or landing

as applicable, rollout dynamic characteristics, propulsion system characteristics, (especially for turbopropeller aircraft which have may have significant lift from thrust effects, and drag transient effects due

to engine failure), flying qualities, display or visual system capability as it affects tracking tasks, force

characteristics of flight controls (e.g., yoke/wheel, rudder, brakes), and performance of the airplane. The

fidelity of the simulator may be demonstrated using matching time histories and ensemble touchdown

footprint correlation obtained from flight test. The data provided to validate the simulation and the

simulation data, itself, will be included as part of the type certification data package.

7.1.3. Simulations for Automatic System Performance Demonstration.

The certification process for systems intended for assessment of automatic systems for Category III

operations (e.g., automatic landing systems, automatic landing and rollout systems) typically require the

use of a high fidelity "fast-time" simulation.

For airworthiness certification credit, a review of the simulation, on a case by case basis, must address at

least the following factors:

1) Simulation fidelity relevant to landing system assessment,

2) Stability derivatives, equation of motion assumptions, and relevant ground effect and air and

ground dynamic models used,

3) Adequacy of the source of aerodynamic performance and handling quality data used,

4) Disturbance input method(s) and fidelity,

5) Environmental models and methods of model input to the equations of motion, including suitable

incorporation of altitude and atmospheric temperature effects,
AC 120-28D

07/13/99 Appendix 3

Page 25

6) Adverse weather models (e.g., turbulence, wind gradients, wind models), and

7) Adequacy of irregular terrain models.

Fidelity of the aerodynamic model is needed for at least ground effect, propulsion effects, touch down

dynamics, de-rotation, and landing gear models if required for ground rollout characteristics. The fidelity

of the simulator may be demonstrated using matching time histories obtained from flight test. The data

provided to validate the simulation and the simulation data, itself, will be included as part of the type

certification data package.

7.1.4. Flight Test Performance Demonstration. A flight test performance demonstration should be

conducted, in part, to confirm the results of simulation. A test airplane equipped with special

instrumentation can be used to record the necessary flight test data, for subsequent correlation of flight

test results with simulation results. Comparisons should address flight test data, "Monte Carlo

simulation" results, and failure demonstration simulation results.

The principal performance parameters to be addressed include, as applicable: vertical and lateral flight

path tracking with respect to the intended path (e.g., localizer error, glideslope error, lateral deviation

from runway centerline during rollout); altitude and height above terrain during approach or the runway;

air data vertical speed and radar altitude sink rate; airspeed and ground speed; and longitudinal and

lateral runway touchdown point.

Instrumentation capable of appropriate sample rates and scaling should be used to record relevant

parameters (as a function of time, when applicable) including: air data parameters (e.g., airspeed, angle of

attack, temperature); aircraft position; attitude; heading; track; velocity and velocity errors (e.g., ground

speed, speed error), relevant accelerations; pilot control inputs and resulting surface positions, command

information (i.e., flight director), sink rate at touch down (for structural limit load); drift angle at touch

down (for gear/tire load); applicable mode and mode transition information (e.g., flare, autothrottle retard,

rollout engage); wind as measured at the airplane; a method to determine any unusual aircraft contact with

the runway (e.g., wing, nacelle or tail skid ground contact); and reported surface winds and gusts near the

runway, at the time of approach and landing.

Data taken during demonstration flight tests should be used to validate the simulation(s). Unless otherwise

agreed by FAA, the objective of a flight test program should be to demonstrate performance of the system

to 100% of the steady state wind limit values (e.g., typically at least a 25 kt headwind, 15 kt crosswind, and

10 kt tailwind) that are used in the simulation statistical performance analysis. The simulation can be

considered validated if at least four landings are accomplished during flight test at no less than 80% of the

intended limit steady state wind value, and a best effort has been made to achieve the full steady state wind

component values. It must be shown that the landing system is sufficiently robust near the desired AFM

wind demonstrated values.

7.1.5. Demonstration of Approach and Landing with an Inoperative Engine.

The applicant may optionally demonstrate the low visibility landing system with an inoperative engine,

and, accordingly, the Airplane Flight Manual (AFM) may state what capability has been satisfactorily

demonstrated. With the critical engine inoperative, the applicant may demonstrate the capability to

“initiate” and complete the approach and landing. Alternatively, the applicant may demonstrate the

capability to “continue” the approach and landing, following failure of the critical engine at any point

above the Alert Height or Decision Height.
AC 120-28D

Appendix 3 07/13/99

Page 26

Provisions of section 5.17 of this AC apply to these demonstrations, as do provisions of this appendix

related to landing and rollout performance. The applicant should identify the critical engine, if any,

considering any steady state or transient effects on performance, handling, loss of systems, and landing

mode status (e.g., alignment, flare, rollout). Individual engines may be critical for different reasons.

If the airplane configuration, procedures or operation are the same as that used in the performance

demonstration of section 6.3.1 of this appendix for all-engine operation, compliance may be demonstrated

by, typically, 10 to 15 landings. If there are differences in these airplane configurations, procedures or

operations, the number of required landings will be determined by FAA, on a case by case basis.

If the airplane configuration, procedures or operation is changed significantly from the all-engine operating

case, compliance must typically be demonstrated by statistical analysis of Monte-Carlo simulation results

supported by flight test. Any effect on configuration or landing distance must be considered.

To aid planning for landing with an inoperative engine, or engine failure during approach or go-around,

appropriate procedures, performance, and obstacle clearance information should be available to permit an

operator to provide for a safe go-around at any point in the approach to touchdown. For the purposes of

this requirement, demonstration or data regarding landing and go-around performance in the event of a

second engine failure need not be considered.

If compliance for the case of initiation or continuation of an approach with engine failure is intended, a

statement shall be included in the Non-normal Procedures, or equivalent section of the Flight Manual.

The flight manual should note that approach and landing with an engine inoperative has been satisfactorily

demonstrated. The AFM should list the relevant configuration and conditions under which that

demonstration was made (see Appendix 3 section 9, and Appendix 6, regarding sample AFM provisions).

7.2. Safety Assessment. In addition to any specific safety related criteria identified in this appendix, a

safety assessment of the Landing and Rollout system, considered separately and in conjunction with

other systems, shall be conducted to meet the requirements of section 25.1309.

The safety level for an automatic landing and rollout system, or manual landing and rollout system with

command information as guidance, should not be less than that typically achieved during a conventional

manual landing accomplished by a pilot using a combination of external visual reference and flight

instruments. Hence, in showing compliance with the performance and failure requirements, the

probabilities of performance or failure effects may not be factored by the proportion of landings made

using the landing and roll out system.

In showing compliance with airplane system performance and failure requirements, the probabilities of

performance or failure effects may also not be factored by the proportion of approaches which are made

in low visibility conditions.

The effect of the failure of navigation facilities must be considered taking into account ICAO and other

pertinent State criteria.

Documented conclusions of the safety analysis shall include:

a. A summary of results from the fault tree analysis, demonstrated compliance, and probability

requirements for significant functional hazards.
AC 120-28D

07/13/99 Appendix 3

Page 27

b. Information regarding "alleviating flightcrew actions" that were considered in the safety analysis.

This information should list appropriate alleviating actions, if any, and should be consistent with the

validation conducted during testing. If alleviating actions are identified, the alleviating actions should be

described in a form suitable to aid in developing, as applicable:

1) Pertinent provisions of the airplane flight manual procedures section(s), or

2) Flight Crew Operating Manual (FCOM) provisions, or equivalent, or

3) Pilot qualification criteria (e.g., training requirements, FSB provisions), or

4) Any other reference material necessary for an operator or flightcrew to safely use the system.

c. Information to support preparation of any maintenance procedures necessary for safety, such as:

1) Certification maintenance requirements (CMR),

2) Periodic checks, or

3) Other checks, as necessary (e.g., return to service).

d. Information applicable to limitations, as necessary.

e. Identification of applicable systems, modes or equipment necessary for use of the landing system,

to aid in development of flight planning or dispatch criteria, or to aid in development of procedures or

checklists for pilot selection of modes or assessment of system status, prior to initiation of approach or

during approach.

f. Information necessary for development of Non-normal procedures.

8. AIRBORNE SYSTEMS. The airborne system should be shown to meet the performance, integrity

and availability requirements identified in this AC, as applicable to the type(s) of operation(s) intended.

In addition, airborne systems intended for use for Category III approach and landing, or approach,

landing and rollout shall comply with the pertinent sections of this appendix and the specific

requirements which follow.

8.1. Automatic Flight Control Systems. When established on a final approach path below 1000 ft. HAT,

it must not be possible to change the flight path of the airplane with the automatic pilot(s) engaged, except

by initiating an automatic go-around.

It must be possible to disengage the automatic landing system at any time without the pilot being faced with

significant out-of-trim forces that might lead to an unacceptable flight path disturbance.

It must be possible for each pilot to disengage the automatic landing system by applying a suitable force

to the control column, wheel, or stick. This force should be high enough to preclude inadvertent

disengagement, and low enough to be applied with one hand, but not as low as those described in

section 25.143.

Following a failure or inadvertent disconnect of the automatic pilot, or loss of the automatic landing

mode, when it is necessary for a pilot to immediately assume manual control, a visual alert and an aural

warning must be given. This warning must be given without delay and be distinct from all other cockpit
AC 120-28D

Appendix 3 07/13/99

Page 28

warnings. Even when the automatic pilot is disengaged by a pilot, a warning must sound for a period

long enough to ensure that it is heard and recognized by that pilot and by other flightcrew members. The

warning should continue until silenced by one of the pilots using an automatic pilot quick release control,

or is silenced by another acceptable means. For purposes of this provision, an automatic pilot quick

release control must be mounted on each control wheel or control stick.

8.2 Autothrottle Systems. The following criteria apply to an autothrottle system when used with a low

visibility landing system, if an autothrottle is provided.

a. An automatic landing system must include automatic control of throttles to touch down unless it

can be shown that:

1) Airplane speed can be controlled manually without excessive workload, in representative

conditions for which the system is intended and as demonstrated; and

2) For manual control of throttles, the touch down performance limits must be achieved both for

normal autopilot operations and applicable non-normal operations (e.g., engine failure, as applicable;

during pilot takeover to manual control using HUD guidance, if part of a hybrid system).

b. An automatic throttle system must provide safe operation taking into account the factors listed in

Appendix 3, section 7.1 Landing and Rollout Criteria. Additionally, the system should:

1) Adjust throttles to maintain airplane speed* within acceptable limits;

*NOTE: The approach speed may be selected manually or automatically. If

automatically selected, each pilot must be able to determine that the aircraft is

flying an appropriate speed.

2) Provide throttle application at a rate consistent with the recommendations of the appropriate

engine and airframe manufacturers,

3) Modulate thrust or throttle application at a rate consistent with, and with activity consistent

with typical pilot expectation, considering speed error to be corrected, and any particular conditions or

circumstances (e.g., flare retard, go-around thrust application, response to wind gradients), and

4) Respect maximum limits, minimum limits, and any limits necessary for specific conditions

(e.g., anti-ice, approach idle).

c. An indication of pertinent automatic throttle system engagement must be provided.

d. An appropriate alert or warning of automatic throttle failure must be provided.

e. It must be possible for each pilot to override the automatic throttle (when provided) without using

excessive force.

f. Automatic throttle disengagement switches must be mounted on or adjacent to the throttle levers

where they can be operated without removing the hand from the throttles.
AC 120-28D

07/13/99 Appendix 3

Page 29

g. Following a failure, failure disconnect, or inadvertent disconnect of the automatic throttle, or

uncommanded loss of a selected automatic throttle mode, a suitably clear and compelling advisory or

indication should be provided.

8.3. Head Up Guidance.

a. For a Head Up Guidance landing system, intended for manual "pilot-in-the-loop" control during a

low visibility approach and landing, and if applicable, a low visibility rollout, the HUD must provide

sufficient command information as guidance to enable the pilot to maintain the approach path, to make

the alignment with the runway, flare and land the airplane within the prescribed limits. The HUD must

also provide sufficient information to enable the pilot to initiate a go-around without reference to other

cockpit displays.

b. HUD manual guidance must not require exceptional piloting skill to achieve the required

performance.

c. The workload associated with use of the HUD must be considered in showing compliance with the

minimum flightcrew requirements found in section 25.1523.

d. Any HUD installation, or HUD display presentation, to comply with FAR 25.773, must not

significantly obscure or degrade the pilot's outside view or field of view, or other flightcrew member's

outside view or field of view, through the cockpit window(s). For compliance with this provision,

consideration should be given to dynamic and/or extreme ambient lighting conditions which can affect

the brightness of the display in a manner that adversely affect the suitability of outside view through the

HUD and cockpit windows. The outside view must also be adequate around the HUD combiner through

cockpit windows (e.g., no significant HUD combiner or electronics unit blockage of pilot view).

e. Head Up Guidance systems may be considered Fail Passive if, after a failure, the airplane's flight

path does not experience a significant, immediate deviation due to the pilot following the failed guidance,

before detecting the failure and discontinuing its use.

f. The active mode of the HUD system itself, as well as the flight guidance/automatic flight control

system, must be clearly annunciated in the HUD, unless there are compensating features for displaying

them elsewhere.

g. If a manual "pilot-in-the-loop" landing and rollout system is designed to be used as a single HUD

configuration, the HUD should be installed at the captain's crew station.

h. For a dual HUD configuration, unless otherwise approved by FAA, procedures should be based

on the concept that the Pilot Flying (PF) is the pilot using the HUD during an approach. The Pilot Not

Flying (PNF) is expected to monitor other pertinent flight deck indications (e.g., head down PFD, ND,

thrust or engine parameters, systems, annunciations other than those provided on the HUD, and alerts).

While "head down" flight deck parameters may be assigned as a primary responsibility for a PNF, it is

not necessary or expected that the PNF stow a PNF HUD. This provision does not preclude a PNF from

referring to the HUD, or incorporating use of HUD information with outside visual reference,

particularly when establishing or using outside visual reference. This provision also does not preclude

other concepts for PF or PNF use of a dual HUD installation, if found acceptable by FAA.

i. If an automatic flight control system is used to control the flight path of the airplane prior to

establishing manual "pilot-in-the-loop" HUD guidance on final approach (e.g., the autoflight system is
AC 120-28D

Appendix 3 07/13/99

Page 30

used to intercept and establish tracking of the final approach path), the transition from automatic to

manual flight shall be evaluated during either the HUD demonstration or automatic flight control system

demonstration, or both demonstration(s).

j. Any transition from automatic flight control to manual control using HUD guidance must not

require exceptional piloting skill, alertness, strength or excessive workload.

k. If the HUD fails at any time during a go-around (GA), the pilot must be able to satisfactorily

revert to use of head down displays or instruments. The transition must be completed without

unacceptable flight path transients, or loss of climb performance that could adversely affect obstacle

clearance.

l. During demonstration of any HUD intended for use in Category III operations (e.g., to monitor

autoland), and particularly for any HUD intended for manual "pilot-in-the-loop" flight guidance for

Category III approach and landing, both landing cases and go-around (GA) cases should be demonstrated

where:

1) External visual reference is available at or below 50 ft. HAT to touchdown, and

2) External visual reference is not available at any time below 50 ft. HAT to touchdown, and, if

applicable, is also not available for rollout, and

3) External visual references and HUD and instrument references disagree (e.g., localizer

centering errors).

m. If rollout guidance is provided on the HUD, the HUD information must enable the pilot to safely

control the airplane along the runway after touch down within the prescribed limits. Both normal

tracking and any applicable non-normal capture or tracking conditions (e.g., recovery from

displacements) should be assessed.

n. After touch down, loss of a Fail Passive rollout system for manual control with guidance, shall be

annunciated with an appropriate visual alert and removal of the command guidance.

o. Rollout systems which display only lateral deviation as a cue for centerline tracking have generally

not been shown to provide adequate information to adequately control the aircraft or recover from

displacements. Consequently, such displays are typically considered to have excessive workload and

require excessive pilot task compensation. Also, systems which display only situation information in lieu

of command information have not been shown to be effective. If proposed, either type of such system

would require successful proof of concept evaluation. [PoC]

8.4. Hybrid HUD/Autoland Systems [PoC]. Hybrid systems must be demonstrated to be acceptable to

the FAA in a proof of concept evaluation during which specific airworthiness and operation criteria will

be developed, and they must otherwise meet the requirements of 5.8 and this appendix.

8.4.1. Hybrid HUD/Autoland System Fail Operational Equivalency Concept. Combining an automatic

landing system which meets the Fail Passive criteria of this appendix with a HUD which also meets that

same criteria does not necessarily ensure that an acceptable Fail Operational system will result. These

systems may be combined to establish a Fail Operational system for low visibility operations provided

certain considerations are addressed:
AC 120-28D

07/13/99 Appendix 3

Page 31

1) Each element of the system alone is shown to meet its respective requirements for a Fail Passive

system.

2) The automatic landing system shall be the primary means of control, with the manual flight

guidance system serving as a backup mode or reversionary mode.

3) Manual rollout flight guidance capability must be provided for hybrid systems which do not have

automatic rollout capability. Such manual rollout capability must have been shown to have performance

and reliability at least equivalent to that required of a Fail Passive automatic rollout system.

4) The transition between automatic mode of operation and manual mode of operator should not

require extraordinary skill, training, or proficiency.

5) If the system requires a pilot to initiate manual control at or shortly after touch down, the

transition from automatic control prior to touch down to manual control using the remaining element of

the hybrid system (e.g., HUD) after touch down must be shown to be safe and reliable.

6) The capability of the pilot to use a hybrid system to safely accomplish the landing and rollout,

following a failure of one of the hybrid system elements below alert height, must be demonstrated, even

if operational procedures require the pilot to initiate a go-around.

7) Appropriate annunciations must be provided to the flightcrew to ensure a safe operation.

8) The combined elements of the system must be demonstrated to meet the required Fail Operational

criteria necessary to support the operation (refer to Section 4 of the AC)

9) The overall system must also be shown to meet necessary accuracy, availability, and integrity

criteria suitable for Fail Operational systems. Individual components must each be individually reliable

(e.g., a highly reliable automatic flight control system and an unreliable HUD would not be acceptable).

Hybrid System Go Around Capability.

Demonstrations are necessary for each element of the hybrid system for low altitude go-around (GA), in

the altitude range between 50 ft. HAT and touchdown.

Hybrid system demonstrations must be conducted in the following conditions:

a. Without external visual reference,

b. With visual reference, and

c. With the presence of external visual reference that disagrees with instrument reference

(e.g., localizer centering errors).

8.4.3. Hybrid System Transition From Automatic to Manual Flight.

A safe manual takeover of airplane control to complete the landing within the established touchdown

footprint must be demonstrated. Use of appropriate takeover response time delays for the transition

should be considered during the demonstration.
AC 120-28D

Appendix 3 07/13/99

Page 32

These demonstrations must be conducted in the following conditions:

a. Without external visual reference,

b. With visual reference, and

c. With the presence of external visual reference that disagrees with instrument reference

(e.g., localizer centering errors).

8.4.4. Hybrid System Pilot Not Flying (PNF). The pilot not flying (PNF) must have suitable

information provided to accomplish appropriate assigned duties, to be an integral part of the crew, and to

safely deal with immediate or subtle incapacitation of the Pilot Flying (PF) regardless of visual reference

availability.

8.5. Satellite Based Landing Systems [PoC]. This appendix is intended to provide criteria, but not a

comprehensive acceptable means of compliance for airworthiness approval of GNSS based low visibility

landing systems (e.g., GLS). Airworthiness approval of a GLS requires an overall assessment of the

integration of the airplane landing system components with other related non-airplane landing system

elements (e.g., GLS differential transmitters, pseudolites, satellite constellation(s) characteristics,

waypoint data sources and use, reference datum used) to ensure that the overall safety is acceptable.

The performance, integrity and availability of any ground station elements, any data links to the airplane,

any satellite elements and any data base considerations, when combined with the performance, integrity

and availability of the airplane system, should be at least equivalent to the overall performance, integrity

and availability achieved when ILS is used to support Category III operations.

The following requirements apply to approach and landing systems using GNSS (e.g., GLS):

a. During the approach, the flightcrew must be advised if the GNSS service or landing system cannot

support the required performance and integrity. This includes assessment of space vehicle (SV)

degradation or failure, augmentation degradation or failure, including the effect of satellite vehicle

geometry on the required performance, availability and integrity.

b. The GNSS system assessment should address failure mode detection coverage and adequacy of

monitors and associated alarm times. GLS landing and rollout system performance, failure detection and

annunciation should be consistent with any established ICAO Standards and Recommended Practices,

FAA criteria, or other State criteria acceptable to FAA, unless otherwise approved by FAA.

c. The effect of airplane maneuvers on the reception of signals must be considered as necessary to

maintain the required performance, availability and integrity. If applicable, loss and re-acquisition of

signals should be considered. The effect of local terrain should also be considered.

8.5.1. Flight Path Definition. For Flight Path Definition considerations refer to Section 4.6 of this AC.

8.5.2. Aircraft Database. The required flight path may be uplinked to the airplane or may be stored in an

aircraft database for recall and incorporation into the flight guidance and/or control system when required

to conduct an approach, landing and rollout.

Corruption of the information contained in the data base used to define the reference flight path is considered

Hazardous. Failures which result in unannunciated changes to the data base must be Extremely Remote.
AC 120-28D

07/13/99 Appendix 3

Page 33

For a procedural specified flight path intended to support automatic landing or manual flight guidance

below 100 ft HAT, the flightcrew should not be able to modify information in the data base which relates

to the critical definition of that required flight path, for any segment(s) of the procedure considered flight

critical.

8.5.3. Differential Augmentation. Differential augmentation uses a set of GNSS receivers at known

locations to derive differential corrections for each of the satellite pseudo-ranges. This network of GNSS

receivers typically also provides signal in space integrity monitoring. If such a ground based augmentation

system is used to provide differential pseudo-range corrections, or other data to an airplane to support

Category III operations, the overall integrity of that operation must be established.

The role of the ground based augmentation system in the landing system must be considered during the

aircraft system certification process until such time as an acceptable national, or international standard,

for the ground reference system is established.

8.5.4. Datalink. A data link may be used to provide data to the airplane to provide the accuracy

necessary to support certain operations.

The integrity of the data link should be commensurate with the integrity required for the operation.

The role of the data link in the landing system must be addressed as part of the aircraft system

certification process until such time as an acceptable national, or international standard, for the ground

system is established.

8.6 Enhanced Vision Systems or Synthetic Vision Systems [PoC]. Enhanced Vision System are

typically considered to be those systems using airplane based sensors to penetrate visibility restrictions,

and provide the flightcrew with a corresponding enhanced forward view of the scene outside the airplane

(e.g., radar imagery presented in a perspective view, FLIR, LLTV). Synthetic Vision Systems (SVS) are

typically those systems which create computer generated imagery or symbology representing how an

outside forward vision scene would otherwise appear, or elements of that scene would appear, if a pilot

could optically see through the visibility restriction or darkness.

This appendix section is not intended to address acceptable means of compliance for airworthiness

approval of either Enhanced Vision Systems or Synthetic Vision Systems. Criteria for approval of an

enhanced vision system or synthetic vision systems must match the system's proposed intended use, and

must follow and be based on successful completion of proof of concept testing acceptable to FAA.

Typically EVS or SVS systems would be expected to meet the same or equivalent performance accuracy,

integrity, and availability criteria of other acceptable landing systems. Other limited uses, such as for

assessing integrity alone (e.g., use as an independent landing monitor) may be assessed principally

considering the proposed limited intended function. However, fidelity, alignment, penetration of weather,

potential for misleading information, real time response, and any other relevant factor must be shown to be

safe and appropriate for the intended application. If EVS or SVS information is to be presented on a headup-display (HUD), such EVS or SVS information must additionally meet any pertinent HUD provisions

(e.g., see Appendix 3, sections 8.3 and 8.4, as applicable). For a HUD presentation of EVS or SVS, a

significant issue to be considered, even for no credit or limited credit, is the issue of potential blockage of

cockpit window forward view (see provisions of Appendix 3, section 8.3 d.).

9. Airplane Flight Manual. Upon satisfactory completion of an airworthiness assessment and test

program, the FAA-approved airplane flight manual or supplement, and any associated markings or

placards, if appropriate, should be issued or amended to address the following:
AC 120-28D

Appendix 3 07/13/99

Page 34

1) Relevant conditions or constraints applicable to landing or landing and rollout system use

regarding the airport or runway conditions (e.g., elevation, ambient temperature, runway slope).

2) The criteria used for the demonstration of the system, acceptable normal and non-normal

procedures (including procedures for response to loss of guidance), the demonstrated configurations, and

any constraints or limitations necessary for safe operation.

3) The type of navigation aids used as a basis for demonstration. This should not be taken as a

limitation on the use of other facilities. The AFM may contain a statement regarding the type of facilities

or condition known to be unacceptable for use (e.g., For ILS or MLS) based systems, the AFM should

indicate that operation is predicated upon the use of an ILS (or MLS) facility with performance and

integrity equivalent to, or better than, a United States Type II or Type III ILS, or equivalent ICAO Annex

10 Facility Performance Category III facility).

4) Applicable atmospheric conditions under which the system was demonstrated (e.g., demonstrated

headwind, crosswind, tailwind) should be described as follows:

a) In the Limitations Section, the wind component values* used as a basis for statistical analysis,

as supported by flight evaluation and validation, which may apply to use of the landing system, such as if

credit for use is sought for low visibility operations,

*Note: These are the wind values for which the applicable criteria of Appendix 3,

(see paragraph 5) below), have been met.

b) In the Normal Operations Section, or equivalent section, maximum** wind component values

experienced during the flight demonstration, described as "Demonstrated Wind Component(s)",

**Note: These values are provided for information only.

c) For use of the landing system other than for low visibility credit (e.g., in wind or other

conditions where system performance may not necessarily be supported by the statistical analysis), any

necessary description of considerations, if other than the maximum demonstrated wind component values

for the basic airplane*** apply.

***NOTE: FAA does not apply a "landing system" wind limitation unless

unacceptable system characteristics dictate use of a limitation. This is consistent

with specification of the demonstrated wind component value for the basic

airplane, which is included in the AFM for information, and is not limiting.

5) For a landing or landing and rollout system meeting provisions of Appendix 3, the Normal

Procedures, Normal Operations, or equivalent section, of the AFM should also contain the following

statements:

"The airborne system has been demonstrated to meet the airworthiness requirements of

AC 120-28D Appendix 3 for <specify the pertinent Landing or Landing and Rollout

capability Section(s) criteria met> when the following equipment is installed and

operative:

<list pertinent equipment>"

"This AFM provision does not constitute operational approval or credit for Category III use of this

system."
AC 120-28D

07/13/99 Appendix 3

Page 35

6) Airplane Flight Manual provisions should be consistent with the following:

a) The AFM may list the alert height demonstrated,

b) The AFM should not specify a DA, DH or RVR constraint, and

c) The AFM should not include visual segment specifications.

Examples of general AFM considerations, specific AFM provisions, and location of those provisions for

applicable landing or landing and rollout systems are provided in Appendix 6.

AC 120-28D

07/13/99 Appendix 4

Page 1

APPENDIX 4

WIND MODEL FOR APPROACH AND LANDING SIMULATION

In carrying out the performance analysis, one of the following models of wind, turbulence and wind shear

may be used:

Wind Model A

Mean Wind

The mean wind is the steady state wind measured at landing. This mean wind is composed of a downwind

component (headwind and tailwind) and a crosswind component. The cumulative probability distributions

for these components are provided in Figure A4-1 (downwind) and Figure A4-2 (crosswind). Alternatively,

the mean wind can be defined with magnitude and direction. The cumulative probability for the mean wind

magnitude is provided in Figure A4-3, and the histogram of the mean wind direction is provided in

Figure A4-4. The mean wind is measured at a reference altitude of 20 ft. AGL. The models of the wind

shear and turbulence given in following sections assume this reference altitude of 20 ft. AGL is used.

Wind Shear

The wind shear component is that portion which affects the air mass moving along the ground

(i.e., ground friction). The magnitude of the shear is defined by the following expression:

V V h

wref = + 0 20407  015

015 20

. ln .

.

where Vwref is the mean wind speed measured at h ft. and V

20 is the mean wind speed at 20 ft. AGL.

Turbulence

The turbulence spectra are of the Von Karman form.

Vertical Component of Turbulence.

The vertical component of turbulence has a spectrum of the form defined by the following equation:

( ) ( )

( ) w

w

L L

L

w w w

Φ Ω

Ω

Ω

=

 +

+ 



 

2

2

2

11

6

1 2 67 1339

2 1 1339

σ

π

. .

.

where:

Φw = spectral density in (ft./sec)2

σw = root mean square (rms) turbulence magnitude in ft/sec = 01061 20 . (ft / sec) V

where V20 is expressed in knots

Lw = scale length = h (for h < 1000 ft.)

Ω = spatial frequency in radians/ft. = ω/VT

ω = temporal frequency in radians/sec, and

VT = airplane speed in ft./sec.
AC 120-28D

Appendix 4 07/13/99

Page 2

Horizontal Component of Turbulence.

The horizontal component of turbulence consists of a longitudinal component (in the direction of the

mean wind) and lateral component. The longitudinal and lateral components have spectra of the form

defined by the following equations:

Longitudinal Component:

( )

( ) ( )

Φ Ω

Ω

u

u u

u

L

L

=

+

2

2

1 1399

σ

π .

5

6

Lateral Component:

( ) ( ) ( )

( ) ( ) v

v v v

v

L L

L

Φ Ω

Ω

Ω

=

+

+

2 2

2

11

6

1 2 67 1339

2 1 1339

σ

π

. .

.

where the RMS Turbulence Scales are defined as below

σ w = 01061 V kts.

20 . ()

a. When h ft ≥ 1 000 , . σσσ uvw = =

b. When h ft < 1 000 , .

σσσ uvw h = = +













1

0177 0 000823

0 4

. .

.

c. When h ≤ 0

σσσ uvw = =  

1

0177

0 4

.

.

and where the Turbulence Scales are defined as below

a. When h ft ≥ 1 000 , . LLL uvw == = 1000 ,

b. When h ft < 1 000 , . L h w =

( ) LLh

h u v = = +  1

0177 0 000823 . .

1.2

c. When h ft ≤ 0 LLL uvw === 0
AC 120-28D

07/13/99 Appendix 4

Page 3

0.01 0.1 1 10 20 30 40 50 60 70 80 90 99 99.9 99.99

99.99 99.9 99 90 80 70 60 50 40 30 20 10 1 0.1 0.01

30

20

10

0

-30

-20

-10

-0

Probability of Exceedance, %

Probability of not Exceeding, %

HEADWIND-TAILWIND DESCRIPTION

TAILWIND SPEED .KT (WIND FROM 180 DEG)

HEADWIND SPEED .KT (WIND FROM 0 DEG)

Figure A4-1

0.01 0.1 1 10 20 30 40 50 60 70 80 90 99 99.9 99.99

99.99 99.9 99 90 80 70 60 50 40 30 20 10 1 0.1 0.01

30

20

10

0

-30

-20

-10

-0

Probability of Exceedance, %

CROSSWIND DESCRIPTION

-5

-15

-25

5

15

25

Probability of Exceedance, %

CROSSWIND SPEED .KT COUNTERCLOCKWISE FROM 0 DEG

CROSSWIND SPEED .KT CLOCKWISE FROM O DEG

Figure A4-2
AC 120-28D

Appendix 4 07/13/99

Page 4

0 5 10 15 20 25 30 35 40

Wind S peed V w kt

100

80

60

40

20

10

8

6

4

2

1.0

0.8

0.6

0.4

0.2

0.1

ANNUAL PERCENT PROBABILITY OF MEAN WIND SPEEDEQUALING OR EXCEEDING GIVEN VALUES

Figure A4-3

PERCENT PROBABILITY OF EXCEEDANCE
AC 120-28D

07/13/99 Appendix 4

Page 5

Wind Direc tion Histogram

Wind Direction Relative to Runway Heading

P

e

r

c

e

n

t

0

2

4

6

8

10

12

180190200210220230240250260270280290300310320330340350

0 10 20 30 40 50 60 70 80 90 100110120130140150160170180

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Wind from the Left Wind from the Right

Figure A4-4
AC 120-28D

Appendix 4 07/13/99

Page 6

0.8

1.2

1.0

0.6

0.4

0.2

0 1.0 1.2 1.4 1.6 1.8

h/h i

SELECTED DESCRIPTION FOR VARIANCES OF

HORIZONTAL TURBULENCE COMPONENTS

2.0

{ .4 

h > h i

[ 0.177 + 0.823 h/h i ]

1.0

1

σu σv

σw σw

= =

σu/σw = σ vσw

 h < h i

Figure A4-5
AC 120-28D

07/13/99 Appendix 4

Page 7

1.2

1.0

0.8

0.6

0.4

0.2

0 0.2 0.4 0.6 0.8 1.0

h/h i

Lu = L v

Lw

hi = Altitude above which turbulence is isotropic

Lv = L u

Lw ={

Lu ={

h,h<h i

d,h = h i

Lw σu

σw

3

d

=

h

[0.177 + 0.823 h/h i ] 1.2

h < h i

h > h i

Lw /h i ,L u/h i = Lv/h i

SELECTED INTEGRAL SCALE DESCRIPTION

Figure A4-6
AC 120-28D

Appendix 4 07/13/99

Page 8

Wind Model B.

Mean Wind

It may be assumed that the cumulative probability of reported mean wind speed at landing, and the crosswind

component of that wind are as shown in Figure A4-7. Normally, the mean wind which is reported to the pilot

is measured at a height which may be between 6m (20 ft.) and 10m (33 ft.) above the runway. The models of

wind shear and turbulence given in the following paragraphs assume this reference height is used.

Wind Shear

Normal Wind Shear. Wind shear should be included in each simulated approach and landing, unless its effect

can be accounted for separately. The magnitude of the shear should be defined by the expression:

u = 0.43 U log10 (z) + 0.57 U, for z ≥ 0.05 m (1)

u ≅ 0, for z < 0.05m

where z is the height in meters

u is the mean wind speed at height z (meters)

U is the mean wind speed at 10m (33 ft.).

Abnormal Wind Shear. The effect of wind shears exceeding those described above should be investigated

using known severe wind shear data.

Turbulence.

Horizontal Component of Turbulence. It may be assumed that the longitudinal component (in the direction of

mean wind) and lateral component of turbulence may each be represented by a Gaussian process having a

spectrum of the form:

Φ Ω( ) Ω = • +

2

1

2

2 2

σ

π

L

L (2)

where Φ Ω( ) = a spectral density in (meters/sec)2

 per (radian/meter).

σ = root mean square (rms) turbulence intensity = 0.15 U

L = scale length = 183m (600 ft.)

Ω = frequency in radians/meter.

Vertical Component of Turbulence. It may be assumed that the vertical component of turbulence has a

spectrum of the form defined by equation (2) above. The following values have been in use:

σ = 1.5 knots with L = 9.2m (30 ft.)

or alternatively

σ = 0.09 U with L = 4.6m (15 ft.) when z < 9.2m (30 ft.)

and

L = 0.5 z when 9.2 < z < 305m (30 < z < 1000 ft.)
AC 120-28D

07/13/99 Appendix 4

Page 9

0 10 20 30 40

Total Wind

Head Wind

Cross Wind Component

 Component

Tail Wind

 Component

WIND SPEED KNOTS

 Cumulative probability of reported Mean Wind, and Head Wind, Tail Wind

 Cross Wind Components, when landing.

NOTE: This data is based on world wide in-service operations of UK airlines (sample size

about 2000)

P

R

O

B

A

B

I

L

I

T

Y

O

F

E

X

C

E

E

D

I

N

G

G

I

V

E

N

W

I

N

D

S

P

E

E

D

0.01

0.05

0.1

0.2

0.5

1

2

8

10

20

30

40

50

60

70

80

90

95

98

99

99.8

99.9

99.99

Figure A4-7

AC 120-28D

07/13/99 Appendix 5

Page 1 and 2

APPENDIX 5. [RESERVED]

AIRWORTHINESS DEMONSTRATION OF DECELERATION AND

BRAKING SYSTEMS OR DISPLAYS.

THIS APPENDIX INTENTIONALLY LEFT BLANK

[RESERVED]

AC 120-28D

07/13/99 Appendix 6

Page 1

APPENDIX 6

AFM PROVISIONS AND EXAMPLE AFM WORDING

6.1. Example Provision - AFM "Certificate Limitation" Section.

6.2. Example Provision - AFM “Normal Procedures” or “Normal Operation” Section [Typical Aircraft

Type with Fail Operational and Fail Passive FGS Capability]

6.3. Example Provision - AFM “Normal Procedures” or “Normal Operation” Section [Typical Aircraft

Type with Fail Passive FGS Capability]
AC 120-28D

Appendix 6 07/13/99

Page 2

6.1 Example Provision - AFM "Certificate Limitation" Section (With "Type Specific" Example

Information and Notes)

____________________________________________________________________________

(List Aircraft Type)

AIRPLANE FLIGHT MANUAL

Section 1 - CERTIFICATE LIMITATIONS

ELECTRONIC SYSTEMS

AUTOPILOT/FLIGHT DIRECTOR SYSTEM

Automatic Landing

Maximum wind component speeds when landing weather minima are predicated on autoland operations:

Headwind: 25 knots

Tailwind: 15 knots

Crosswind: 25 knots

The maximum and minimum glideslope angles are 3.25 degrees and 2.5 degrees respectively.

The autoland capability may be used with flaps 20 or 30, with both engines operative or with one engine

inoperative. The Autopilot Flight Director System (AFDS) status annunciation must have LAND 2 or LAND 3

displayed and the SLATS DRIVE message must not be present.

Automatic Approach with Flaps 25

Autoland is not approved with flaps 25.

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

07/13/99 Appendix 6

Page 3

6.2 Example Provision - AFM “Normal Procedures” or “Normal Operation” Section

[Typical Aircraft Type with Fail Operational and Fail Passive FGS Capability]

____________________________________________________________________________

(List Aircraft Type)

AIRPLANE FLIGHT MANUAL

Section 3 - NORMAL PROCEDURES

AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS)

LOW WEATHER MINIMA - AUTOMATIC LANDING - FAIL-OPERATIONAL

The autopilot system has been shown to meet the applicable airworthiness, performance, and integrity criteria

applicable to Category III as specified in FAA Advisory Circular (AC) 120-28D Appendix 3 for a failoperational automatic landing system, with the following functions operative and LAND 3 annunciated:

Autoland status annunciation on both PFD’s

Autothrottle

Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting

messages are not displayed:

SGL SOURCE DISPLAYS

SGL SOURCE RAD ALT

SINGLE SOURCE ILS

LOW WEATHER MINTMA - AUTOMATIC LANDING - FAIL-PASSIVE

The autopilot system has been shown to meet the applicable airworthiness, performance, and integrity criteria

applicable to Category III as specified in FAA AC 120-28D Appendix 3 for a fail-passive automatic landing

system, with the following functions operative and LAND 2 annunciated:

Autoland status annunciation on both PFD’s

Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting

messages are not displayed:

SGL SOURCE DISPLAYS

SGL SOURCE RAD ALT

SINGLE SOURCE ILS

The demonstration for fail-passive autoland operations with LAND 2 annunciated included a requirement for a

go-around if a subsequent autopilot system failure were to be detected on approach, if operational credit for use

of autoland is required.

CAUTION: If the autopilot disconnects during an engine-out go-around, loss of autopilot rudder

control can result in large yaw and roll excursions.

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

Appendix 6 07/13/99

Page 4

Section 3 - NORMAL PROCEDURES

AUTOPILOT - F LIGHT DIRECTOR SYSTEM (AFDS) (Continued)

LOW WEATHER MINIMA - AUTOPILOT APPROACH

The autopilot system has been shown to meet the applicable airworthiness, performance, and integrity criteria

applicable to Category II as specified in FAA (AC) 120-29__ Appendix __ for automatic approach with the

following functions operative and LAND 3 or LAND 2 annunciated:

Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting

messages are not displayed:

SGL SOURCE DISPLAYS

SGL SOURCE RAD ALT

SINGLE SOURCE ILS

LOW WEATHER MINIMA - FLIGHT DIRECTOR

The flight director system has been shown to meet the applicable airworthiness, performance, and integrity

criteria applicable to Category II as specified in FAA (AC) 120-29__ Appendix __ for manual approach with

the following functions operative:

Normal flight controls

Air Data Inertial Reference Unit

Independent ILS and radio altitude sources on the PFD for each pilot, i.e., the following alerting

messages are not displayed:

SGL SOURCE DISPLAYS

SGL SOURCE RAD ALT

SINGLE SOURCE ILS

SINGLE SOURCE F/D

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

07/13/99 Appendix 6

Page 5

6.3 Example Provision - AFM “Normal Procedures” or “Normal Operation” Section

[Typical Aircraft Type with Fail Passive FGS Capability]

____________________________________________________________________________

(List Aircraft Type)

AIRPLANE FLIGHT MANUAL

Section 3 - NORMAL OPERATIONS

AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS)

The Autopilot-Flight Director System is used as either a single channel autopilot or flight director for en route

and single channel approaches. Dual autopilot channels provide fail-passive operation for automatic landing

and go-around. Dual flight directors provide for takeoff, approach and go-around guidance.

The following flight path control functions for automatic (autopilot) and/or manual (flight director) control of

the airplane are provided:

Lateral navigation

Vertical navigation

VOR

Localizer (Front course only) Approach

Autoland (Dual autopilot only)

Go-around (Dual autopilot and/or flight director only)

The following pilot assist functions for automatic (autopilot) and/or manual (flight director) control of the

airplane are provided:

Control Wheel Steering (Autopilot only)

Heading select and hold

Vertical speed select and hold

IAS/Mach select and hold (Elevator control of speed in level change)

Altitude Select/Acquire or Capture and Hold

Takeoff (Dual Flight director only)

Go-around, one engine inoperative (Dual Flight director only)

The Captain's and First Officer's instruments (Display Source, VHF NAV and IRS) must not be on the same

source when credit for use of the AFDS is necessary to make lower weather minima approaches.

An interlock is provided with the electrical transfer bus sensing circuit to preclude dual-channel autopilot operation on a

single source of power. However, the Auxiliary Power Unit generator may be used as an independent power source.

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

Appendix 6 07/13/99

Page 6

Section 3 - NORMAL OPERATIONS

AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued)

DEMONSTRATED CONDITIONS

The system has been demonstrated both with and without yaw damper and autothrottle and with normal landing

flaps 30 and 40.

The approach speed selected for automatic approaches using autothrottles Was VREF + 5 knots (no wind

correction).

The approach speed selected for autothrottle inoperative was VREF for calm air conditions and VREF + 1/2

(Headwind) + Full Gust for wind conditions.

The automatic landing system has been demonstrated in VMC conditions with the following wind conditions:

Headwind - 25 knots

Tailwind - 30 knots

Crosswind - 24 knots

Satisfactory Automatic Landing System performance has been demonstrated on U.S. Type II and Type III ILS

ground facilities.

An autopilot minimum engage height (MEH) of 400 feet after takeoff has been demonstrated to provide

satisfactory performance.

Single Engine Approach: The AFDS has demonstrated adequate performance for low visibility approach using

a single engine, with flaps 15.

MINIMUM MULTICHANNEL ENGAGE ALTITUDE FOR AUTOLAND

On approach for autoland, dual channel operation should be engaged prior to 800 feet AGL. Check FLARE

arm annunciation at approximately 500 feet AGL.

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

07/13/99 Appendix 6

Page 7

Section 3 - NORMAL OPERATIONS

AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued)

AFDS SYSTEM CONFIGURATION

The AFDS equipment listings in this section do not necessarily denote all of the systems and equipment

required for the types of operation specified. Applicable FAR's and AC’s may prescribe an operational

requirement for such additional systems such as autothrottle, or autobrakes. Operators should determine the

total systems requirements for each type of operation prior to requesting OpSpecs authorization.

Demonstrated compliance with the airworthiness performance standards does not constitute approval to

conduct operations in lower weather minimums.

DEMONSTRATED ALTITUDE LOSS

The demonstrated altitude loss due to a simulated hard-over autopilot malfunction is:

Level Flight:

Flaps up - 370 feet when recovery was initiated 3 seconds after the recognition point.

Approach:

(a) 23 feet with a 1 second time delay between recognition point and initiation of recovery.

(b) Negligible when recovery was initiated without delay after pilot recognition.

Go-Around:

The demonstrated altitude loss during an automatic go-around initiated below 100 feet AGL is listed below:

GA Altitude (ft AGL) Altitude Loss (ft)

70 to 100 26

60 21

50 20

40 18

30 11

20 3

10 2.5

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

Appendix 6 07/13/99

Page 8

Section 3 - NORMAL OPERATIONS

AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued)

AUTOPILOT APPROACH/AUTOLAND (FAIL PASSIVE) (Applicable to Category III)

The Autopilot System has been shown to meet the applicable airworthiness and performance and reliability

criteria of FAA AC120-28D for automatic approach and landing of the airplane to touchdown with the

following additional equipment operative and FLARE arm annunciated.

Dual Channel Autopilot engaged

Low Range Radio Altimeter and display for each Pilot

Decision Height (DH) Display for each Pilot

Two Digital Air Data Computer Systems

Windshield Wipers for each Pilot

ILS Receiver and display for each Pilot

Flight Mode Annunciator for each Pilot

Two ADIRU's (associated with the engaged autopilots) in NAV mode

Dual Hydraulic Systems

Two sources of electrical power (The APU generator may be used as an independent power source)

Both Engines Operating

AUTOPILOT APPROACH (Applicable to Category II)

The Autopilot System has been shown to meet the airworthiness, performance, and reliability criteria of FAA

AC 120-29 __, Appendix __ for Category II, for automatic approach with the following additional listed

equipment operative:

Single or Dual channel Autopilot engaged

Low Range Radio Altimeter and display for each Pilot

Decision Height (DH) Display for each Pilot

Two Digital Air Data Computer Systems

Windshield Wipers for each Pilot

ILS Receiver and display for each Pilot

Flight Mode Annunciator for each Pilot

Two ADIRU's (associated with the engaged autopilot) in NAV mode

Two sources of electrical power (The APU generator may be used as an independent power source.)

Both Engines Operating

FAA APPROVED (Date) Section 3 Page ___
AC 120-28D

07/13/99 Appendix 6

Page 9

Section 3 - NORMAL OPERATIONS

AUTOPILOT - FLIGHT DIRECTOR SYSTEM (AFDS) (Continued)

FLIGHT DIRECTOR (F/D)

The flight director command may be used as supplemental guidance to the primary speed and attitude

indications for takeoff, climb and descent to acquire and maintain desired altitudes.

All of the autopilot command modes, except "CWS," are also available on the flight directors. An additional

takeoff mode exists for the F/D only. One or both F/Ds may be on for all modes, except during T/O or GA

which requires dual F/D ON.

FLIGHT DIRECTOR APPROACH (Applicable to Category II)

The flight director system has been shown to meet the applicable airworthiness, performance and reliability

requirements of FAA AC 120-29__, Appendix __, for manual approach with the following equipment

operative:

Both flight directors must be selected

Low Range Radio Altimeter and display for each Pilot

Decision Height (DH) Display for each Pilot

Two Digital Air Data Computer Systems

Windshield Wipers for each Pilot

ILS Receiver and display for each Pilot

Flight Mode Annunciator for each Pilot

Two ADIRU's in NAV mode.

Two sources of electrical power. (The APU generator may be used as an independent power source.)

Both Engines Operating

GO - AR0UND

When go-around is initiated the autothrottle system (if engaged) advances the thrust levers automatically.

Flaps and landing gear must be controlled manually.

An Autothrottle, Flight Director and/or Dual Autopilot go-around may be initiated below a radio altitude of

2000 feet by pressing the go-around switches.

When a decision is made to abort an approach, actuate the go-around switches and assure rotation to go-around

attitude. Verify thrust lever movement to achieve a nominal rate of climb* and retract flaps to flaps 15.**

After a positive rate of climb has been established, retract landing gear. Climb to a safe altitude, accelerate and retract

remaining flaps according to takeoff flap retraction speed schedule. Monitor rate of climb, attitude, and airspeed.

Full go-around thrust may be obtained, after engine spool up, by reactivating the go-around switch(es).

In windshear, the recommended procedure is to delay flap and gear retraction until windshear is no

longer a factor.

FAA APPROVED (Date) Section 3 Page ___

AC 120-28D

07/13/99 Appendix 7

Page 1

APPENDIX 7

STANDARD OPERATIONS SPECIFICATIONS

1. General. This appendix provides samples of standard operations specifications (OpSpecs) provisions

typically issued for operations described in this AC. Standard OpSpecs are developed by FAA Flight Standards

Service, Washington D.C., and are issued by certificate holding district offices (CHDO’s) to each specific

operator. Certificate Holding District Offices incorporate any necessary specific information applicable to that

operator, to that operator's fleet of aircraft, or to that operator's specific operational environment or

requirements (e.g., areas of operation).

OpSpecs specify limitations, conditions, and other provisions which operators must comply with to comply

with the FAR. Standard OpSpecs are normally coordinated with industry prior to issuance to ensure a mutual

and clear understanding of content and applicability, and to pre-determine the effect they may have on

operations. After appropriate coordination new standard provisions, or amendments to existing provisions are

incorporated into the FAA's computer based OpSpecs program used by field offices.

Use of standard OpSpecs provisions facilitates application of equivalent safety criteria for various operators,

aircraft types and operating environments. Occasionally, it may be necessary to issue OpSpecs provisions that

are non-standard because of unique situations not otherwise addressed by standard provisions. Non-standard

OpSpec provisions may be more or less restrictive than standard provisions, depending on the circumstances

necessary to show appropriate safety for the intended application. Nonstandard OpSpecs provisions typically

should not be contrary to the provisions of standard paragraphs. In cases when a non-standard paragraph is

more or less restrictive than a standard paragraph, appropriate justification must be provided.

The following Part A and Part C Standard OpSpecs paragraphs are provided:

2. A002 Definitions and Abbreviations

3. C051 Terminal Instrument Procedures

4. C055 Alternate Airport IFR Weather Minimums

5. C056 IFR Standard Takeoff Minimums, Part 121 Airplane Operations -- All Airports

6. C060 Category III Instrument Approach and Landing Operations

7. C078 IFR Lower Than Standard Takeoff Minimums
AC 120-28D

Appendix 7 07/13/99

Page 2

2. DEFINITIONS AND ABBREVIATIONS.

Sample operations specifications paragraph A002:

FAR 121 Operations Specifications - PART A

A002. Definitions and Abbreviations HQ Control: 03/27/97

HQ Revision: 010

Unless otherwise defined in these operations specifications, all words, phrases, definitions, and abbreviations

have identical meanings to those used in the Federal Aviation Act of 1958, as amended. Additionally, the

definitions listed below are applicable to operations conducted in accordance with these operations

specifications.

(1) Instrument Approach Categories are defined as follows:

Category I An instrument approach and landing with a decision altitude(height) or minimum

descent altitude(height) not lower than 60m (200 ft) and with either a visibility not less

than 800m (2400 ft), or a runway visual range not less than 550m (1800 ft).

Category II A precision instrument approach and landing with a decision height lower than 60m

(200 ft) but not lower than 30m (100 ft) and a runway visual range not less than 350m

(1200 ft).

Category IIIa A precision instrument approach and landing with a decision height lower than 30m

(100 ft), or no decision height and a runway visual range not less than 200m (700 ft).

Category IIIb A precision instrument approach and landing with a decision height lower than 15m (50

ft), or no decision height and a runway visual range less than 200m (700 ft) but not less

than 50m (150 ft).

Category IIIc A precision instrument approach and landing with no decision height and no runway

visual range limitations.

(2) Other related definitions are as follows:

Certificate Holder. In these operations specifications the term "certificate holder" shall mean the holder of the

certificate described in Part A paragraph A001 and any of its officers, employees, or agents used in the conduct

of operations under these operations specifications.

Class I Navigation. Class I navigation is any en route flight operation or portion of an operation that is

conducted entirely within the designated Operational Service Volumes (or ICAO equivalent) of ICAO standard

airway navigation facilities (VOR, VOR/DME, NDB). Class I navigation also includes en route flight

operations over routes designated with an "MEA GAP" (or ICAO equivalent). En route flight operations

conducted within these areas are defined as "Class I navigation" operations irrespective of the navigation means

used. Class I navigation includes operations within these areas using pilotage or any other means of navigation

which does not rely on the use of VOR, VOR/DME, or NDB.

Class II Navigation. Class II navigation is any en route flight operation which is not defined as Class I

navigation. Class II navigation is any en route flight operation or portion of an en route operation irrespective
AC 120-28D

07/13/99 Appendix 7

Page 3

of the means of navigation) which takes place outside (beyond) the designated Operational Service Volume (or

ICAO equivalents) of ICAO standard airway navigation facilities (VOR, VOR/DME, NDB). However, Class II

navigation does not include en route flight operations over routes designated with an "MEA GAP" (or ICAO

equivalent).

Operational Service Volume. The Operational Service Volume is that volume of airspace surrounding a

NAVAID which is available for operational use and within which a signal of usable strength exists and where

that signal is not operationally limited by co-channel interference. Operational Service Volume includes all of

the following:

(1) The officially designated Standard Service Volume excluding any portion of the Standard Service Volume

which has been restricted.

(2) The Expanded Service Volume.

(3) Within the United States, any published instrument flight procedure (victor or jet airway, SID, STARS,

SIAPS, or instrument departure).

(4) Outside the United States, any designated signal coverage or published instrument flight procedure

equivalent to U.S. standards.

Reliable Fix. A "reliable fix" means station passage of a VOR, VORTAC, or NDB. A reliable fix also

includes a VOR/DME fix, an NDB/DME fix, a VOR intersection, an NDB intersection, and a VOR/NDB

intersection provided course guidance is available from one of the facilities and the fix lies within the

designated operational service volumes of both facilities which define the fix.

Runway. In these operations specifications the term "runway" in the case of land airports, water airports and

heliports, and helipads shall mean that portion of the surface intended for the takeoff and landing of land

airplanes, seaplanes, or rotorcraft, as appropriate.

Navigation Facilities. Navigation facilities are those ICAO Standard Navigation Aids (VOR, VOR/DME,

and/or NDB) which are used to establish the en route airway structure within the sovereign airspace of ICAO

member states. These facilities are also used to establish the degree of navigation accuracy required for air

traffic separation service and Class I navigation within that airspace.

Planned Re-dispatch or Re-release En Route. The term "planned re-dispatch or re-release en route" means any

flag operation (or any supplemental operation that includes a departure or arrival point outside the 48 contiguous

United States and the District of Columbia) that is planned before takeoff to be re-dispatched or re-released

inflight in accordance with section 121.631(c) to a destination airport other than the destination airport specified

in the original dispatch or release.
AC 120-28D

Appendix 7 07/13/99

Page 4

3. TERMINAL INSTRUMENT PROCEDURES.

Sample operations specifications paragraph C051:

C051, Terminal Instrument Procedures.

a. The certificate holder is authorized to conduct terminal instrument operations using the procedures and

minimums specified in these operations specifications, provided one of the following conditions is met:

(1) The terminal instrument procedure used is prescribed by these operations specifications.

(2) The terminal instrument procedure used is prescribed by Title 14 Code of Federal Regulations (CFR)

Part 97, Standard Instrument Approach Procedures.

(3) At U.S. military airports, the terminal instrument procedure used is prescribed by the U.S. military

agency operating the airport.

b. If Applicable, Special Limitations, and Provisions for Instrument Approaches at Foreign Airports.

(1) At authorized foreign airports, the terminal instrument procedure used is prescribed or approved by the

government of an ICAO contracting State. The terminal instrument procedure must meet criteria equivalent

to that specified in either the United States Standard for Terminal Instrument Procedures (TERPS) or ICAO

Document 8168-OPS, Procedures for Air Navigation Services-Aircraft Operations (PANS-OPS), volume II,

or Joint Aviation Authorities (JAR-OPS1).

(2) Terminal instrument procedures may be developed and used by the certificate holder for any foreign

airport, provided the certificate holder makes a determination that each procedure developed is equivalent

to U.S. TERPS, ICAO PANS-OPS, or JAR-OPS1 criteria and submits to the FAA a copy of the terminal

instrument procedure with supporting documentation.

(3) At foreign airports, the certificate holder shall not conduct terminal instrument procedures

determined by the FAA to be "not authorized for United States air carrier use." In these cases, the

certificate holder may develop and use a terminal instrument procedure provided the certificate holder

makes a determination that each procedure developed is equivalent to U.S. TERPS, ICAO PANS-OPS, or

JAR-OPS1 criteria and submits to the FAA a copy of the terminal instrument procedure with supporting

documentation.

(4) When operating at foreign airports where the metric system is used and the minimums are specified

only in meters, the certificate holder shall use the metric operational equivalents in the following table for

both takeoff and landing operations. This table converts commonly used RVR values appropriate to

existing operational approvals. Values not shown may be interpolated.
AC 120-28D

07/13/99 Appendix 7

Page 5

RVR METEOROLOGICAL VISIBILITY

FEET METERS STATUTE MILES METERS NAUTICAL MILES

300 ft 75 m 1/4 sm 400 m 1/4 nm

400 ft 125 m 3/8 sm 600m 3/8 nm

500 ft 150 m 1/2 sm 800 m 1/2 nm

600 ft 175 m 5/8 sm 1000 m 5/8 nm

700 ft 200 m 3/4 sm 1200 m 7/10 nm

1000 ft 300 m 7/8 sm 1400 m 7/8 nm

1200 ft 350 m 1 sm 1600 m 9/10 nm

1600 ft 500 m 1 1/8 sm 1800 m 1 1/8 nm

1800 ft 550 m 1 1/4 sm 2000 m 1 1/10 nm

2000 ft 600 m 1 1/2 sm 2400 m 1 3/10 nm

2100 ft 650 m 1 3/4 sm 2800 m 1 1/2 nm

2400 ft 750 m 2 sm 3200 m 1 3/4 nm

3000 ft 1000 m 2 1/4 sm 3600 m 2 nm

4000 ft 1200 m 2 1/2 sm 4000 m 2 2/10 nm

4500 ft 1400 m 2 3/4 sm 4400 m 2 4/10 nm

5000 ft 1500 m 3 sm 4800 m 2 6/10 nm

6000 ft 1800 m 

(5) When operating at foreign airports where the landing minimums are specified only in RVR and

meteorological visibility is provided, the certificate holder shall convert meteorological visibility to RVR

by multiplying the reported visibility by the appropriate factor, shown in the following table.

[equivalent RVR to be used for minima = (reported meteorological visibility) x (factor from table

below)]

AVAILABLE LIGHTING DAY NIGHT

High Intensity approach and

runway lighting

1.5 2.0

Any type of lighting installation

other than above

1.0 1.5

No lighting 1.0 N/A

NOTE: The conversion of reported Meteorological Visibility to RVR shall not be used for takeoff

minima, Category II or III minima, or when a reported RVR is available.
AC 120-28D

Appendix 7 07/13/99

Page 6

4. ALTERNATE AIRPORT IFR WEATHER MINIMUMS

Sample operations specifications paragraph C055:

___________________________________________________________________________________

U.S. Department

of Transportation

Federal Aviation Operations Specification Form Approved

Administration OMB No. 2120-00028

____________________________________________________________________________________

C055. Alternate Airport IFR Weather Minimums. The certificate holder is authorized to derive

alternate airport weather minimums from the following table. In no case shall the certificate holder use

an alternate airport weather minimum other than any applicable minimum derived from this table. In

determining alternate airport weather minimums, the certificate holder shall not use any published

instrument approach procedure which specifies that alternate airport weather minimums are not

authorized. Credit for alternate minima based Category II or Category III capability is predicated on

authorization for engine inoperative Category III operations for the certificate holder, aircraft type and

flightcrew for the respective Category II or Category III minima applicable to the alternate airport.

Alternate Airport IFR Weather Minimums

Approach Facility

Configuration Ceiling Visibility

(no change from existing

provisions)

(no change from existing

provisions)

(additional provision added to

paragraph C55)

For airports with a published

Category II or Category III

approach, and at least two

operational navigational facilities,

each providing a straight-in

precision approach procedure to

different, suitable runways.

For Category II procedures, a

ceiling of at least 300' HAT, or,

For Category III procedures, a

ceiling of at least 200' HAT.

For Category II procedures, a

visibility of at least RVR4000

or,

For Category III procedures, a

visibility of at least RVR1800.
AC 120-28D

07/13/99 Appendix 7

Page 7

5. IFR TAKEOFF MINIMUMS, PART 121 AIRPLANE OPERATIONS - ALL AIRPORTS

Sample operations specifications paragraph C056:

C056. IFR Takeoff Minimums, Part 121 Airplane Operations -

All

Control: 10/05/90

Airports Revision: 011

Standard takeoff minimums are defined as 1 statute mile visibility or RVR 5000 for airplanes having 2

engines or less and 1/2 statute mile visibility or RVR 2400 for airplanes having more than 2 engines.

RVR reports, when available for a particular runway, shall be used for all takeoff operations on that

runway. All takeoff operations, based on RVR, must use RVR reports from the locations along the

runway specified in this paragraph.

a. When a takeoff minimum is not published, the certificate holder may use the applicable standard

takeoff minimum and any lower than standard takeoff minimums authorized by these operations

specifications. When standard takeoff minimums or greater are used, the Touchdown Zone RVR report,

if available, is controlling.

b. When a published takeoff minimum is greater than the applicable standard takeoff minimum and an

alternate procedure (such as a minimum climb gradient compatible with aircraft capabilities) is not

prescribed, the certificate holder shall not use a takeoff minimum lower than the published minimum.

The Touchdown Zone RVR report, if available, is controlling.
AC 120-28D

Appendix 7 07/13/99

Page 8

6. CATEGORY III INSTRUMENT APPROACH AND LANDING OPERATIONS

Sample Operations Specifications Paragraph C060:

C060, Category III Instrument Approach and Landing Operations.

The certificate holder is authorized to conduct Category III instrument approach and landing operations to

the airports and runways listed in subparagraph g. using the procedures and minimums specified in this

paragraph and shall conduct no other Category III operations.

a. Category III Approach and Landing Minimums. The certificate holder is authorized to use the

following Category III landing minimums for the aircraft listed below at authorized airports and runways,

provided the special limitations in subparagraph g are met. These minimums are the lowest authorized at

any airport.

1. Category III Fail-Passive Operations

Airplane M/M/S DH Lowest Authorized RVR

************************************************************************

2. Category III Fail-Operational Operations

Airplane M/M/S DH/AH Lowest Authorized RVR

**********************************************************************

b. Required Category III Airborne Equipment. The flight instruments, radio navigation equipment, and

other airborne systems required by the applicable Section of the Code of Federal Regulations (CFR) must

be installed and operational for Category III operations at or above RVR 600. The additional airborne

equipment listed or referenced in the following table is also required and must be operational for

Category III operations below RVR600.

Airplane

M/M/S

Additional Equip.

& Special Provisions

c. Required RVR Reporting Equipment. The certificate holder shall not conduct any Category III

operation unless the following RVR reporting systems are installed and operational for the runway of

intended landing.

(1) For Category III landing minimums as low as RVR600 (175 meters), the Touchdown Zone, Mid, and

Rollout RVR reporting systems are required and must be used. Touchdown Zone and Mid RVR reports

are controlling for all operations. The Rollout report provides advisory information to pilots.

(2) For Category III landing minimums below RVR600 (175 meters) using fail-passive rollout control

systems, the Touchdown Zone, Mid, and Rollout RVR reporting systems are required and must be used.

All three RVR reports are controlling for all operations.
AC 120-28D

07/13/99 Appendix 7

Page 9

(3) For Category III landing minimums below RVR600 (175 meters) using fail-operational rollout

control systems, the Touchdown Zone, Mid, and Rollout RVR reporting systems are normally required

and are controlling for all operations. If one of these RVR reporting systems is temporarily inoperative,

these operations may be initiated and continue using the two remaining RVR reporting systems. Both

RVR reports are controlling.

d. Pilot Qualifications. A pilot-in-command shall not conduct Category III operations in any airplane

until that pilot has successfully completed the certificate holder's approved Category III training program,

and has been certified as being qualified for Category III operations by one of the certificate holder's

check airmen properly qualified for Category III operations or an FAA inspector. Pilots in command

who have not met the requirements of Section 121.652 shall use high minimum pilot landing minima not

less than RVR1800.

e. Operating Limitations. The certificate holder shall not begin the final approach segment of an

instrument approach procedure, unless the latest reported controlling RVR for the landing runway is at or

above the minimums authorized for the operation being conducted. If the aircraft is established on the

final approach segment and the controlling RVR is reported to decrease below the authorized minimums,

the approach may be continued to the AH/DH applicable to the operation being conducted. Unless all of

the following conditions are met, the certificate holder shall not begin the final approach segment of a

Category III instrument approach:

(1) The airborne equipment required by subparagraph b. is operating satisfactorily.

(2) All required elements of the Category III ground system, except sequence flashing lights, are in

normal operation. A precision or surveillance radar fix, a NDB, VOR, DME fix, its published Waypoint,

or a published minimum GSIA fix, may be used in lieu of an outer marker.

(3) All Category III operations using minimums below RVR600 shall be conducted to runways which

provide direct access to taxi routings equipped with serviceable taxiway centerline lighting which meets

U.S. or ICAO criteria for Category III operations.

(4) The crosswind component on the landing runway is 15 knots or less.

(5) The runway field length requirements, the special operational equipment requirements, and the special

limitations listed or referenced in the following table are met. If required runway field length factors are

listed in this table, the required field length is established by multiplying these factors by the runway field

length required by the provisions of Section 121.195(b) or 14 CFR Part 135, Section 135.385(b), as

appropriate.

Airplane

Make/Model/Seri

es

Category III Required Field Length Special Operational Equipment

 or Special Limitations

RVR not less

than RVR700

RVR600 RVR less

than RVR600

f. Missed Approach Requirements.
AC 120-28D

Appendix 7 07/13/99

Page 10

(1) For Category III approaches with a fail-passive landing system a missed approach shall be initiated

when any of the following conditions exist:

(a) At the DH, if the pilot has not identified the required visual references with the touch down zone or

touch down zone lights to verify that the aircraft will touch down in the touch down zone.

(b) At or before the DH, if the controlling RVR is reported below the lowest RVR authorized for fail

passive operations.

(c) If, after passing the DH, visual reference is lost or a reduction in visual reference occurs which

prevents the pilot from continuing to verify that the aircraft will touch down in the touch down zone.

(d) When a failure in the fail-passive flight control system occurs prior to touch down.

(e) If the pilot determines that touch down cannot be safely accomplished within the touch down zone.

(f) When any of the required elements of the ground system becomes inoperative before arriving at DH.

(g) The crosswind component at touchdown is expected to be greater than 15 knots.

(2) For Category III approaches with a fail-operational landing and rollout control system, a missed

approach shall be initiated at or before AH when any of the following conditions exist:

(a) A failure occurs in one of the redundant systems in the aircraft before reaching the AH.

(b) Any of the required elements of the ground system becomes inoperative. However, Category III

approaches and landings may be continued even though the sequence flashers and the approach lights

became inoperative.

(c) The crosswind component at touchdown is expected to be greater than 15 knots.

(3) The preceding subparagraphs f.(1) and (2) do not preclude continuation of a higher minimum

Category approach if the system failures do not affect the systems required for the higher approach

minimums.

g. Authorized Category III Airports and Runways. The certificate holder is authorized to conduct

Category III operations at the airports and runways listed in the following table.

Airport Ident Runways Special Limitations
AC 120-28D

07/13/99 Appendix 7

Page 11

7. IFR LOWER THAN STANDARD TAKEOFF MINIMUMS,

14 CFR PART 121 AIRPLANE OPERATIONS - ALL AIRPORTS.

Sample Operations Specifications Paragraph C078:

IFR Lower Than Standard Takeoff Minimums, 14 CFR Part 121 Airplane Operations - All

Airports.

Standard takeoff minimums are defined in paragraph C056 of these operations specifications. The

certificate holder is authorized to use lower than standard takeoff minimums under the following

provisions and limitations. Runway visual range (RVR) reports, when available for a particular runway,

shall be used for all takeoff operations on that runway. All takeoff operations, based on RVR, must use

RVR reports from the locations along the runway specified in this paragraph.

a. When takeoff minimums are equal to or less than the applicable standard takeoff minimum, the

certificate holder is authorized to use the lower than standard takeoff minimums described below:

(1) Visibility or runway visual value (RVV) 1/4 statute mile or touchdown zone RVR 1600, provided at

least one of the following visual aids is available. The touchdown zone RVR report, if available, is

controlling. The mid RVR report may be substituted for the touchdown zone RVR report if the

touchdown zone RVR report is not available.

(a) Operative high intensity runway lights (HIRL).

(b) Operative runway centerline lights (CL).

(c) Runway centerline marking (RCLM).

(d) In circumstances when none of the above visual aids are available, visibility or RVV 1/4 statute mile

may still be used, provided other runway markings or runway lighting provide pilots with adequate visual

reference to continuously identify the takeoff surface and maintain directional control throughout the

takeoff run.

(2) Touchdown zone RVR 1000 (beginning of takeoff run) and rollout RVR 1000, provided all of the

following visual aids and RVR equipment are available.

(a) Operative runway centerline lights (CL).

(b) Two operative RVR reporting systems serving the runway to be used, both of which are required and

controlling. A mid-RVR report may be substituted for either a touchdown zone RVR report if a

touchdown zone report is not available or a rollout RVR report if a rollout RVR report is not available.

(3) Touchdown zone RVR 500 (beginning of takeoff run), mid RVR 500, and rollout RVR 500, provided

all of the following visual aids and RVR equipment are available.

(a) Operative runway centerline lights (CL).

(b) Runway centerline markings (RCLM).

(c) Operative touchdown zone and rollout RVR reporting systems serving the runway to be used, both of

which are controlling, or three RVR reporting systems serving the runway to be used, all of which are

controlling. However, if one of the three RVR reporting systems has failed, a takeoff is authorized,

provided the remaining two RVR values are at or above the appropriate takeoff minimum as listed in this

subparagraph.

b. At foreign airports which have runway lighting systems equivalent to U.S. standards, takeoff is

authorized with a reported touchdown zone RVR of 150 meters, mid RVR of 150 meters, and rollout
AC 120-28D

Appendix 7 07/13/99

Page 12

RVR of 150 meters. At those airports where it has been determined that the runway lighting system is

not equivalent to U.S. standards, the minimums in subparagraphs a(1) or (2), as appropriate, apply.

c. In circumstances when the touchdown zone RVR reporting system has failed, is inaccurate, or is not

available, the certificate holder is authorized to substitute pilot assessment of equivalent RVR for any

touchdown zone RVR report required by this operations specification paragraph provided that:

(1) The pilot has completed the approved training addressing pilot procedures to be used for visibility

assessment in lieu of RVR, and

(2) Runway markings or runway lighting is available to provide adequate visual reference for the

assessment.

d. Additional provisions for takeoff guidance systems--all airports, if applicable. Not withstanding the

lower than standard takeoff minimums specified in subparagraph a of this operations specification, the

certificate holder is authorized to use the takeoff minimums specified for the aircraft and airports listed in

this subparagraph provided the special provisions and conditions described below are met. The

certificate holder shall conduct no other takeoffs using these takeoff minimums.

(1) Special provisions and limitations.

(a) Operative runway centerline lights (CL)

(b) Operative high intensity runway lights (HIRL)

(c) Serviceable runway centerline markings (RCLM)

(d) Front course guidance from the localizer must be available and used (if applicable to guidance

systems used)

(e) The reported crosswind component shall not exceed 10 knots.

(f) Operative touchdown zone, and rollout RVR reporting systems serving the runway to be used, both of

which are controlling, or three RVR reporting systems serving the runway to be used, all of which are

controlling. However, if one of the three RVR reporting systems has failed, a takeoff is authorized,

provided the remaining two RVR values are at or above the appropriate takeoff minimum as listed in this

subparagraph.

(g) The pilot-in-command and the second-in-command have completed the certificate holders approved

training program for these operations.

(h) All operations using these minimums shall be conducted to runways which provide direct access to

taxi routings which are equipped with: operative taxiway centerline lighting which meets U.S. or ICAO

criteria for Category III operations; or other taxiway guidance systems approved for these operations.

(2) Authorized airplanes using takeoff guidance systems--all airports. The certificate holder is

authorized to use the following takeoff minimums for the airplanes listed below. (if subparagraph d is not

authorized, use N/A in the Airplane M/M/S column):

Airplane M/M/S Lowest Authorized RVR Required Takeoff Guidance System
AC 120-28D

07/13/99 Appendix 8

Page 1

APPENDIX 8

IRREGULAR TERRAIN ASSESSMENT

The following information describes the operational evaluation process, procedures, and criteria applicable

to approval of flight guidance systems (e.g., autoland or “pilot-in-the-loop” manual flight guidance

systems) to support Category III procedures and minima at airports identified in the FAA Order 8400.8 and

“Category II/III Status List” as having irregular underlying approach terrain.

Background. FAA type design approval of flight guidance systems provides for generic performance

evaluation of autoland capability or “pilot-in-the-loop” manual flight guidance capability through

simulation with reference terrain conditions, and flight testing at a few particular locations. This is to

verify suitability of the design analysis. When an aircraft is type certificated (or STC'd) for use of a

flight guidance systems, it is not the intent, nor is it practical that each model of aircraft, flight guidance

system, radar altimeter type, NAVAID receiver type, etc., be tested at each conceivable location that it

could potentially be used in operation, domestic and foreign. Additionally, NAVAID performance itself

(e.g., ILS system) may vary somewhat from location to location or time to time due to different ATS

critical area protection procedures to assure NAVAID performance (e.g., to minimize reflective

interference). While type design certification by FAA, and frequent flight inspection by FAA or foreign

authorities, addresses generic system performance, specific operational review and approval of particular

aircraft type/site autoland performance is necessary when minima are predicated on use of autoland or

other manual flight guidance system (e.g., head-up- display (HUD)) use. This is especially important at

airports with irregular pre-threshold terrain (e.g., cliffs, valleys, sea walls) in the area of final approach,

within approximately 1500 ft. of the landing threshold.

At typical airports/runways that are not considered to be "special terrain" (e.g., those not restricted by

FAA Order 8400.8 and the CAT II/III Status List) the review and approval process usually consists of

verifying the operator’s report of performance for a small number of "line landings" using the flight

guidance system in weather conditions better than those requiring use of Cat II or lower minima. This is

true whether the review and approval is for a new operator or aircraft type at a particular runway, or is

for a “follow-on” operator or aircraft type starting service at a runway previously found suitable for a

particular type aircraft and system. If the review and approval is for a "special terrain" runway,

particularly for a first of an aircraft type or system to base Category II or Category III minima on using a

particular flight guidance system at that runway, then a specific evaluation including an operational

demonstration is generally necessary.

This paper describes the general evaluation process, procedures, and criteria to be applied for such cases.

Since circumstances often are unique in assessing aircraft/ flight guidance system/site performance, this

summary represents an acceptable method. It is not the only method that may be proposed by FAA or an

applicant. Credit may be applied for relevant testing by the manufacturer, for similar airborne systems,

or for performance at similar locations (e.g., subsequent special terrain airport approvals). Certain

aircraft/ flight guidance system combinations may require more extensive testing when an aircraft may

exhibit unique characteristics at a particular runway (e.g., transient Radio Altimeter failure indication due

to disagreement or unlock, inappropriate auto throttle response, inconsistent flare performance).

Accordingly, before establishing test requirements with a manufacturer or operator for special terrain

airports or particular runways, the proposed evaluation plan should be coordinated with AFS-400. This

should be done prior to agreement by the Principal Operations Inspector or Principal Avionics Inspector

with the operator on the testing to be done and data to be collected.
AC 120-28D

Appendix 8 07/13/99

Page 2

Flight Guidance System Evaluation Process At Special Terrain Airports or Runways

That Are Proposed For Category III Procedures Or Minima

A. Case I - First of a Type/Model at Any Special Terrain Airport/Runway.

Case I , First of a Type/Model, applies to the first Special Terrain airport/runway to be approved for a

particular type (e.g., first L1011 autoland approval for irregular terrain at any airport – such as first L1011

use of KSEA Runway 16R, if not otherwise previously approved at KSEA, or any other “Special terrain

airport” such as KCVG, KDEN, or KPIT).

1). Evaluation objective. Assess and verify normal flight guidance system performance from an operational

perspective, and identify miscellaneous factors needed for a safe Cat III operation (e.g., alert height or

decision height identification).

2). Procedure. Perform at least 4 to 6 successful evaluation landings in typical atmospheric conditions

regarding wind and turbulence, using the applicable operational aircraft configuration, with a representative

aircraft from the fleet, (e.g., a typical aircraft maintained using routine maintenance practices, not specially

configured, not specially tested, or otherwise not specially selected from the operator’s fleet). If the flight

guidance system may be susceptible to an uncertain performance characteristic (e.g., long flare in a tailwind

condition, pitch/throttle coupling oscillation during flare) the evaluation should take place when the system

may be put to an appropriate test of the applicable crosswind, tailwind, headwind, wind gradient, or other

critical condition applicable, consistent with the operator’s proposed conditions or limits and the AFM’s

demonstrated conditions or limits.

Confirm the initial assessment of 4 to 6 data recorded evaluation landings, with subsequent successful initial

operational landings (typically the first 25 or more) as reported by the operator (e.g., data recording or other

special observation, other than by the regularly assigned flightcrew, is not required).

3). Evaluator(s). A person qualified to assess flight guidance system function and performance should

conduct these evaluations as the FAA observer (e.g., typically an Category III qualified and experienced

APM of a Category III authorized operator, a qualified AFS-400 representative, a qualified AEG

representative, or an appropriate FAA National Resource Specialist (NRS)). FAA may designate other

suitably qualified representatives to assess flight guidance system function and performance as necessary

(e.g., suitably qualified check airman, fleet manager, FAA DER).

4). FGS Performance/Data Recording. Generally, some form of quantitative data should be recorded and

reviewed as verification of performance. Methods used in the past include, but are not limited to either

method a, or method b, or method c below or any combination:

a) Method A - Data Recording and Observation. Record pertinent flight guidance system performance

data using a DFDR or a Quick reference recorder, or equivalent, which has ability to record the parameters

shown below. The recording should be at a sufficiently high sample rate (e.g., at a rate > 1 sample per

second), for the part of the flight path of interest (typically from 300’HAT through de-rotation after

touchdown).

 barometric altitude

 radio altitude

 radio altitude rate (h dot)
AC 120-28D

07/13/99 Appendix 8

Page 3

 glide slope error

 vertical speed

 elevator command

 pitch attitude

 throttle position

 airspeed

 Mode transition or engagement

Manual observations may be made for touchdown point (lateral, longitudinal), wind profile from 1000 ft. to

surface (e.g., from an INS or IRS that is capable of displaying winds at typical approach speeds).

b) Method B - Review of Manufacturer’s Data. A review of the manufacturer’s data from flight

guidance system development flight testing at the same special terrain runway, or equivalent, may be used to

confirm items shown in 5) below.

c) Method C - Photo recording. Photo recording of pertinent instruments or instruments and outside

view, with a video camera or equivalent, allowing post flight replay and review of indications noted in

Method A above.

5) Data review and Analysis. The final approach, flare, and touchdown profile should be reviewed to ensure

suitability of at least each of the following.

a) Suitability of the resulting flight path

b) Acceptability of any flight path displacement from the nominal path (e.g., Glide slope deviation,

deviation from nominal flare profile),

c) Proper mode switching

d) Suitable touchdown point,

e) Suitable sink rate at touch down,

f) Proper flare initiation altitude

g) Suitable flare “quality” (e.g., no evidence of early or late flare, no overflare or underflare, no

undue “pitchdown down” tendency at flare initiation or during flare, no flare oscillation, no abrupt flare, no

inappropriate pitch response during flare, no unacceptable floating tendency, or other unacceptable

characteristic that a pilot could interpret as failure or inappropriate response of the flight guidance system

and disconnect, disregard, or contradict the FGS),

h) No unusual flight control displacements (e.g., elevator control input spikes, or oscillations),
AC 120-28D

Appendix 8 07/13/99

Page 4

i) Appropriate throttle retard (e.g., no early or late throttle retard, no failure to retard, no undue

reversal of the retard, no undue pitch/throttle coupling),

j) Appropriate speed decay in flare (e.g., no unusually low speed risking high pitch attitude and tail

strike, no excessive float, appropriate speed decay even if well above Vref at flare initiation due to planned

wind or gust compensation ),

k) Proper mode initiation or mode transition relating to altitude or radio altitude inputs, such as

crosswind alignment initiation, if applicable (e.g., Appropriate radio altitude (RA) trigger of crosswind

alignment, to be sure that an appropriate mode transition occurs, even though underlying approach terrain

may be irregular).

6) Miscellaneous Issues.

a. Determine acceptability of any variable radio altitude (RA) indications. Regarding Alert Height

(AH) or Decision Height (DH) identification, determine the acceptability of any variable radio altitude

(RA) indications or displays (e.g., considering variability due to underlying terrain variability in the last

stage of the approach near Alert Height or Decision height). Assure that display indications are

sufficiently stable and continuous to readily identify or define AH or DH. If an Inner Marker is to be

used to establish Alert Height or Decision Height, determine if the inner marker function is adequate.

b. Address any anomalies occurring during the assessment (e.g., autopilot trip, firm landing, flare

oscillation). Additional testing may be needed to clearly identify and resolve any particular problem

identified.

c. Determine if special training, or other operational constraints are needed to accommodate peculiar

approach or flare characteristics (e.g., require visual reference at flare initiation, apply a 50 ft. DH).

d. Authorization for use should occur only after repeated successful landings have been

demonstrated and any anomalies experienced have been resolved.

B. Case II - Subsequent Special Terrain Airport/Runway Authorization for a Particular Type.

Case II addresses the “First of a Model” at a particular runway, but at a subsequent “Special Terrain

Airport” runway (e.g., After an aircraft type has already been successfully demonstrated at some special

terrain airport runway – such as the first ever B767 type FGS use at KPIT Rwy 28L, after prior approval

at KSEA).

1) Evaluation objective. Same as Case I

2) Procedure. Same as Case I.

3) Evaluator(s). Same as Case I.

4) FGS Performance/Data Recording - Data recording is not generally required. However, if the results

of landings are marginal or unacceptable, the data recording and assessment procedures applicable to

Case I may be needed to assess any remedial action required.

5) Data review and Analysis. Same as Case I.

6) Miscellaneous Issues. Same as Case I.
AC 120-28D

07/13/99 Appendix 8

Page 5

C. Case III - Subsequent Operator Use of a Particular Special Terrain Airport/Runway and Type

Combination.

A Certificate Holding District Office (CHDO) (e.g., POI, PAI, APM) may review a request for an

operator to use a particular Special Terrain Airport/runway and aircraft type, and with AFS concurrence,

approve subsequent airline operation of a particular type at that special terrain airport/runway. Any

authorization should be based on 25 or more successful "line" landings reported by the operator

requesting authorization in weather conditions not requiring credit for FGS system use. The experience

reported by operator should include no unsuccessful landing attempts or failures. If problems or failures

are reported, then Case II or Case I procedures may be needed to resolve potential unique aircraft

configuration effects, procedural effects, maintenance effects, or other effects.

D. Case IV – “Not-For-Credit” Use of Special Terrain Airport/Runway and Type Combinations.

“Not-For-Credit” use of “Special Terrain Airport/Runway and Type Combinations” applies to operators

desiring to use an FGS (e.g., Autoland or Flight Guidance HUD) at a Special Terrain Airport/Runway,

but not for any landing minima credit.

In this instance, a representative of the CHDO may evaluate the use during first line operations or specify

that an operator representative (e.g., technical pilot, qualified management pilot, or check airman who is

experienced with flight guidance system operation and performance) assess and verify adequate flight

guidance system performance. This assessment should be completed prior to initiating routine operational

use of the flight guidance system to touchdown at each “Special Terrain” runway. It is desirable, but not

necessary, that a qualified APM, or equivalent, witness each "special terrain airport" evaluation.

The CHDO should request and review flight guidance system reports from line crews for at least the first 5

line landings to confirm appropriate performance. If problems occur, processes for cases I through IV may

be needed to resolve problems depending on the severity and cause of problem (e.g., maintenance problem,

unusual winds, lack of ATS critical area protection, problem with a modification to the FGS, use of a

different associated component, such as substitution of a different and incompatible radar altimeter model).

A “Not-For-Credit” evaluation may be done in line operation as long as no previous reported problems have

been noted with the same or similar aircraft type, and no NOTAM’s or other restrictions preclude such

operations. If problems have been reported for the same or similar type, treatment as Case I through III, as

applicable above, may be appropriate.

NOTE: Unless otherwise restricted by an operator or CHDO, flight guidance

system operations “Not-for-Minima-Credit” may generally be conducted on any

ILS runway that does not have a restricting note on the approach plate (e.g.,

localizer unusable for rollout, glideslope unusable below xxx ft. AGL) and that has

an adequate glide slope threshold clearance height (TCH) suitable for the aircraft

type). If problems are noted in the operator’s evaluation, the operator should

specify that flight guidance system use should not be accomplished at that site to

touchdown. This may be done through a flightcrew bulletin or equivalent.

Conversely, an operator may publish a list of runways approved for flight

guidance system use to touchdown, or through rollout.

AC 120-28D

07/13/99 Appendix 9

Page 1

APPENDIX 9

TAKEOFF SYSTEM PERFORMANCE AFTER LIFTOFF

Takeoff system operation should be continuous and smooth through transition from the runway portion

of the takeoff to the airborne portion and reconfiguration for en route climb. The criteria found in this

paragraph is not unique to low visibility takeoff systems, but such systems must meet these requirements

in addition to those found in Section 6.1.1 of Appendix 2. The pilot must be able to continue the use of

the same primary display(s) for the airborne portion as for the runway portion. Changes in guidance

modes and display formats must be automatic.

a) If the probability of the takeoff system presenting misleading guidance to the pilot is not

Extremely Improbable, it must be shown that loss of the airplane will not occur if the takeoff system

presents misleading guidance, whether caused by performance anomaly or malfunction. Compliance

with this requirement can be demonstrated by showing that the display of misleading guidance

information is Improbable when the flightcrew is alerted to the condition by:

• suitable annunciation means, or

• by information from other independent sources (e.g., primary flight references) available

within the pilot's primary eye-scan area.

NOTE: For takeoff systems using a Head Up Display (HUD) to present takeoff guidance,

the head down instrument panel is typically not within the pilot's primary eye-scan area.

Thus, annunciations displayed in locations near the HUD field of view, such as the glare

shield, may be found suitable, if they are clear, conspicuous and unambiguous to the pilot

while focused on using the HUD.

b) The display of misleading guidance for takeoff shall be Extremely Improbable if no alternate

means are available to detect the malfunction or to assess alternate sources of the guidance information,

or if the transition to an alternate means of guidance is impractical.

c) The vertical axis guidance of the takeoff system during normal operation shall result in the

appropriate pitch attitude, and climb speed for the airplane considering the following factors.

Normal rate rotation of the airplane to the commanded pitch attitude, at VR-10 knots for all engines and

VR-5 knots for engine out, will not result in a tail-strike.

The system should provide commands that lead the airplane to smoothly acquire a pitch attitude that

results in capture and tracking of the All-Engine Takeoff Climb Speed, V2 + X. X is the All-Engine Speed

Additive from the AFM (normally 10 knots or higher). If pitch limited conditions are encountered, a

higher climb airspeed may be used to achieve the required takeoff path without exceeding the pitch limit.

d) For engine-out operation, the system should provide commands that lead the airplane to smoothly

acquire a pitch attitude that results in capture and tracking of the following reference speeds:

V2, for engine failure at or below V2. This speed should be attained by the time the airplane has

reached 35 ft. altitude.

Airspeed at engine failure, for failures between V2 and V2 + X.
AC 120-28D

Appendix 9 07/13/99

Page 2

V2 + X, for failures at or above V2 + X. Alternatively, the airspeed at engine failure may be used,

provided it has been shown that the minimum takeoff climb gradient can still be achieved at that speed.

e) The loss of an electrical source (e.g., as a result of engine failure) shall not result in the guidance

to either pilot being removed.

f) The flightcrew should be clearly advised that takeoff guidance is unusable when the system does

not provide guidance appropriate to the takeoff phase of flight. In the case of the split-cue flight director,

the guidance command associated with the inappropriate information shall be removed from view. In the

case of the single-cue flight director, the guidance cue shall be removed.