(2) The vertical guidance presentation should be compatible with the aircraft’s flight instrumentation such that the pilot is continuously furnished the aircraft’s vertical deviation with respect to the pre-programmed ascent/descent or level flight profile.
(3) Scale change for the final approach must be done in a manner that supports operational suitability for transitioning onto the final approach segment.
(4) Baro VNAV systems using angular vertical scaling must meet the following:
(a) The deviation scaling supports the FTE monitoring and bounding (75 ft deviation below path).
Note: This may require limiting the length of the approach to exclude operating where the angular deviations no longer support FTE monitoring and bounding.
(b) The deviation limits are equivalent to the operational limits for glideslope deviations during an ILS approach.
f. Alert Indications.
Alert indications for the system should be located on or near the vertical path deviation indicator and should provide a readily discernible annunciation to the pilot(s) for any of the following:
(1) Inadequate or invalid navigation signals or sources;
(2) Absence of primary power;
(3) Inadequate or invalid navigation displays or output sources; and
(4) Equipment failures.
Note: These failure/status indications must occur independently of any operator action. Power or navigation equipment failures may be indicated in a common manner.
In the approach mode, the lack of adequate navigation signals or sources will be annunciated by means of a flag displayed on the primary vertical navigation display. In other modes, an appropriately located annunciator may be used.
g. Additional Constraints.
(1) The baro-VNAV equipment should indicate the aircraft vertical path position to the accuracy specified in paragraph 11-2.b within five seconds after any maneuvering or changes in attitude encountered in normal operations.
(2) The system should be capable of providing navigation guidance to the accuracy specified in paragraph 11-2.b within 20 seconds after input of the desired vertical track information (assuming sensor outputs are available).
(3) Navigation guidance should be available within five seconds of waypoint data input.
(4) The equipment should have the capability to meet the criteria outlined in paragraph 11-2 throughout the range of environmental conditions that will be encountered in actual service. Exposing the equipment to the environmental test conditions of TSO-C115b (or later revision) may be used to demonstrate this capability. The environmental test conditions contained in RTCA/DO-160F may be used to demonstrate this ability for baro-VNAV systems certified independent of a multi-sensor RNAV system.
Note: Previously certified baro-VNAV systems may have used an earlier RTCA/DO-160 revision. This equipment may still be installed within the provisions of its original certification.
(5) The equipment should provide a means for the flight crew to determine system status prior to flight.
(6) The equipment should provide the navigation accuracy specified in paragraph
11-2.b for all groundspeeds up to a maximum value, and for all ascent (if applicable) and descent rates up to a maximum value to be set by the applicant.
(7) The equipment should provide a means to alert the flight crew prior to arrival at a waypoint for anticipating necessary vertical maneuvering. This indication should be located on or near the vertical path indicator. A procedural means based on a continuous and properly located distance to waypoint display may be used for vertical maneuver anticipation for baro-VNAV equipment that is not coupled to a FD or autopilot.
(a) Systems that provide steering signals for FDs or autopilots should provide automatic vertical maneuver anticipation and a waypoint alert that occurs prior to the initiation of the vertical maneuver. Systems that are coupled to the automatic guidance/control system(s) should not cause the aircraft to depart an assigned altitude until the impending altitude change is indicated to the crew within the pilot’s primary field of view, then acknowledged by timely crew action unless the system is mechanized to the altitude selector in such a manner that a transition to descent or climb will not occur unless the altitude selector has been reset by the flight crew to the new altitude.
(b) Acceptance of the acknowledgment should not precede the indication if this acknowledgement is stored by the equipment. The acknowledgement timing of an impending vertical path change depends on operational procedures and aircraft/equipment design;
however, past practice has shown that this acknowledgment should not occur more than five minutes prior to the impending vertical path change.
(8) If parallel offset track capability is provided, waypoint alerting and vertical maneuver anticipation should be provided prior to arrival at the point where the offset track intersects the angle bisector of the parent track. These functions should operate as described above in paragraph 11-2.d(7).
(9) The equipment should be capable of providing correct vertical path guidance when interfaced with lateral navigation equipment providing turn anticipation. The baro-VNAV equipment should recognize the angle bisector of the lateral track change as the “zero distance to waypoint” location.
h. The software should be verified and validated to at least level C as defined in RTCA/DO-178B or ‘C’ for baro-VNAV equipment that uses a digital computer.
Chapter 12. General Installation Considerations.
12-1. Introduction.
The following information applies to the installation of all positioning and navigation equipment intended for IFR use.
12-2. Failure Classification.
a. From enroute through Category I precision approach, the loss of navigation function is typically considered to be a major failure condition for the aircraft (see AC
25.1309-1, AC 23.1309-1, AC 27-1, or AC 29-2 as applicable). Other aircraft navigation systems should be considered when determining GNSS loss of navigation, which could be major (no other navigation systems) or minor (other applicable navigation systems).
Navigation data is considered to be misleading when un-annunciated position errors exist. For enroute, terminal, LNAV, and LNAV/VNAV approaches, presenting misleading information to the flight crew is considered to be a major failure condition for the aircraft. For LP/LPV and GLS approaches, presenting misleading information to the flight crew is considered to be a hazardous failure condition. These failure classifications are summarized in Table 8.
Advisory Vertical Guidance Enroute/ Terminal Area/ Non-precision Approach (LNAV or RNP
0.3) Non-precision Approach with Vertical Guidance (LNAV/VNAV) LP/LPV Approach GLS Approach Loss of Navigation No Effect Major Major Major Major Misleading Information Minor Major Major Hazardous Hazardous Table 8. Typical Hazard Classifications Note 1: For RNP values less than 0.3, losing RNP capability constitutes loss of navigation. Refer to appendix 2 for further RNP AR airworthiness information and AC 90-101 (latest revision) for complete guidance on RNP AR operations.
Note 2: Baro-VNAV vertical guidance is independent from the lateral guidance. Loss of baro -VNAV guidance during an LNAV/VNAV approach results in a fail-down to LNAV or missed approach. Therefore, loss of navigation for baro-VNAV is considered a minor failure condition.
b. The applicant must conduct a safety assessment of the positioning/navigation equipment installation to verify that design errors and failure modes meet the probability requirements for that failure class. AC 23.1309-1, AC 25.1309-1, AC 27-1, or AC 29-2, per the latest revision levels, provide an acceptable means for showing that the hardware complies with 93
---- pertinent airworthiness requirements. See paragraph 15-2.a for GPS/SBAS and GPS/GBAS retrofit installation guidance related to navigation displays previously approved for ILS.
c. Any probable failure of the positioning/navigation equipment must not degrade or adversely affect the normal operation and performance of other required equipment or create a flight hazard. The interfaces with other aircraft equipment must be designed such that normal or abnormal positioning/navigation equipment operation must not adversely affect the operation of other equipment nor must operation of other equipment adversely affect the positioning/navigation equipment operation.
12-3. Software Considerations.
a. In December 2011, RTCA published RTCA/DO-178C, Software Considerations in Airborne Systems and Equipment Certification. AC 20-115C Airborne Software Assurance, defines an acceptable means of qualifying software and provides guidance for applicants with software qualified to previous RTCA/DO-178 revisions. Applicants may choose to use RTCA/DO-178C instead of RTCA/DO-178B provided they declare their intention to the applicable aircraft certification office for the project.
b. The applicant is encouraged to submit the Plan for Software Aspects of Certification (PSAC) early in the software development process. Early submittal will allow timely resolution of issues such as partitioning and determining software levels. Software certification is normally addressed during the design approval for positioning/navigation equipment, but should be confirmed at installation to ensure the certification level is appropriate for the installation intended function.
Note: It may be possible to obtain approval for navigation functions that have hazardous level effects with FMS software developed to RTCA/DO-178B or ‘C’ level C criteria. AC 20-174, Development of Civil Aircraft and Systems provides an acceptable method for establishing design assurance levels. This guidance may be helpful for navigation architectures containing independent functions.
12-4. Hardware Considerations.
AC 20-152 (latest revision) RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, defines an acceptable means of qualifying complex electronic hardware devices. The applicant is encouraged to submit the Plan for Hardware Aspects of Certification (PHAC) early in the development process. Hardware certification is normally addressed during the design approval for positioning/navigation equipment; but, should be confirmed at installation to ensure the certification level is appropriate for the installation intended function.
12-5. Installed Equipment Compatibility.
There is no one, single, standardized interface for positioning and navigation equipment to other equipment on-board the aircraft such as displays, autopilots, terrain warning, etc.
Positioning and navigation equipment manufacturer’s installation manuals/instructions should define what other equipment is compatible with the positioning and navigation system.
Equipment manufacturers are encouraged to develop compatible equipment lists and/or detailed interface requirements for their installation manuals/instructions. The installer must ensure that other on-board equipment interfaced with the positioning and navigation systems is compatible, and the airworthiness approval holder is ultimately responsible for defining the installation. But the installation burden is greatly eased when equipment manufacturers define compatible systems in their installation manual/instructions, including software version and/or part number if necessary.
12-6. Installation Instructions.
a. The equipment must be installed in accordance with the instructions and limitations provided by the positioning and navigation equipment manufacturer. The airworthiness approval will address any additional installation specifics.
b. Equipment should be installed with separation between wires of redundant equipment (see AC 43.13-1 latest revision). Wire separation will mitigate the possibility of loss of navigation due to a single event. During installation approval of the system, when wire separation cannot be achieved, the following questions must be evaluated and the potential for single event upsets minimized:
(1) Is it possible for a cable harness to be exposed to wire chafing in a manner that both channels fail simultaneously?
(2) Is the cable harness located near flight control cables, high electrical capacity lines or fuel lines?
(3) Is the cable harness located in a protected area of the aircraft (isolated from engine rotor burst)?
(4) Is any electromagnetic interference (EMI) between systems caused by cable routing?
12-7. Equipment Capability and Installed Limitations.
a. Positioning and navigation avionics might have optional TSO functions that are not supported at the aircraft level after installation. The avionics must have the functions inhibited through configuration settings (e.g., strapping, software, etc.) or through database management processes if the aircraft is not qualified to perform those functions. The AFM(S)/RFM(S) must contain an appropriate entry for any limitations. An example to illustrate the point is avionics with the capability to perform RF legs. The installed avionics may have approved RF leg capability, but the aircraft lacks one or more necessary capabilities such as a roll-steering 95
autopilot or displays able to depict RF legs. For this installation, the avionics would need to have the RF leg capability inhibited.
b. Airworthiness approval holders should include a comprehensive PBN statement of capabilities and qualification in the AFM(S)/RFM(S) describing the aircraft’s PBN capabilities and operations limitations as an easy reference for flightcrews and authorities that grant operations approvals (see appendix 5 for an example). Doing so can greatly ease the process for operators that need operations approvals and enhance flightcrew awareness of the aircraft’s PBN capability.
12-8. Final Approach Segment Step-Down Fixes in Navigation Databases.
a. In the U.S. when RNAV (GPS) approach procedures are produced or updated, the procedure designer names the final approach segment (between the final approach fix and missed approach point) step-down fixes applicable to the LNAV and LP lines of minima. But, some previously published RNAV (GPS) approach procedures still contain unnamed final approach segment step-down fixes, meaning there will be a mix of named and unnamed stepdown fixes published with RNAV (GPS) approach procedures until all the procedures receive their periodic update. ARINC 424 specifications provide data elements for encoding both named and unnamed step-down fixes in a navigation database. Including final approach segment step-down fixes in the aircraft’s onboard navigation database is entirely optional.
However, the database must include all named waypoints that make up the instrument approach procedure except for final approach segment step-down fixes. Showing step-down fixes on a vertical profile display can enhance flight crew situation awareness, but can also complicate installation issues (see paragraphs 12-8.b through 12-8.d). Airworthiness approval applicants should contact their ACO early when seeking an approval for equipment with step-down fixes in the onboard navigation database.
Note 1: Final approach segment step-down fixes are commonly used on U.S. RNAV (GPS) approach procedures to support an LP or LNAV line of minima.
Note 2: Pilots are expected to use distance information to comply with step-down fixes when they are not included in the equipment database.
Note 3: ARINC 424 is not specified by any positioning or navigation TSO. Nor is there any TSO requirement to include final approach segment or unnamed step-down fixes prior to the final approach fix in navigation databases for approach procedures.
b. Equipment manufacturers providing final approach segment step-down fixes in their onboard navigation databases for RNAV (GPS) approach procedures must either provide a method to remove them or provide an installation limitation for cockpit configurations that cannot properly support them (i.e., define the requirements in the installation instructions/manual). If removing final approach segment step-down fixes, manufacturers may choose to employ installation-specific configurations (i.e., software, strapping, etc.), or they 96
may offer a navigation database solution (i.e. a database with final approach segment step-down fixes and a database without final approach segment step-down fixes).
c. Many U.S. RNAV (GPS) approach procedures include LNAV, LNAV/VNAV, and LPV lines of minima. However, a final approach segment step-down fix does not apply to the LNAV/VNAV or LPV minima. The airworthiness applicant must ensure the displayed RNAV(GPS) approach is in the primary field of view, in the proper sequence, unambiguous, and does not create detrimental clutter.
Note: For LPV, some ICAO States may prohibit displaying step-down fix information from the onboard navigation database. Navigation system manufacturers should take this into consideration during their navigation system design and airworthiness applicants should consider this during equipment installation.
(1) The cockpit design and layout can greatly influence an airworthiness approval when it comes to displaying final approach segment step-down fixes. Integrating an RNAV (GPS) approach with LNAV/VNAV or LPV capability in an older cockpit design can be challenging when the onboard navigation database includes final approach segment step-down fixes due to limited display capability and little or no labeling flexibility.
(2) When installing equipment with final approach segment step-down fixes in the onboard navigation database, the display integration must:
• Be accessible and readable by all required flight crewmembers;
• Cleary depict and label the aircraft’s track;
• Clearly label displayed waypoints, fixes and numeric information with sufficient detail to enable a pilot to discern a step-down fix from other fixes on a procedure; and,
• Clearly display distance/bearing/track to the landing threshold point/fictitious threshold point (LTP/FTP) during the final approach segment of an LPV approach.
(3) The suggested optimum implementation is showing final approach segment step-down fixes for LNAV and LP approaches, but not showing final approach segment stepdown fixes during an LNAV/VNAV or LPV approach. When displaying distance/bearing/track to a step-down fix on the LPV final approach segment (i.e., after crossing the final approach fix), the equipment must also provide a readily available, clear, unambiguous indication of distance/bearing/track to the LTP/FTP. Due consideration should be given to the cockpit configuration and display capabilities during the airworthiness approval process. Additionally, equipment manufacturers must ensure final approach segment step-down fixes do not interfere with LPV path construction via the FAS datablock.
d. When using any advisory vertical guidance during an approach to LNAV or LP minimums, or when using GPS substitution on a conventional approach procedure, the flight crew must use the primary barometric altimeter to ensure compliance with any altitude restrictions. RNAV(GPS) procedure design criteria puts final approach segment step-down 97
fixes on or below the VNAV path to provide an opportunity for a continuous descent final approach to the landing runway. However, for any approach other than LNAV/VNAV, LPV, or ILS there is no guarantee the VNAV path guidance will always clear the final approach segment step-down fix altitude restriction(s). Therefore, airworthiness applicants must include language for a limitation in the AFM(S)/RFM(S) (or equivalent documentation) requiring the flight crew to use the primary barometric altimeter to comply with a final approach segment step-down fix altitude restriction during an LNAV, LP, or non-ILS conventional approach.
Equipment manufacturers should also include a limitation in the equipment operating instructions or flight crew operating manual.
Note 1: The intent of paragraph 12-8.d is to ensure the flight crew does not rely solely on the advisory VNAV guidance deviations for compliance with a step-down fix altitude restriction. The limitation must make it clear that it is unacceptable to follow VNAV path guidance below a step-down fix altitude restriction.
Note 2: Baro-VNAV systems certified before 11/20/1989 may have been certified to a lesser standard that is not consistent with a major failure condition. Operators of these aircraft should apply the final approach segment step-down fix to the LNAV/VNAV line of minima and should use the primary barometric altimeter to ensure meeting the step-down fix altitude constraint.
12-9. Magnetic Variation Data and Onboard Database.
a. Avionics typically convert true heading references to magnetic heading references by using worldwide magnetic variation data contained in an on-board magnetic variation database and a set of software algorithms. The algorithms convert the data into a specific magnetic heading reference for a specific geographic reference point. However, since the Earth’s magnetic fields constantly change, magnetic variation databases need periodic updates to provide accurate magnetic heading references. The National Oceanic and Atmospheric Administration (NOAA) offers the World Magnetic Model, available at http://www.ngdc.noaa.gov/geomag/geomag.shtml, and this product is an acceptable source for updating an aircraft magnetic variation database. NOAA updates the model on a five-year cycle, and magnetic variation databases should be re-assessed consistent with this cycle to make sure they continue to meet their stated performance.
Note: If the magnetic variation database is not kept current, the navigation systems no longer support their intended functions for use during flights conducted under IFR. Failure to maintain and update the magnetic variation database can result in presentation of misleading magnetic heading references that can place the aircraft outside the terrain and obstacle protection provided in instrument procedure and route designs.
b. Equipment design approval holders should identify any operating limitations in their equipment associated with application of the magnetic variation data (e.g., operations using magnetic heading references may only be valid between 82° north latitude and 82° south latitude) to ensure accurate magnetic heading references are presented and used in the aircraft.
Since the earth’s magnetic field is not static, equipment design approval holders should periodically re-evaluate their performance claims. Appropriate evaluation periods will depend on operating limitations, performance expected, and avionics intended function. The equipment design approval holders should also define a continuing airworthiness requirement to update the magnetic variation database and, if applicable, conversion algorithms or hardware when the periodic updates become available. This requirement should also define the maintenance procedures necessary to update the on-board magnetic variation database for their avionics.
12-10. Environmental Considerations.
a. Most equipment will have been tested by the equipment manufacturer to the environmental categories described in RTCA/DO-160 (applicable revision), with results described in an environmental qualification form. The airworthiness approval applicant must ensure the environmental categories (or criteria) to which the equipment has been tested are compatible with the aircraft environment in which the positioning and navigation equipment is installed. See AC 21-16F (or later revision) RTCA Document DO-160 versions D, E, and F, Environmental Conditions and Test Procedures for Airborne Equipment, for guidance on differences among RTCA/DO-160 versions D, E, and F.
b. For equipment that has not been tested to the environmental categories described in RTCA/DO-160 (applicable revision), either the equipment manufacturer or airworthiness applicant must thoroughly define the intended aircraft environment and conduct comparable normal and abnormal environment testing.
12-11. General Human Factors Considerations.
a. Control Accessibility.
(1) Controls installed for in-flight operation should be readily accessible from the flight crew’s seated position. Only single-hand operation should be required, the controls should be readily identifiable, and the use of controls should not obscure pertinent displays.
(2) The equipment should be designed so that controls intended for use during flight cannot be operated in any position, combination, or sequence that would result in a condition detrimental to the operation of the aircraft or the reliability of the equipment.
(3) Controls should provide feedback (e.g., tactile, visual) when operated.
(4) Control operating force should be appropriate for its intended function.
Note: Low forces might provide insufficient feedback, while high forces might impede intentional rapid use.
(5) Controls should be resistant to inadvertent activation. Common and acceptable means of reducing the likelihood of inadvertent operation through design include the following:
(a) Placing fences between closely spaced adjacent controls.
(b) Concave upper surface of keys to reduce slippage.
(c) Size of control surface sufficient to provide for accurate selection.
(d) Placing guards over controls.
(e) Providing appropriate sensory feedback, or explicit confirmation of activation.
(6) The function for each control should be indicated, unless obvious. Pilots should be able to quickly and accurately determine the function of the control with minimal experience or training. If a control can be used for multiple functions, the current and inactive functions should be distinguishable.
(7) Controls/input devices should be organized according to the following principles, when feasible:
(a) Controls should be organized in logical groups according to function and frequency of use.
(b) Controls should be easily associated with the related elements (e.g., displays and labels) that identify their function. For example, line select function keys should align with adjacent text.
(c) Controls used most frequently should be the most accessible.
(d) Dedicated controls should be used for frequently used functions.
(e) Line select function keys should align with adjacent text.
(8) Use of two or more controls simultaneously (e.g., pushing two buttons at once) in flight should not be required to perform a function.
(9) Controls that do not require adjustment by the flight crew (e.g., maintenance functions) should not be readily accessible to the flight crew.
(10) Controls and their labels should be identifiable during all normally expected ambient light conditions, including direct sunlight and nighttime.
(11) Control identifiers and other information should not be obstructed by the control input devices.
b. Display Visibility.
(1) Each display element, used as a primary flight instrument in the guidance and control of the aircraft, should be located where it is clearly visible to the pilot with the least practicable deviation from the pilot’s normal position and line of vision when looking forward along the flight path (i.e., within the primary optimum field of view).
Note 1: CDI displays contained in the Control Display Unit (CDU) will most likely not be acceptable for IFR operations.
Note 2: FTE can be reduced when numeric display information is integrated with the non-numeric display or is located within the pilot’s primary field of view. Both digital cross-track and track angle error have been shown to reduce FTE. This information should be displayed together (either within the CDU or remotely displayed near the non-numeric display) for better tracking performance.
Using non-numeric cross track data integrated with nonnumeric track angle error data into one display may provide the optimum situation and control information for the best overall tracking performance.
Note 3: The General Aviation Manufacturers Association with FAA collaboration published Publication Number 10 that has recommended guidelines for Part 23 cockpit/flight deck design. Applicants may apply these guidelines for their Part 23 installations. Additional guidance can be found in FAA Human Factors Design Guide.
DOT/FAA/CT-96/1.
(2) The appropriate flight crew member(s) should have an unobstructed view of displayed data when in the seated position.
(3) Connection to external displays (CDI, horizontal situation indicator (HSI), moving map, annunciator panel, etc.) should be consistent with the equipment installation instructions.
(4) The horizontal (and vertical) deviation(s), display(s), and failure annunciations should be located within the pilot's primary field of view, as should any indication requiring immediate aircrew action.
(5) Compliance with limitations in the equipment installation instructions for display readability should be verified.