AC 20-167B CHAPTER 5. SYSTEMS INSTALLATION CONSIDERATIONS
5.1 EVS/EFVS/CVS Installations Considerations.
5.1.1 EVS/EFVS/CVS Pilot Controls and Annunciations.
5.1.1.1 The EVS/EFVS/CVS display controls should be visible to and within reach of the pilot flying from any normal seated position. The position and movement of the controls should not lead to inadvertent operation.
5.1.1.2 The EVS/EFVS/CVS controls, except those located on the pilot’s control inceptor (e.g., control wheel, yoke, stick, etc.), should be adequately illuminated for all normal background lighting conditions and should not create any objectionable reflections on other flight instruments. See §§ 23.2600(a), 25.773, 27.773 and 29.773.
5.1.1.3 There should be a means to manually modulate illumination unless fixed illumination of the EVS/EFVS/CVS controls is shown to be satisfactory under all lighting conditions. See §§ 23.2600(a), 25.773, 27.773 and
29.773.
5.1.1.4 Any modes of EFVS operation should be annunciated on the flightdeck and visible to the flightcrew. The modes of the EFVS operation should be made available to the flight data recorder, in addition to all of the information required by §§ 23.1459, 25.1459, 27.1459, and 29.1459, or by an operational rule that the applicant seeks to show compliance to during certification (e.g. 14 CFR 121.344).
5.1.2 EFVS Fail Safe Features.
The normal operation of the EFVS should not adversely affect or be adversely affected by other normally operating aircraft systems. Under §§ 23.1309, 25.1309, 27.1309,
29.1309, the flightcrew must be alerted through annunciation (or other means of providing warning information) to any detected malfunctions of the EFVS which could cause display of misleading information, and the misleading information should be removed. Alerting annunciations should be displayed to the flightcrew in accordance with AC 23.1311-1C, AC 25.1322-1, AC 25-11B, AC 27-1B CHG 1-9 and AC 29-2C CHG 9, as applicable. Under §§ 23.2500, 23.2505, 25.1309, and 27.1309, the applicant must assess the criticality of the EFVS’s function to display imagery, including the potential to display hazardously misleading information. Likewise, the assessment must include the hazardous effects of any malfunction of the EFVS that could adversely affect interfaced equipment or associated systems. See AC 23-1309-1E, AC 25-11B, and Army Reserve Aviation Command (ARAC)-recommended 25.1309 and Arsenal Guidance, AC 27-1B CHG 1-9 and AC 29-2C CHG 9. This requirement should be met through a system safety assessment (SSA) and documented via fault tree analysis (FTA), failure mode and effects analysis (FMEA), and FMEA substantiation, or equivalent safety documentation.
5-1
AC 20-167B
5.1.3 The electrical system must be able to furnish the required power at the proper voltage for the EVS/CVS. See §§ 23.2525, 25.1310, 27.1351 and 29.1351.
5.1.4 EVS/EFVS/CVS Built-In Test (BIT).
The applicant should provide a BIT capability that, at a minimum, limits the exposure time to latent failures consistent with the exposure limits in the SSA.
5.2 Continued Airworthiness and Maintenance.
5.2.1 Under § 23.1529, 25.1529, 27.1529, and 29.1529, the applicant must develop instructions for continued airworthiness for maintaining the EVS/CVS/EFVS and its components.
5.2.2 Under § 21.50, Instructions for Continued Airworthiness (ICA) must be furnished after final design approval. Refer to FAA Order 8110.54A, Instructions for Continued Airworthiness, for additional guidance on FAA’s procedures for administering ICA requirements.
5.2.3 Other maintenance tasks may be developed as a result of the safety assessment, design reviews, manufacture’s recommendations and Maintenance Steering Group 3 (MSG-3) analyses that are conducted. These instructions include but are not limited to removal and replacement, troubleshooting, cleaning, maintenance procedures for the MEL relief and software loading/configuration control.
5.3 EFVS Environmental Specifications.
Applicants should follow the guidance in AC 21-16G (as revised), and RTCA DO-160 versions D, E, F and G, Environmental Conditions and Test Procedures for Airborne Equipment. Additionally, under §§ 23.2520, 25.1316, 25.13l7, 27.13l7, 29.1316, or
29.1317, or related special conditions, the EFVS must also meet the high-intensity radiated fields (HIRF), electromagnetic interference, and lightning requirements as specified in the certification basis of the aircraft in which the EFVS is to be installed.
5.4 HIRF Considerations for All Installations (EVS, CVS, and EFVS).
Under §§ 23.2520, 25.13l7, 27.13l7, or 29.1317, the immunity of critical avionics/electronics and electrical systems to HIRF must be established. Critical avionics/electronics and electrical system functions are those whose failure would contribute to or cause a failure condition that would prevent the continued safe flight and landing of the aircraft. Refer to AC 20-158A, The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment, for additional guidance.
5-2
AC 20-167B
5.5 Software and Hardware Design Assurance.
5.5.1 Follow the guidance in AC 20-115D, Airborne Software Development Assurance Using EUROCAE ED-12 and RTCA DO-178 to develop software. Use the version which is current at time of application.
5.5.2 Follow the guidance in AC 20-152, RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware, to develop your airborne electronic hardware, if applicable. Use the version which is current at time of application.
5.6 EVS/EFVS/CVS System Safety Design Criteria.
A complete functional hazard assessment (FHA) and SSA should be conducted to identify failure modes and classify the hazard levels. Under §§ 23.2500, 23.2505,
25.1309, 27.1309, and 29.1309, the ability of the system design to perform its intended function must be demonstrated through analysis and engineering tests to preclude failures that can cause hazardously misleading information to be presented to the pilot or the flightcrew, or which can otherwise subsequently cause an unsafe condition. The following guidelines do not preclude the results of a full SSA. The results of an SSA found acceptable to the FAA should prevail.
5.7 EVS/EFVS/CVS Required Safety Level.
Under §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309, the applicant must perform a safety assessment based on the proposed installation for the given aircraft and intended function for each phase of flight. The SSA should address both the loss and the incorrect display of information, including hazardously misleading information. The hazard effects of all malfunction of the EVS/EFVS/CVS that could adversely affect interfaced equipment or associated systems should be determined and assessed according to the applicable certification rules and associated advisory materials.
5.7.1 Transport Category Airplanes.
Section 25.1309 defines the safety requirement, and ARAC-recommended § 25.1309 and Arsenal Guidance provide guidance for demonstrating compliance to show verification.
5.7.2 Non-Transport Category Airplanes.
Sections 23.2500 and 23.2505 define the regulatory safety requirement, and AC 23- 1309-1E provides guidance for demonstrating compliance. Severity of failure conditions and software development assurance levels are found in AC 23.1309-1E.
5.7.3 Rotorcraft.
Sections 27.1309 and 29.1309 define the safety requirements. Regulatory guidance can be found in AC 27-1B CHG 1-9 and AC 29-2C CHG 9.Once the safety assessment has been completed, for any hazard or failure classification greater than Major, an FTA 5-3
AC 20-167B should be evaluated using the guidance found in the FAA system safety AC that is applicable to the installation. The FTA should include the display monitor, power supply, imaging camera and sensors, cable, status annunciations, and other components that affect the top-level events.
5.7.4 The SSA should consider the sample operating phases in Table 2-1.
Table 2-1. System Operating Phases for Considerations
GROUND TAKEOFF IN-FLIGHT LANDING
(1) Taxi
(2) Maintenance
(1) Takeoff Roll Prior to V1
(2) Takeoff Roll After V1
(3) Takeoff After VR to 200’
(4) Rejected Takeoff
(1) Climb
(2) Gear Up
(3) Cruise
(4) Descent
(5) Gear Down
(6) Approach 200’ to 0’
(7) Go Around
(1) Touchdown & Rollout
(2) Taxi
5.7.5 The normal operation (without malfunction) of the EVS/EFVS/CVS should not adversely affect or be adversely affected by other normally operating aircraft functions.
As applicable, similar criteria are found in SAE ARP 4754 and ARP 4761A.
5.7.6 Demonstration.
Under §§ 23.2600, 25.771(a), 27.771(a), 29.771(a) and 25.1302(b), to meet the safety criteria, the EFVS design must be demonstrated to mitigate any failure combinations that can cause hazardously misleading information to be presented to the flightcrew, or which can otherwise subsequently cause an unsafe condition. Failures which are selfevident or made obvious to the flightcrew, and with which they can safely cope, need not be specifically monitored.
5.7.7 State Data.
The aircraft state data are provided by the standard inertial, air data, and radio guidance sensors. Under §§ 23.1309, 25.1309, 27.1309 and 29.1309, the HUD or display processor will be required to be at a sufficient level of safety for the aircraft type and application to detect critical random or common faults that could otherwise cause an unsafe condition. The ability to continue the approach below the standard Category I DA/DH or MDA into the visual segment therefore is strictly borne by the pilot, a safety factor already accounted for in the safety analysis for standard Category I operations.
5.7.8 EFVS system safety design criteria analysis (as applicable).
To demonstrate compliance with §§ 23.2500, 23.2505, 25.1309, 27.1309, 29.1309:
5.7.8.1 The overall level of safety of the aircraft is based on installed equipment.
A complete SSA should be conducted to identify failure modes and classify the hazard levels. To meet the safety criteria, the system design 5-4
AC 20-167B should preclude failures that can cause hazardously misleading information (HMI) to be presented to the pilot or the flightcrew, or which can otherwise subsequently cause an unsafe condition. For example, HMI could include information providing attitude, altitude, and distance cues as outside terrain imagery.
5.7.8.2 The EFVS system must perform its intended function for each applicable operation and phase of flight in which it would be used.
5.7.8.3 The normal operation of the EFVS must not adversely affect or be adversely affected by other aircraft systems. The EFVS should annunciate detected malfunctions of the system and remove the malfunctioning display elements.
5.7.8.4 RTCA DO-315A, appendix C, lists sample categories of systems and failure probabilities to meet the safety criteria in transport category airplanes. The applicant should consider these samples when adapting to their specific design and the intended aircraft type (i.e., part 23, 25, 27 or 29 aircraft). The following additional guidance helps assess the criticality of the EFVS display, including the potential to display HMI:
• AC 25-11B (chapter 4);
• AC 23.1311-1C; and
• AC 27-1B CHG 1-9 and AC 29-2C CHG 9, as appropriate for the installation.
5.7.8.5 The applicant should validate all alleviating flightcrew actions and any cues that provide crew awareness (e.g.: alerts, status) that are considered in the EFVS safety analysis during testing either for incorporation in the AFM/airplane flight manual supplement or rotorcraft flight manual/rotorcraft flight manual supplement (RFM/RFMS) limitation section or procedures section, or for inclusion in type-specific training.
5.7.9 EFVS approach system required level of safety analysis (as applicable).
To demonstrate compliance with §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309 should take the following items into consideration:
5.7.9.1 Safety design goals for airworthiness approval should be established when designing an EFVS approach system. The safety criteria for each phase of flight, including approach and landing systems, are defined in terms of accuracy, continuity, availability, and integrity. FAA design guidance provides criteria to determine the overall required level of safety for the aircraft in any mode of flight, for any combination of failures which can cause an unsafe condition to be fully assessed and categorized. For failures where the SSA assumes a particular pilot intervention to limit the hazard effects, for example from Catastrophic or Hazardous to Major or Minor, 5-5
AC 20-167B the applicant should show the pilot can perform that intervention. For example, a pilot might be assumed to detect a system error because of other displays or what is being viewed out the window. It should be demonstrated that pilots can detect the error in a timely fashion and not be hazardously misled. The demonstration must validate the proposed hazard classification, as applicable.
5.7.9.2 The applicant should demonstrate a satisfactory safety (failure and performance) level which should not be less than the safety level required for non-EFVS approach system based precision and non-precision approaches with decision altitudes of 200 ft. or above. In showing compliance, probabilities cannot be factored by the fraction of approaches which are made using EFVS. Consideration, however, can be given to the EFVS approach system critical flight time, such as from the highest DA/DH that can be expected for an EFVS approach system based approach to 100 ft. above the TDZE.
5.7.9.3 The design assurance levels (DALs) are directly linked to the specific intended use and to the specific EFVS approach system installation as an integrated part of the flightdeck flight information system.
5.7.9.4 There are failure modes within the EFVS approach system which determine that software and hardware DALs should use the criteria of the latest versions of RTCA DO-178 (for software) and DO-254 (for hardware) level C as a minimum. Depending upon specific functions or system architecture, a higher DAL (for example see RTCA DO-315A, appendix C) may result from the DAL allocation analysis.
5.7.9.5 The safety assessment process, starting with the FHA, should determine whether the minimum required DAL C is adequate for your specific installation. The example FHA shown in RTCA DO 315A, appendix C is a model case only and cannot be applied to any specific aircraft without independent analysis.
5.7.9.6 The applicant must provide the applicable analysis that is specific for each installation approval. An example SSA of an EFVS approach system is shown in RTCA DO-315A, appendix C.
5.7.9.7 The applicant must conduct a safety analysis to show the EFVS approach system meets all the integrity criteria for the aircraft, HUD, and EFVS.
The applicant should demonstrate system and subsystem malfunctions, which are not extremely improbable, as appropriate in a simulation or in flight. The malfunction annunciation and fault detection schemes must achieve the determined level of safety.
5.7.10 EFVS landing system required level of safety analysis (as applicable).
To demonstrate compliance with §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309:
5-6
AC 20-167B
5.7.10.1 The applicant should demonstrate a satisfactory level of safety (failure and performance) appropriate to the operations being addressed, but with the visual segment primarily accomplished by the use of an EFVS landing system rather than natural vision.
5.7.10.2 To achieve the required safety level, the minimum baseline safety levels required for the installed EFVS landing system equipment regardless of visibility, should be dependent on the demonstrated performance.
5.7.10.3 An aircraft level FHA and SSA should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine the minimum required software and hardware DALs based on the applicant’s specific installation. Mitigating system design features include redundancy, independent guidance display, system monitoring, pilot in the loop, pilot not flying, etc. In no case should the DAL be less than DAL B.
5.7.10.4 The minimum required safety level for an EFVS landing system (EFVS to touchdown and roll out in visibilities not less than runway visual range (RVR) 1000 feet) is based on the assumption that the EFVS being approved can demonstrate that the flightcrew can verify that the aircraft is safely approaching the runway for EFVS landing system based landing, or if not, to initiate a timely go-around if sufficient enhanced visibility is not achieved. This provides additional integrity to the operation. Depending on the applicant’s design, it may be possible that the proposed natural visibility can also compensate for loss of EFVS imagery, such that the pilot can use the remaining symbolic flight information on the HUD and the external view to safely land. System evaluation should consider EFVS landing system failure modes and whether the pilot can safely land and rollout with available natural vision plus whatever capability remains of the EFVS landing system. A safe landing should not be assumed with only available natural vision after total loss of the EFVS landing system (i.e., symbology and image).
5.7.10.5 In showing compliance with these safety criteria, the applicant should not factor probabilities of EFVS landing system failure conditions by the fraction of approaches which require use of the EFVS landing system.
Also, the applicant should not factor probabilities of EFVS landing system failure conditions by a statistical distribution of visibility conditions. The exposure time used for EFVS landing system failure calculations should be the elapsed time from descent below the highest expected DA/DH for the EFVS landing system-based approach to completion of rollout to a safe taxi speed.
5-7
AC 20-167B
5.7.11 SSA analysis (as applicable).
To demonstrate compliance with §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309 analysis should contain the following elements:
5.7.11.1 An aircraft-level FHA should be prepared by the applicant to assess the hazard level associated with system failure conditions and to determine that the minimum required software and hardware DALs are appropriate to the applicant’s specific intended function.
5.7.11.2 The DALs are directly linked to the specific intended use and to the specific EFVS installation as an integrated part of the flightdeck flight information system. The availability and integrity of situational and flight path information from sources other than the EFVS image and the ability of the pilot monitoring the operation should be considered when assessing the appropriate hazard levels for the EFVS.
5.7.11.3 Under §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309, the applicant must provide an SSA.
5.7.11.4 The SSA should show that the applicant’s specific installation meets all the integrity criteria for the aircraft systems, and EFVS.
5.7.11.5 The applicant may need to demonstrate by flight test or simulation, combinations of EFVS malfunctions that are not shown to be extremely improbable (10-9) as determined by the AIR certification branch and the project specific certification plan (PSCP).
5.7.11.6 Any malfunction fault detection and annunciation schemes must satisfy the required levels of safety and must perform their intended functions.
5.7.11.7 All aircraft configurations to be approved must be addressed.
5.7.12 EFVS Fail Safe Features.
Under 23.2500, 25.1353(a), 27.1351(b), and 29.1353(a), the normal operation of the EFVS must not adversely affect or be adversely affected by other normally operating aircraft systems. Warning information (e.g. annunciations) must be provided to alert the crew to unsafe EFVS operating conditions, including detected malfunctions of the EFVS which could cause display of misleading information. The misleading information should be removed. Alerting annunciations should be displayed to the flightcrew in accordance with AC 23.1311-1C, AC 25.1322-1, AC 25-11B, AC 27-1B CHG 1-9, and AC 29-2C CHG 9 as applicable. Under §§ 23.2500, 23.2505, 25.1309,
27.1309, and 29.1309, the applicant must assess the criticality of the EFVS’s function to display imagery, including the potential to display hazardously misleading information.
That assessment should include the hazardous effects of any malfunction of the EFVS that could adversely affect interfaced equipment or associated systems. See AC 23- 1309-1E, AC 25-11B, and ARAC-recommended 25.1309 and Arsenal Guidance, AC 5-8
AC 20-167B 27-1B CHG 1-9 and AC 29-2C CHG 9. This requirement should be met through an SSA and documented via FTA, FMEA, and FMEA substantiation, or equivalent safety documentation.
5-9
AC 20-167B CHAPTER 6. PERFORMANCE EVALUATION
6.1 EVS/EFVS Performance Demonstration.
The performance demonstration used to establish aircraft system compliance with applicable FAA airworthiness criteria typically includes bench testing, simulation, flight testing, data collection, and data reduction to show that the proposed performance criteria can be met. The performance evaluations should therefore include demonstrations of the kinds of operations and those operations’ flight regimes that are stated as the system’s intended functions. For EFVS, the applicant should demonstrate performance at the lateral and vertical limits for the type of approach (for example, precision, non-precision, and approach with vertical guidance) for which operational credit is sought. Appendix B of this AC provides sample EFVS flight test considerations.
6.1.1 This AC does not prescribe specific test procedures. We recognize that alternative methods can be used. In accordance with §§ 21.17 and 21.97, your test procedures and compliance reports must show compliance with the applicable airworthiness criteria.
System performance tests are the most important tests, as they relate to operational capability. Subsystem tests are used to test subsystems during system buildup to ensure appropriate subsystem performance as it relates to overall system performance.
6.1.2 The applicant should use some or all these four general verification methods as necessary (Refer to AC 23.1309-1E, AC 25.1329-1C, AC 27-1B or AC 29-2C CHG 9 as applicable).
6.1.2.1 Analysis.
Demonstrate compliance using an engineering analysis.
6.1.2.2 Flight Test.
Demonstrate compliance using an aircraft that is fully representative for the purpose of the test in terms of flightdeck geometry, instrumentation, alerts, indications, and controls in the air and on the ground.
6.1.2.3 Laboratory Test.
Demonstrate compliance using an engineering bench representative of the final EVS/CVS/EFVS system being approved.
6.1.2.4 Simulation.
Demonstrate compliance using a flight simulator as accepted by the AIR certification branch in the PSCP.
6.1.3 The applicant should specify the individual verification methods used in the certification plan. Confirm that the responsible AIR certification branch agrees with your plan before you begin. For extensions, features, and design decisions not explicitly specified in this AC, you should conduct human factors evaluations. Conduct these 6-1
AC 20-167B evaluations through appropriate combinations of analyses, bench testing, simulation, or flight testing.
6.1.4 The applicant should verify both the installed system and the individual system components meet the EVS/CVS/EFVS criteria described in Chapter 4 of this AC.
6.1.5 The applicant should demonstrate the system meets performance criteria specified in Chapter 4 by flight test and/or other appropriate means, which can include the use of a flight simulator. An example of a flight test program for EFVS is described in appendix C in this AC. The flight test program assumes that the guidance system utilized to satisfactorily position the aircraft at the DA/DH or MDA has been separately tested and shown to fully perform its intended function. Testing and data collection to demonstrate this is not addressed in this AC.
6.1.6 The applicant should conduct an evaluation of the system used during anticipated operational scenarios, including:
6.1.6.1 EFVS Flight Testing.
Unapproved EFVS systems may be operated on test flights provided that the operation is conducted under § 91.176(d) and the aircraft is issued an experimental certificate under § 21.191.
6.1.6.2 Section 21.191, Experimental Certificates.
Identifies a number of purposes for which an experimental certificate can be issued. Not all of those are eligible for the exception in § 91.176(d).
Section 91.176(d) limits the exception purposes to only those listed in §§ 21.191(a) and 21.191(b). Please note, however, that using an unapproved EFVS to conduct an EFVS operation outside this specific scope would still require a waiver from the applicable operating rules.
For the Administrator to determine that the flight test operations can be conducted safely in accordance with § 91.176(d) and all other applicable regulations, the FAA will evaluate the flight test in accordance with FAA Order 8130.2J, Airworthiness Certification of Aircraft. FAA Order 8130.2J contains detailed instructions about how to obtain an experimental certificate (Chapter 4, Sec. 2 and Chapter 10.) It also describes what the applicant’s program letter must contain (appendix C) and lists what operating limitations must be applied to the experimental certificate (appendix D). As a part of the airworthiness certification process, the FAA determines whether the operations proposed by the applicant can be safely conducted. The FAA issues operating limitations when the program letter is approved, and the experimental certificate is issued.
6.2 Performance Demonstration of EFVS Landing System.
Where appropriate for the performance demonstration, the non-visual conditions can be achieved either by natural obscuration or by the use of a visibility-limiting device in 6-2
AC 20-167B front of the pilot. Caution should be used if the applicant chooses to use a visibilitylimiting device for system performance demonstrations. Visibility-limiting devices may not adequately simulate low visibility conditions for all EFVS landing system landing performance demonstrations because of the unrealistically good external visibility outside the HUD FOV and the unrealistic EFVS landing system image performance in good atmospheric conditions.
6.2.1 Under §§ 23.2610, 25.1523, 27.1523, and 29.1523, the applicant must consider the workload associated with the use of EFVS landing system for approach, landing and rollout.
6.2.2 The system may fly final approach courses with offsets greater than 3 degrees. In this case, the applicant should establish the maximum allowable final approach course offset by flight test. The flight test should address factors related to the offset, such as HUD/EFVS FOV, crosswinds, and the maximum drift angle for a conformal FPV.
6.2.3 The EFVS landing system image with superimposed flight symbology must not mislead, distract or jeopardize the safety of the landing and rollout. Performance should be demonstrated to be no worse than that normally achieved in visual operations for the specific aircraft for all performance parameters measured. See §§ 23.2600, 25.771,
27.771, 29.771 and §§ 23.2500, 23.2505, 25.1309, 27.1309, and 29.1309. The applicant may propose a valid means for establishing performance normally achieved that the FAA may accept as a benchmark for the EFVS demonstrations.
6.2.4 Benchmark data establishing equivalence to normal visual operations with the specific aircraft is not normally necessary. However, if flight test results show deviations for the standard criteria listed above, then benchmark data might be necessary to establish the equivalence of EFVS landing system operations to normal visual operations for that specific aircraft.
6.2.5 Without requiring exceptional pilot skill, alerting, strength, or workload, the EFVS image/symbology should provide the visual cues for the pilot to perform the following items:
6.2.5.1 Speed control within +10/-5 knots of the approach speed, whether manually controlled or with auto-throttle, as proposed by the applicant, up to the point where the throttles are retarded for landing.
6.2.5.2 A smooth transition through flare to landing.
6.2.5.3 Approach, flare, and landing at a normal sink rate for the aircraft.
6.2.5.4 Touchdown within the touchdown zone. The lateral touchdown performance should be demonstrated to be no worse than that achieved in visual landings for the specific aircraft.
6.2.5.5 Prompt and predictable correction of any lateral deviation away from the runway centerline to smoothly intercept the centerline.
6-3