曝光臺 注意防騙 網曝天貓店富美金盛家居專營店坑蒙拐騙欺詐消費者

early stages of landing, most of the responsibility for assuring that the above objective is not exceeded is vested in the pilot.
In Category III operations, the same objective is required but must now be inherent in the whole system. In this context it is
of the utmost importance to endeavour to achieve the highest level of integrity and continuity of service of the ground
equipment. Integrity is needed to ensure that an aircraft on approach will have a low probability of receiving false guidance;
continuity of service is needed to ensure that an aircraft in the final stages of approach will have a low probability of being
deprived of a guidance signal.
11.1.4 It is seen that various operational requirements correspond to varied objectives of integrity and continuity of
service. Table G-15 identifies and describes four levels of integrity and continuity of service that are applicable for basic
procedures where DME is not a critical element.
11.2 Achievement and retention of integrity and continuity of service levels
11.2.1 An integrity failure can occur if radiation of a signal which is outside specified tolerances or which is incorrect
(in the case of digital data) is either unrecognized by the monitoring equipment or the control circuits fail to remove the
faulty signal. Such a failure might constitute a hazard if it results in a gross error.
23/11/06 ATT G-30
Attachment G Annex 10 — Aeronautical Communications
11.2.2 Clearly not all integrity failures are hazardous in all phases of the approach. For example, during the critical
stages of the approach, undetected failures producing significant path following error (PFE) are of special significance
whereas an undetected loss of clearance or identification signals would not necessarily produce a hazardous situation. The
criterion in assessing which failure modes are relevant must however include all those deleterious fault conditions which are
not unquestionably obvious to the automatic flight system or pilot.
11.2.3 It is especially important that monitors be designed to provide fail-safe operation through compliance with the
Standards of Chapter 3, 3.11.5.2.3 and 3.11.5.3.3. This often requires a rigorous design analysis. Monitor failures otherwise
may permit the radiation of erroneous signals. Some of the possible conditions which might constitute a hazard in operational
performance Categories II and III are:
a) an undetected fault causing a significant increase in PFE as seen by an approaching aircraft;
b) an undetected error in the minimum glide path, transmitted in basic data word 2;
c) an undetected error in the TDM synchronization resulting in overlap; and
d) loss of power that increases CMN to unacceptable limits.
11.2.4 The highest order of protection is required against the risk of undetected failures in the monitoring and
associated control system. This would be achieved by careful design to reduce the probability of such occurrences to a low
level and by carrying out periodic checks on the monitor system performance at intervals which are determined by the design
analysis. Such an analysis can be used to calculate the level of integrity of the system in any one landing. The following
formula can be applied to certain types of MLS and provides an example of the determination of system integrity, I, from a
calculation of the probability of transmission of undetected erroneous radiation, P.
I = 1 – P
2
1 2 1 2
P T
M M
=
α α
Where:
I = integrity;
P = the probability of a concurrent failure in transmitter and monitor systems resulting in undetected erroneous radiation;
M1 = transmitter mean time between failure (MTBF)
M2 = MTBF of the monitoring and associated control system;
1
1
α
= ratio of the rate of failure in the transmitter resulting in the radiation of an erroneous signal to the rate of all
transmitter failures;
2
1
α
= ratio of the rate of failure in the monitoring and associated control system resulting in inability to detect an
erroneous signal to the rate of all monitoring and associated control system failures; and
T = period of time (in hours) between checks on the monitoring and associated control system.
ATT G-31 23/11/06
Annex 10 — Aeronautical Communications Volume I
This example formula would be applicable to a non-redundant monitor design in which a single value of T applies to all
elements of the monitoring and associated control system.
11.2.5 With regard to integrity, since the probability of occurrence of an unsafe failure within the monitoring or
control equipment is extremely remote, to establish the required integrity level with a high degree of confidence would
necessitate an evaluation period many times that needed to establish the equipment MTBF. Such a protracted period is
　
中國航空網 www.k6050.com
航空翻譯 www.aviation.cn
本文鏈接地址：附件10--航空電信an10_v1_6ed下(137)