(h) Software traps (for example, divide by zero, un-implemented instruction, specific software interrupt instructions, unrecognized instruction, and recursion termination).
(i) Hold-up commands (such as, performance hedges).
(4) As a minimum, when evaluating space properties, the following items should be considered to demonstrate those functions either have no effect or that their effect is acceptable based on the identified safety parameters:
(a) Loss, corruption, or delay of input or output data (memory aspects).
(b) Memory overflow.
(c) Corruption of internal data (for example, direct or indirect memory writes, table overrun, incorrect linking, calculations involving time, or corrupted cache memory).
(d) Memory mapping errors.
(e) Program overlays.
(f) Buffer sequence.
(g) External device interaction (for example, loss of data, delayed data, incorrect data, or protocol halts).
(h) Control flow defects (space aspects) (for example, incorrect branching into a partition or protected area, corruption of a jump table, corruption of the processor sequence control, corruption of return addresses, or unrecoverable hardware state corruption).
(i) Partition address violations.
e. S oftware Reuse. IMA systems frequently implement reusable software. If software is reused, the following items should be assured:
(1) The software life cycle data being considered for reuse has not changed since its previous approval.
(2) The required software level of the software application(s) is equal to, or less than, the software level of the previous approval.
(3) The range and data type of inputs to the configuration item are equivalent to its approved predecessor.
(4) The configuration item being reused is resident on the same target computer and used in the same way operationally as it was for the previous approval.
(5) Equivalent software/hardware integration testing and system testing were conducted on the target computer and system as in the previous approval.
(6) Software life cycle data have been shown to have no adverse effect on (1) the original systems safety margins and (2) the original operational capability, unless accompanied by a justifiable increase in safety. If software life cycle data intended for reuse adversely affect safety or exceed a pre-approved range of data, parameters, or equipment performance characteristics, then it will not be approved for reuse. The software life cycle data would require design approval under the applicable paragraph of 14 CFR.
(7) All open problem reports and in-service problems associated with the software to be reused should be analyzed to ensure that there are no safety or operational issues.
13. ELECTRONIC HARDWARE GUIDANCE. If the IMA system contains electronic devices whose functions cannot feasibly be evaluated by test and/or analysis, the electronic devices should comply with RTCA/DO-254, or other acceptable means of compliance, as agreed to by the cognizant ACO.
14. IMA DESIGN GUIDANCE.
a. Electrical Power for IMA Systems.
(1) IMA cabinet or rack installations should show compliance with XX.1357 (where XX may be 14 CFR parts 23, 25, 27, or 29) or provide supporting data to justify an equivalent level of safety finding. For part 25 aircraft, circuits that do not directly comply with 25.1357(e) may be acceptable if the failure effects are minor.
(2) Design of the physical architecture should support the ability to manage smoke or fire without losing functions whose loss is catastrophic.
(3) The IMA cabinet or rack should not be powered with circuit protection features that are under control of that IMA cabinet or rack.
(4) If redundant IMA hardware elements are used to provide functions, individual nonresettable fuses or circuit breakers may be provided for each IMA hardware element. The applicant should provide supporting data in the aircraft-level SSA to verify that operation of the circuit device does not cause a loss of a function. The applicant must provide an analysis to demonstrate appropriate availability in compliance with XX.1309 (where XX may be 23, 25, 27, or 29) to justify an equivalent level of safety finding.
b. Recovery Features. IMA systems should be designed to provide capabilities to initiate recovery of functions whose loss is catastrophic. IMA systems should be designed to avoid the need for crew-initiated recovery features. If crew-initiated recovery features are implemented, protective mechanisms and operational procedures should be in place to prevent accidental Page 21
activation of the recovery feature. Effects of recovery feature activation in normal and failed conditions must be evaluated for all phases of flight.
c. Built-In Test (BIT). BIT features are recommended to limit exposure time to latent failures. If pilot-initiated BIT features are provided, there should be provisions (for example, interlocks) to prevent interference with control functions (for example, flight controls, autopilots, and engine controls). Activation of BIT features intended only for ground operations should be inhibited during flight.
d. Mai ntenance Diagnostics. It is recommended that the IMA system provide means to detect and record failures of hardware elements and to isolate these failures to the IMA hardware module that has failed in order to facilitate maintenance of the IMA system. Procedures for isolating the problems to the module-level are recommended. Activation of maintenance diagnostic software intended for ground operations should be inhibited during flight.
e. Failure Detection and Annunciation. Failures that affect functions provided by the IMA system should be detected and annunciated to the flight crew with alerting and indication means for warning, caution, or advisory information appropriate for the failure effects.
f. F unctional Partitioning. It is recommended that IMA systems that integrate multiple functions within a single processor implement partitioning among functions to reduce complexity and provide fault containment. This is recommended even if all of the software is developed to the same software level.
g. F unctional Isolation. To enable continued use of the working IMA functions in the event of a failed function, it is recommended that IMA systems that integrate multiple functions incorporate a means that allows the failed function(s) to become disabled while other working functions remain operational.
h. Int entional Transmitters. Intentional transmitters should not be installed in TSO-C153 authorized racks or cabinets.
i. Visual and Aural Alerting. Because of the integrated nature of IMA systems, the visual and aural alerting systems must be carefully designed and evaluated. For example:
(1) The presentation of visual and aural alerts should be prioritized (including addressing simultaneous alerts).
(2) A means should be provided to disable nuisance and distracting aural and visual alerts. There should be an annunciation to the flight crew that the alerts have been disabled, until they are rearmed.
(3) The visual and aural alerts should be included as part of the human factors and flight crew interface evaluations.
15. ENVIRONMENTAL QUALIFICATION GUIDANCE.
a. Appendix 1 of TSO-C153 lists environmental qualification tests (EQT) that should be performed to satisfy the TSO. The TSO EQTs are performed according to procedures and category levels defined in RTCA/DO-160D (Change 2). The category levels tested should be selected, as appropriate, for the aircraft installation and environment. The EQTs performed as part of TSO-C153 should be applicable to the functional TSO environmental qualification and may be applied to the aircraft TC, STC, ATC, or ASTC environment qualification. Figure 15-1 lists the RTCA/DO-160D environmental tests that can be accomplished under TSO-C153 authorization and how they may affect functional TSO authorization or aircraft installation approval.
Figure 15-1. RTCA/DO-160D Environmental Qualification Requirements
RTCA/ DO-160D Section # RTCA/DO-160D Section Title TSO-C153 Requirement Functional TSO or Aircraft Installation Requirement 4 Temperature and Altitude – Temperature Not tested Yes 4 Temperature and Altitude – Altitude Yes Yes, TSO-C153 qualification data may be used by similarity 5 Temperature Variation Not tested Yes 6 Humidity Yes Yes, TSO-C153 qualification data may be used by similarity 7 Operational Shock and Crash Safety – Operational Shock Not tested Yes 7 Operational Shock and Crash Safety – Crash Safety Yes Yes, TSO-C153 qualification data may be used by similarity 8 Vibration Not tested Yes 9 Explosion-proofness Yes, if appropriate Yes, TSO-C153 qualification data may be used by similarity 10 Waterproofness Yes, if appropriate Yes, TSO-C153 qualification data may be used by similarity 11 Fluid Susceptibility Yes, if appropriate Yes, TSO-C153 qualification data may be used by similarity 12 Sand and Dust Yes, if appropriate Yes, TSO-C153 qualification data may be used by similarity 13 Fungus Resistance Yes, if appropriate Yes, TSO-C153 qualification data may be used by similarity 14 Salt Spray Yes, if appropriate Yes, TSO-C153 qualification data may be used by similarity 15 Magnetic Effect Yes Yes, TSO-C153 qualification data may be used by similarity 16 Power Input Not tested Yes 17 Voltage Spike Yes Yes, TSO-C153 qualification data may be used by similarity 18 Audio Susceptibility – Power Inputs Yes Yes, TSO-C153 qualification d b d b ii li Page 23
RTCA/ DO-160D Section # RTCA/DO-160D Section Title TSO-C153 Requirement Functional TSO or Aircraft Installation Requirement data may be used by similarity 19 Induced Signal Susceptibility Not tested Yes 20 Radio Frequency Susceptibility Not tested Yes 21 Emissions of Radio Frequency Energy Not tested Yes 22 Lightning-Induced Transient Susceptibility Not tested Yes 23 Lightning Direct Effects Not tested Yes 24 Icing Yes Yes, TSO-C153 qualification data may be used by similarity 25 Electrostatic Discharge Yes Yes, TSO-C153 qualification data may be used by similarity
NOTE: RTCA/DO-160D, Sections 20 and 22 may require more testing at aircraft installation (see section 17c(4) and (5) of this AC).
b. Certain EQTs cannot be appropriately performed on the hardware elements as part of the TSO-C153. Those EQTs can only be appropriately performed when the IMA system and hardware elements are arranged in the configuration specified for the applicable aircraft, as defined for the aircraft TC, STC, ATC, or ASTC. Also, those EQTs can only be appropriately performed with the functional software components installed and operating. Therefore, certain RTCA/DO-160D EQTs are excluded from the TSO-C153. These EQTs must then be addressed as part of the functional TSO compliance, or as part of the TC/STC/ATC/ASTC environmental qualification. These tests are described below:
(1) The EQT for temperature (RTCA/DO-160D, Section 4) and temperature variation (RTCA/DO-160D, Section 5) should be performed with the cabinet or rack and modules in the hardware configuration intended for the functional TSO authorization or the TC/STC/ATC/ASTC approval. For temperature and temperature variation tests performed for the functional TSO or TC/STC/ATC/ASTC, the hardware module arrangement should represent the expected worst-case temperature conditions. As an alternate approach, the functional TSO or TC/STC/ATC/ASTC applicant may perform engineering analysis of the thermal characteristics of the expected cabinet or rack and module configuration variations to determine temperature test parameters that exceed the worst-case expected temperature conditions. These temperature test parameters could be used instead of the standard RTCA/DO-160D, Sections 4 and 5 temperature conditions.
(2) The EQT for operational shock (RTCA/DO-160D, Section 7) and vibration (RTCA/DO-160D, Section 8) should be performed with all cabinet or rack module positions (slots) occupied in the hardware configuration specified for the functional TSO or TC/STC/ATC/ASTC installation. An alternate approach would be to perform an engineering analysis of the characteristics of the expected cabinet or rack and module configurations to determine vibration and operational shock test parameters that exceed the worst expected Page 24
conditions. These test parameters could be used instead of the standard RTCA/DO-160D, Sections 7 and 8 conditions.
(3) The EQT for induced transients (RTCA/DO-160D, Section 19), Radio Frequency (RF) susceptibility (RTCA/DO-160D, Section 20), RF emissions (RTCA/DO-160D, Section 21), and lightning-induced transients (RTCA/DO-160D, Section 22) are most appropriately performed with the hardware elements and software components loaded and active in the IMA system. This is because the response of the system may be highly dependent on the hardware element position and software component configuration. Therefore, these EQTs should be performed as part of the functional TSO compliance or as part of the TC/STC/ATC/ASTC environmental qualification.
(4) IMA systems should have lightning and HIRF protection EQTs performed with the hardware elements and software components loaded in the configuration specified for the applicable aircraft, per the lightning regulations and ACs and the HIRF policy. The interface wiring and connected equipment must be representative of the wiring and connected equipment intended to be installed in the aircraft.
c. The EQT performed for a single functional TSO authorization or aircraft TC/STC/ATC/ASTC may be used to support other applications for functional TSOs or aircraft TC/STC/ATC/ASTCs with similar configurations. The TSO applicant may use similarity assessment and worst-case test conditions to minimize the EQTs required for subsequent functional TSO applications or aircraft TC/STC/ATC/ASTC. Use of the environmental qualification data should be accompanied by a rational and accurate engineering analysis of the differences between hardware element and software component load configurations used during the original environmental tests and the proposed new configuration. The engineering analysis may consider the worst-case environmental limits developed above.
d. The functional TSO qualification data sheet should state explicitly the RTCA/DO-160D test categories and tests that are performed in the functional TSO configuration and the test categories and tests that are performed in the TSO-C153 configuration. This information should also be included in the installation instructions.
e. Hardware elements and software components providing a function that does not have an applicable functional TSO must meet the TC/STC/ATC/ASTC environmental requirements.
f. All hardware elements must be evaluated prior to installation to ensure that the TC/STC/ATC/ASTC environmental qualification requirements have been satisfied.
16. HUMAN FACTORS AND FLIGHT CREW INTERFACE GUIDANCE.
a. Human Factors Background.
(1) This section provides guidance to identify and, in some cases, resolve human factors and flight crew interface issues of IMA systems. It addresses issues with the design of Page 25
TSO-C153 hardware elements and the installation and integration of such elements into the aircraft. The installation and integration of an end-state, fully integrated IMA system is also addressed in this section.
(2) Because IMA systems contain many unique issues, applicants should develop a plan early in the program to address human factors and flight crew interface issues. The plan should document how issues will be identified, tracked, and resolved throughout the life cycle of the program. Typically, this information is documented through either a Human Factors Certification Plan or through a general certification plan in which the human factors components are identified.
(3) FAA Policy Statement PS-ANM100-2003-01-03, Factors to Consider When Reviewing an Applicant’s Proposed Human Factors Methods of Compliance for Flight Deck Certification, provides guidance on factors to consider when reviewing an applicant’s proposed method of compliance identified in a Human Factors Certification Plan or general certification plan. FAA Policy Statement PS-ANM111-1999-99-2, Guidance for Reviewing Certification Plans to Address Human Factors for Certification of Transport Airplane Flight Decks, provides guidance for reviewing the human factors components of the certification plan for Transport Category Airplanes, as well as what should be included in these plans. While these policy statements are tailored for part 25, much of the guidance is general and may prove useful for any aircraft type. Potential human factors and flight crew interface issues for all aircraft types are discussed below, as well as guidance related to finding compliance with the related regulations.
b. Potential Human Factors and Flight Crew Interface Issues with IMA Systems.
(1) Displays and associated flight deck controls typically pose the greatest challenges for human factors and flight crew interfaces in IMA systems. This section addresses the most common issues, but does not comprehensively address all potential human factors and flight crew interface issues with an IMA system. IMA systems have many novel aspects; therefore, new issues arise with each project.
(2) Guidance in this section is intended to supplement the previously published material (as listed in section 2 of this AC) and provide awareness of the issues that applicants should consider. Thus, where relevant regulatory or advisory materials exist, they are referenced, and where none exists the issue is noted along with a recommended resolution path, where one has been established.
(3) E lectronic Checklists.
(a) In the past, electronic checklists were passive; that is, they only monitored system status and then allowed check-off (either manually or automatically) of the item when it was accomplished by the flight crew. In order to address the workload and task timeline issues with integration of utility system controls (including fuel, electrical, pneumatic, air conditioning, and pressurization), the applicant may use electronic checklists. These allow the flight crew to click on the checklist item (to call up the system synoptic display), move the cursor to the Page 26
synoptic display, and position the cursor on required control function on that display. One good aspect of this approach is a reduction in errors associated with selecting the wrong control.
However, a significant potential human factors and flight crew interface issue is system awareness, because overloaded or complacent pilots may adopt a “click, click, click, … checklist complete” habit and lose awareness of the consequences of the individual items. This is even more significant because of the small amount of display area that may have been reserved for the checklist (which may result in little room for expanded explanations of procedure steps).
(b) The FAA’s Flight Standard Service normally handles the post-TC approval of user-modifiable checklists without the need of a design change. However, it is recommended that checklists that interact with aircraft systems not be user-modifiable, because they may require design changes to other aircraft systems and additional human factors evaluations.
(c) Automatic control of aircraft functions through the electronic checklist is not recommended.
(4) Accessibility of Functions.
(a) As more and more functions are being controlled using multi-purpose controls (such as, Cursor Control Device (CCD) or Multifunction Control and Display Unit (MCDU)), the flight crew must step through more menus to access functions that had previously been immediately accessible using dedicated controls. For example, applicants may propose to use the CCD to control all radios (with the MCDU as a backup). This may take several steps to do something that previously took only one control action (such as, turning a single knob). While some shortcuts have been developed for on-side radios, there can still be more steps than required for conventional radio control panels.
(b) Quick access to various functions can be an important issue, considering that many other functions may be performed using the CCDs and other multifunction controls.
(c) Increased sharing of the MCDU may also cause problems. For example, an applicant design may propose to use the MCDU as the control and display device for the solidstate circuit breakers. This would require time-sharing with all of the other functions (for example, Flight Management System, datalink, display of maintenance data, backup tuning of communication/navigation radios, and so forth) that currently are hosted on the MCDUs.
(d) It is important to evaluate this decrease in accessibility across all flight deck functions, in addition to evaluating it on a case-by-case basis. The cumulative effects on workload, task timelines, interference across functions, and flight crew coordination may be significant.
(5) Cu rsor-Based Controls.
(a) Controls used in IMA systems pose a number of potential human factors and flight crew interface issues. Specifically, a variety of cursor-based controls may be used with Page 27
“point-and-click” graphical user interfaces for certain flight crew functions. Examples of cursorbased control technologies include touch-pads, joysticks, force-sensitive two-axis buttons (similar to those embedded in some laptop computer keyboards), and trackballs. A number of cursor-based control issues to be addressed are included below:
1. Numerous Functions. A number of functions are likely to be controlled by these cursor-based control devices, presenting the possibility of flight crew interface “choke points.” Rather than simply reaching for different discrete controls as needed, the flight crew may have to repeatedly work their way through menus in order to use the cursor-based control to perform various control functions.
2. Performance-in-Motion Environments. A related issue that needs to be evaluated when determining the acceptability of a cursor-based control is performance-inexpected motion environments. This may be especially problematic using cursor-based controls to navigate through multiple nested menus, during time-critical activities, in turbulence, or when tasks are interrupted (for example, by Air Traffic Control).
3. Control Labeling. Title 14 CFR § 25.1555(a) states the following: “Each cockpit control, other than primary flight controls and controls whose function is obvious, must be plainly marked as to its function and method of operation” (parts 23, 27, and 29 contain similar requirements). IMA system designs may use multifunction control devices that perform different functions under various conditions. Examples include cursor-based controls, multifunction rotary knobs (associated with the cursor-based controls), multifunction keyboards, and MCDUs. These controls perform a variety of functions, depending on the context. In the case of cursor-based control devices, part of the control function, including the labeling, actually exists on the display (the cursor and the selectable items).
a. The flight crew must be able to quickly identify which function is currently active for cursor-based control functions. This means that the current location of the cursor should be easily identifiable, without searching the displays.
b. In some designs, certain of these controls are labeled (on the display) with icons (symbols) in lieu of text. While a limited number of control functions may have icons associated with them that one could reasonably assume the pilot could recognize, most functions may have no universally accepted icons. Therefore, the association between the icons and the controlled function will require flight crew training and memorization. The use of such icons in lieu of text should be kept to a minimum.
4. Cursor-Based Control Failures. Several types of cursor-based control failures need to be considered. One is the failure of a single cursor-based control, which may disrupt the normal flow of flight crew tasks. The tasks on the flight deck are normally allocated based on which pilot is flying the aircraft. As tasks are performed, some will be accomplished by the Pilot-Flying, while others will be accomplished by the Pilot-Not-Flying. With the failure of one cursor-based control, there may be significant disruption in flight crew activities for the following two reasons:
a. In some designs, the pilot with a failed cursor-based control will be unable to use the other pilot’s cursor-based control. In this case, flight crew procedures can be disrupted. For example, tasks that are normally allocated to the Pilot-Flying or Pilot-Not-Flying may need to be done by the flight crew with the remaining functional cursor-based control, regardless of who is flying.
b. Even if the remaining cursor-based control is usable by both pilots, it may be required by both pilots simultaneously. With some implementations, loss of both cursorbased controls can render significant numbers of important functions unavailable.
5. Replacement of Discrete Control Panels:
a. In some configurations, the IMA system and associated cursor-based controls (in conjunction with synoptic (schematic) system displays and electronic checklists) can be used to control a wide variety of functions. Those include fuel, electrical, pneumatic, air conditioning, pressurization, communication and navigation radios, and display systems. In such cases, many discrete or dedicated control panels may be eliminated. Pilots will “point and click” to bring up menus, select icons that represent system components (for example, valves, pumps, generators, and radios), and change system states. Significant human factors issues include workload, time to complete functions, system status awareness, and crew coordination. For example, with a conventionally designed flight deck, the flight crew could turn off a hydraulic pump by simply reaching up to the overhead panel and pushing a button. To do the same thing using an integrated CCD or IMA system that replaces the overhead panel, the flight crew may have to perform many more individual actions.
b. This sequence of individual actions is likely to take significantly longer than it would on a conventional design. This may also cause more difficulty in manipulating different systems in a sequence, particularly if the system requires the flight crew to navigate through various menus. Furthermore, these selections would be accomplished by very small finger motions on the cursor-based control, which are more likely to go unnoticed by the other flight crewmember, especially if cursor-based control activity is very routine and the selections occur on a multifunction display that is displaced to one side of the flight deck. Thus, the other flight crewmember might not know that the status of the system has changed. Additionally, the flight crew may spend significantly more time “heads-down” while manipulating the cursorbased control and navigating the menu selections than they would if using a single dedicated control.
c. For IMA systems, applicants should present criteria and rationale to justify which functions will retain discrete or dedicated controls, and which ones will not.
d. Another consideration is the splitting of controls for a system. For a given system, a few of its controls may be in the overhead panel while the rest will be operated by the CCD. In conventional designs, there will typically be a control panel or area of the overhead panel devoted to each major system. In that way, for example, all controls for the Page 29
electrical system will be grouped together. However, when some controls are moved from the discrete or dedicated control panels, some of the system’s controls may now be accessed by the CCD and main displays, while other controls for that same system may remain in the overhead panel. For example, most electrical system controls (such as bus switching) would be controlled by the CCD, while the generator drive disconnect switches are likely to stay in the overhead panel due, in part, to the irreversible nature of the control. Thus, the flight crew would have to go to different locations for various electrical system controls. This scattering of system controls may result in flight crew confusion in critical, high workload/stress failure scenarios.
Compliance with 14 CFR § XX.777a should be shown (where XX may be 23, 25, 27, or 29).
c. Testing Considerations for Human Factors and Flight Crew Interface Issues.
Cursor-based control evaluations should include scenarios involving manual flight, emergencies, multiple failures, turbulence, vibration from sustained engine imbalance (blade-out), and so forth. Scenarios should involve testing of all cursor-based control functionality, including when the flight crew might use the cursor-based control to select displays, position the cursor, select from menus, and navigate through menu trees to access control functions (see also section 17 of this AC for testing considerations). Testing the acceptability of the IMA cursor-based control system should focus on each of the issues discussed in the section above, as well as on determining compliance with the regulations, as partially discussed in the following section.
d. Methods of Compliance with Controls Regulations.
(1) Policy Statement PS-ANM111-1999-99-2 contains an appendix with a list of regulations typically associated with human factors and flight crew interface issues. It is important to check that the IMA system as a whole, as well as to check that the individual components, comply with these and other applicable regulations. It is recommended that an IMA system applicant develop a Human Factors Certification Plan that will provide the certification office a structured approach to show how compliance will be determined with each of the applicable regulations (that is, test, analysis, and simulation). The certification plan should be organized to show the relationship between the specific human factors requirements and the method of compliance. Methods of compliance must be evaluated for the following regulations:
14 CFR §§ XX.771(a), XX.771(e), XX.777(a), XX.1523, XX.1555(a), XX.1301(a), XX.1309(b), XX.1309(d) (where XX may be 23, 25, 27, or 29). A subset of these are discussed below with emphasis on part 25, but must also be evaluated for parts 23, 27, and 29 (as appropriate):
(a) To comply with 14 CFR §§ 25.777(a) and 25.1523, the applicant must show that the flight crew can conveniently access required controls in all expected flight scenarios, without unacceptable disruption of aircraft control, crew task performance, and Crew Resource Management. Since not all possible scenarios can be evaluated, the applicant should develop a set of worst-case scenarios for evaluation, along with proposed methods for evaluation (such as, analysis, test, and demonstration). Comparison to conventional controls is considered an important aspect of this evaluation, in order to determine if the use of cursor-based controls results in an increase in flight crew workload or task timelines. The evaluation plan should show how each of the factors identified in 14 CFR part 25, Appendix D will be evaluated. Operation of the cursor-based control with both the dominant and non-dominant hand should be included in Page 30
the evaluations. Additionally, experience has shown that control-display response lag (time delay between movement of the control and response of the cursor) and control gain characteristics can be critical in the acceptability of a cursor-based control. Therefore, usability testing should accurately replicate the response lag and control gain characteristics that will be present in the actual aircraft.
(b) To show compliance with 14 CFR § 25.771(e), the applicant should show by test and/or demonstration in representative motion environment(s) that the cursor-based control is acceptable for controlling all functions that the flight crew will access using the cursor-based control during these conditions. In addition to turbulence, vibration due to the loss of a fan blade and the subsequent damage to other rotating parts of the fan and engine must be considered in the definition of the motion environment.
(c) To show compliance with 14 CFR §§ 25.1309(b) and (d), the applicant must conduct an aircraft-level safety assessment to determine the hazards and failure conditions associated with the failure of one and of both cursor-based controls. Particular attention should be paid to the independence of the two cursor-based controls (that is, vulnerability to commoncause failures), and to the combined effects of the loss of control of multiple cursor-based systems and functions. The applicant should demonstrate that the failure of either cursor-based control does not unacceptably disrupt operation of the aircraft (that is, the allocation of flight crew tasks) in normal and emergency conditions. The failure condition classifications described in SAE ARP4761 can be used to assess the severity of the effect on the aircraft and on flight crew operations of the loss or malfunction of a single cursor-based control or the loss or malfunction of both cursor-based controls, either by themselves or in combination with other failures. In conducting the safety assessment, the failure conditions that could result in the failure or anomalous behavior of a cursor-based control should include fluid contamination, unless it can be shown that spills of fluids expected to be present in the flight deck (for example, coffee and syrup) will not result in cursor-based control failure or anomalous behavior, or in degraded flight crew usability of the cursor-based control. The safety assessment should also include common mode failures such as physical damage, HIRF, lightning, fire, and electrical faults.
(d) To show compliance with 14 CFR § 25.1555(a), the following should be demonstrated:
1. That pilots are able to quickly and reliably identify what item on the display is “active” as a result of cursor positioning, as well as what that function will perform, if the item is selected using the selector buttons and/or changed using the multifunction knob.
2. That pilots will correctly identify and select the control functions, at a speed and error-rate that is equivalent to or better than that of controls that are labeled with text formats. The data required to substantiate that the speed and error rate is equivalent need not be objective data; the applicant may collect subjective data from test subjects to show that the design meets this standard.